WordPress plugin vulnerabilities: week 28, 2026

175 vulnerabilities published Jul 6 – Jul 12, 2026 in 155 plugins we track, by day.

9 critical 48 high 118 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, July 11, 2026 · 49

• high 8.8 Genolve

  Privilege escalation

  CVE-2026-1359 · affected 5.0.5 and older · fixed in 5.0.6 *

• high 7.5 W3 Total Cache

  Path traversal / file read

  CVE-2026-9282 · affected 2.9.4 and older · fixed in 2.10.0 *

• medium 6.4 bbp style pack

  Stored cross-site scripting (XSS)

  CVE-2026-15010 · affected 6.4.5 and older · fixed in 6.4.6 *

• high 7.2 CorvusPay WooCommerce Payment Gateway

  Stored cross-site scripting (XSS)

  CVE-2026-6939 · affected 2.7.4 and older · fixed in 2.7.5 *

• high 7.5 WP CTA

  SQL injection

  CVE-2026-4661 · affected 2.2.2 and older · fixed in 2.3.0 *

• high 8.8 Essential Addons for Elementor

  Weak password recovery

  CVE-2026-15155 · affected 6.6.10 and older · fixed in 6.6.11 *

• medium 6.4 affects latest 1.0.7 fresh Podcaster

  Stored cross-site scripting (XSS)

  CVE-2026-1382 · affected 1.0.7 and older · no fix listed yet

• medium 5.3 NEX-Forms

  Missing authorization check

  CVE-2026-9017 · affected 9.2.2 and older · fixed in 9.2.3 *

• medium 5.3 WCFM

  Missing authorization check

  CVE-2026-12994 · affected 6.7.27 and older · fixed in 6.7.28 *

• medium 6.4 WCFM Marketplace

  Stored cross-site scripting (XSS)

  CVE-2026-12126 · affected 3.7.3 and older · fixed in 3.7.4 *

• medium 4.4 White Label CMS

  Stored cross-site scripting (XSS)

  CVE-2026-11898 · affected 2.7.12 and older · fixed in 2.7.13 *

• medium 4.3 Wallet for WooCommerce

  Missing authorization check

  CVE-2026-12103 · affected 1.6.4 and older · fixed in 1.6.5 *

• medium 4.3 WP Easy Pay

  Missing authorization check

  CVE-2026-12738 · affected 4.5.0 and older · fixed in 4.5.1 *

• medium 5.3 WP Hotel Booking

  Security issue

  CVE-2026-11901 · affected 2.3.1 and older · fixed in 2.3.2 *

• medium 4.4 Widgets for Google Reviews

  Stored cross-site scripting (XSS)

  CVE-2026-11591 · affected 13.3 and older · fixed in 13.3.2 *

• medium 4.9 Catalyst Connect Zoho CRM Client Portal

  SQL injection

  CVE-2025-5017 · affected 2.2.0 and older · fix not stated

• medium 5.3 Cost Calculator Builder

  Information disclosure

  CVE-2026-10865 · affected 4.0.11 and older · fixed in 4.0.12 *

• medium 4.3 WCFM

  Missing authorization check

  CVE-2026-10041 · affected 6.7.27 and older · fixed in 6.7.28 *

• high 8.1 SureCart

  Privilege escalation

  CVE-2026-7655 · affected 4.2.3 and older · fixed in 4.3.0 *

• high 7.2 Form Vibes

  Stored cross-site scripting (XSS)

  CVE-2026-13378 · affected 1.5.2 and older · fixed in 1.5.3 *

• medium 4.3 Affilia

  Missing authorization check

  CVE-2026-7559 · affected 3.3.3 and older · fixed in 3.3.4 *

• medium 5.3 AI Copilot

  Missing authorization check

  CVE-2026-6804 · affected 1.4.12 and older · fix not stated

• medium 5.3 AI Copilot

  Missing authorization check

  CVE-2026-6803 · affected 1.4.12 and older · fix not stated

• medium 4.3 Notification for Telegram

  Missing authorization check

  CVE-2026-7620 · affected 3.5.1 and older · fixed in 3.5.2 *

• high 7.2 Planyo online reservation system

  File inclusion

  CVE-2026-3576 · affected 3.0 and older · fixed in 3.1 *

• medium 4.4 Print, PDF & Email by PrintFriendly

  Stored cross-site scripting (XSS)

  CVE-2026-9738 · affected 5.5.10 and older · fixed in 5.5.11 *

• medium 4.3 SurfLink

  Missing authorization check

  CVE-2026-3552 · affected older than 2.6.0 · fixed in 2.6.0

• high 8.8 Swiss Toolkit For WP

  Arbitrary file upload

  CVE-2026-2354 · affected 1.4.6 and older · fix not stated

• medium 4.3 ThriveDesk

  Missing authorization check

  CVE-2026-1832 · affected 2.1.7 and older · fixed in 2.2.0 *

• high 7.5 Booking Package

  SQL injection

  CVE-2026-15335 · affected 1.7.20 and older · fixed in 1.7.21 *

• medium 4.9 Premium Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-12141 · affected 4.11.84 and older · fixed in 4.11.85 *

