WordPress plugin vulnerabilities: week 27, 2026
174 vulnerabilities published Jun 29 – Jul 5, 2026 in 150 plugins we track, by day.
12 critical 58 high 101 medium 3 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, July 5, 2026 · 3
-
medium 5.3 Exclusive Addons for Elementor
-
medium 5.3 FormLayer
-
medium 4.3 CrawlWP SEO
Friday, July 3, 2026 · 21
-
medium 4.3 RTMKit for Elementor
-
medium 6.4 GenerateBlocks
-
medium 4.3 Ad Inserter
-
medium 5.3 Appointment Booking Plugin
-
medium 5.4 CURCY
-
medium 4.3 Quiz and Survey Master (QSM)
-
medium 6.4 RTMKit for Elementor
-
high 7.2 Comments
-
medium 6.4 JSON API User
-
critical 9.1 Printcart Store
-
medium 6.4 CM Business Directory
-
medium 5.3 MotoPress Appointment Booking
-
medium 6.4 Ultimate Member
-
high 7.5 AR for WooCommerce
-
high 7.2 NEX-Forms
-
medium 5.5 WP Import Export Lite
-
high 7.5 AR for WordPress
-
medium 4.9 WPLP Cookie Consent
-
medium 6.4 weDocs
-
medium 6.4 weDocs
-
medium 4.3 weDocs
Thursday, July 2, 2026 · 77
-
high 8.1 TinyPNG Image Optimization
-
medium 5.3 Sendcloud for WooCommerce
-
medium 5.9 Lasso Lite
-
medium 6.5 affects latest 1.7.0 Structured Content (JSON-LD) #wpsc
-
medium 6.5 affects latest 1.2 Surbma
-
high 8.5 WP EasyCart
-
high 8.8 WPIDE
-
medium 6.5 WPBakery Page Builder Addons by Livemesh
-
medium 5.3 Kit (formerly ConvertKit) for WooCommerce
-
high 8.5 iNET Webkit
-
medium 6.5 Mosaic Gallery
-
high 8.5 nicen-localize-image
-
high 7.1 pCloud WP Backup
-
high 7.1 Permalink Manager for WooCommerce
-
high 8.8 ProfileGrid
-
high 8.1 Heateor Social Login WordPress
-
high 8.5 Custom Field Template
-
critical 9.3 WP Fast Total Search
-
high 8.2 POS Entegratör
-
high 7.1 WowAddons
-
critical 9.3 Geeky Bot
-
medium 6.4 GeoDirectory
-
medium 6.5 Kirki
-
high 7.1 Timetics
-
critical 9.8 Novalnet Payment Gateway for WooCommerce
-
high 7.1 WP Photo Album Plus
-
medium 6.5 Vsourz Form Entries for Contact Form 7
-
critical 9.8 Booktics
-
high 7.1 CodePeople Post Map for Google Maps
-
high 7.1 Optimole
-
critical 9.0 W3 Total Cache
-
high 7.1 wpDataTables
-
high 7.1 WPBot
-
high 7.1 eCommerce Product Catalog
-
high 7.1 Search Atlas SEO
-
high 7.1 ReviewX
-
high 7.1 Survey Maker by AYS
-
high 7.1 WPAdverts
-
medium 6.5 Classified Listing
-
high 7.1 HandL UTM Grabber / Tracker
-
high 7.1 MoreConvert Wishlist for WooCommerce
-
medium 4.8 ALD
Security issue
-
high 7.1 WP Debugging
-
high 7.1 WPeMatico RSS Feed Fetcher
-
high 7.1 Classified Listing
-
medium 6.5 MotoPress Hotel Booking
-
high 7.2 Paid Membership Subscriptions
-
high 7.1 Internal Links Manager
-
medium 6.5 ShortPixel Adaptive Images
-
high 8.8 Themify Popup
-
high 7.5 NOWPayments for WooCommerce
-
critical 9.1 Five Star Business Profile and Schema
-
medium 5.3 affects latest 1.6.2 Woostify Sites Library
-
high 7.2 WP Database Backup
-
medium 6.4 RSS Aggregator by Feedzy
-
medium 6.5 Groundhogg
-
medium 5.3 JetFormBuilder
-
medium 4.3 JoomSport
-
medium 5.3 Kirki
-
medium 5.3 Kirki
-
medium 5.3 Appointment Booking Plugin
-
medium 5.3 My Calendar
-
medium 4.4 Product Video Gallery for Woocommerce
-
medium 5.3 Academy LMS
-
high 8.1 Image Optimizer
-
low 2.7 Adminify
Security issue
-
medium 6.4 GiveWP
-
medium 4.9 Houzez Property Feed
-
high 7.5 Request a Quote
-
medium 6.5 User Registration & Membership
Security issue
-
low 2.7 Fluent Forms
Security issue
-
medium 6.4 Insert Pages
Wednesday, July 1, 2026 · 47
-
medium 5.9 Enable Media Replace
-
high 7.4 HubSpot All-In-One Marketing
-
medium 5.3 ApplyOnline
-
medium 4.3 ThumbPress
-
medium 5.3 Easy Appointment Booking & Scheduling Plugin
-
critical 9.8 Private Content
-
high 8.8 Appointment Booking Plugin
-
high 7.2 NEX-Forms
-
medium 6.4 WP Photo Album Plus
-
medium 6.5 MotoPress Appointment Booking
-
medium 6.1 VikBooking Hotel Booking Engine & PMS
-
medium 6.4 Download Manager
-
medium 6.4 LearnPress
-
medium 4.3 Motors
-
high 8.8 RegistrationMagic
-
medium 4.3 Slim SEO
-
critical 9.8 SMS Alert
-
medium 4.3 Qi Blocks
-
low 3.1 Fluent Forms
-
high 7.5 Ninja Forms
-
medium 4.3 Salon Booking System
Security issue
-
medium 4.2 User Submitted Posts
-
high 8.1 Royal MCP
Security issue
-
medium 4.3 WS Form LITE
Security issue
-
medium 6.4 Kali Forms
-
critical 9.1 WP-BusinessDirectory
-
medium 6.4 Event Organiser
-
high 7.2 WPBot
-
medium 6.4 GiveWP
-
medium 6.4 Tutor LMS
-
high 7.5 Visualizer
-
medium 6.1 WP Google Review Slider
-
high 7.5 Video Gallery
-
medium 4.3 Appointment Booking Calendar
-
medium 6.4 FV Flowplayer Video Player
-
medium 4.3 JoomSport
-
medium 4.3 Kadence Blocks
-
medium 4.3 Kadence Blocks
-
medium 6.5 Taskbuilder
-
medium 5.3 WPForms
Security issue
-
medium 4.3 GiveWP
-
medium 6.4 JetWidgets For Elementor
-
medium 6.5 LearnPress
-
medium 6.5 Taskbuilder
Tuesday, June 30, 2026 · 10
-
high 7.2 Webmention
-
medium 4.9 Fluent Booking
-
high 8.0 Export User Data
-
medium 5.9 Kali Forms
-
medium 4.4 Editorial Rating
-
medium 5.3 Premium Addons for KingComposer
-
critical 9.8 ProfileGrid
-
medium 6.5 PixMagix
-
medium 4.4 Team Members
Monday, June 29, 2026 · 16
-
medium 6.5 Business Directory Plugin
-
medium 6.5 Colissimo shipping methods for WooCommerce
-
high 7.1 Landing Page Builder
-
medium 6.5 Japanized for WooCommerce
-
medium 6.5 Business Directory Plugin
-
high 7.1 Link Whisper Free
-
medium 6.5 MasterStudy LMS WordPress Plugin
-
critical 9.9 Paid Videochat Turnkey Site
-
medium 6.5 Quads Ads Manager for Google AdSense
-
high 7.1 Wallet System for WooCommerce
-
medium 6.5 User Frontend
-
medium 6.1 Business Directory Plugin
-
medium 6.3 MainWP Dashboard
-
high 7.1 BEAR
-
high 7.1 Embed Privacy
-
medium 4.3 Simple User Avatar
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.