• high 8.8 Simple JWT Login

  Privilege escalation

  CVE-2026-14262 · affected 3.6.6 and older · fixed in 3.6.7 *

• medium 5.3 Solace Extra

  Missing authorization check

  CVE-2026-13250 · affected 1.5.3 and older · fixed in 1.6.0 *

• medium 6.4 Themify Builder

  Stored cross-site scripting (XSS)

  CVE-2026-15097 · affected 7.7.6 and older · fixed in 7.7.7 *

• medium 6.4 Themify Builder

  Stored cross-site scripting (XSS)

  CVE-2026-15096 · affected 7.7.6 and older · fixed in 7.7.7 *

• medium 4.3 PDF Invoices & Packing Slips for WooCommerce

  Missing authorization check

  CVE-2026-13116 · affected 5.14.0 and older · fixed in 5.15.0 *

• medium 6.4 Starboard Suite Reservation Calendars

  Stored cross-site scripting (XSS)

  CVE-2025-13968 · affected 3.1.4 and older · fixed in 3.1.5 *

• medium 4.3 MyParcel

  Missing authorization check

  CVE-2026-8678 · affected 4.25.1 and older · fixed in 4.25.2 *

• medium 4.3 Mux Video Uploader

  Information disclosure

  CVE-2026-7544 · affected 1.1.4 and older · fixed in 1.1.5 *

• medium 4.4 Lockme calendars integration

  Stored cross-site scripting (XSS)

  CVE-2026-3367 · affected 2.11.0 and older · fixed in 2.11.1 *

• medium 6.4 SimpLy Gallery

  Stored cross-site scripting (XSS)

  CVE-2026-5743 · affected 3.3.3.1 and older · fixed in 3.3.3.2 *

• high 7.5 LA-Studio Element Kit for Elementor

  File inclusion

  CVE-2026-15338 · affected 1.6.1 and older · fixed in 1.6.2 *

• medium 6.5 KiviCare

  SQL injection

  CVE-2026-15073 · affected 4.5.0 and older · fixed in 4.5.1 *

• medium 6.5 KiviCare

  SQL injection

  CVE-2026-15072 · affected 4.5.0 and older · fixed in 4.5.1 *

• medium 6.5 Majestic Support

  SQL injection

  CVE-2026-13262 · affected 1.1.9 and older · fixed in 1.2.0 *

• medium 5.3 Members

  Information disclosure

  CVE-2026-12426 · affected 3.2.22 and older · fixed in 3.2.23 *

• high 7.2 Motors

  Stored cross-site scripting (XSS)

  CVE-2026-13114 · affected 1.4.112 and older · fixed in 1.4.113 *

• high 8.8 WP Ultimate CSV Importer

  Remote code execution

  CVE-2026-13353 · affected 8.0.1 and older · fixed in 8.1 *

• medium 4.3 Points and Rewards for WooCommerce

  Missing authorization check

  CVE-2026-10628 · affected 2.10.1 and older · fixed in 2.10.2 *

Friday, July 10, 2026 · 51

• critical 9.8 Social Login, Social Sharing by miniOrange

  Authentication bypass

  CVE-2026-12761 · affected 7.7.0 and older · fixed in 7.8.0 *

• medium 5.3 Eventin

  Missing authorization check

  CVE-2026-13039 · affected 4.0.26 to 4.1.15 · fixed in 4.1.16 *

• medium 4.4 Ajax Load More

  Stored cross-site scripting (XSS)

  CVE-2026-15295 · affected 7.0.1 and older · fixed in 7.0.2 *

• high 7.2 GEO Plugin by Squirrly SEO

  Stored cross-site scripting (XSS)

  CVE-2026-1667 · affected 14.0.0 and older · fixed in 14.0.1 *

• medium 4.3 Invoice123

  Missing authorization check

  CVE-2026-9857 · affected 1.7.0 and older · fixed in 1.7.1 *

• medium 6.4 Jeg Kit for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-13710 · affected 3.2.6 and older · fixed in 3.2.7 *

• medium 6.5 JoomSport

  SQL injection

  CVE-2026-13010 · affected 5.7.9 and older · fixed in 5.7.10 *

• medium 6.4 Logo Slider WP

  Stored cross-site scripting (XSS)

  CVE-2026-13247 · affected 5.5 and older · fixed in 5.5.4 *

• medium 4.9 Mail Mint

  SQL injection

  CVE-2026-12918 · affected 1.24.1 and older · fixed in 1.24.2 *

• medium 5.3 KiviCare

  Missing authorization check

  CVE-2026-11990 · affected 4.4.0 and older · fixed in 4.5.0 *

• medium 6.1 ICS Calendar

  Reflected cross-site scripting (XSS)

  CVE-2026-9838 · affected 12.0.9 and older · fixed in 12.0.9.2 *

• medium 6.5 BetterDocs

  SQL injection

  CVE-2026-15104 · affected 4.6.0 and older · fixed in 4.6.1 *

• medium 5.3 Easy Upload Files During Checkout

  Missing authorization check

  CVE-2026-6802 · affected 3.0.1 and older · fixed in 3.0.2 *

• medium 4.9 WPLP Cookie Consent

  SQL injection

  CVE-2026-14475 · affected 4.3.6 and older · fixed in 4.3.7 *

• medium 4.3 GoodMeet

  Cross-site request forgery (CSRF)

  CVE-2026-6440 · affected 1.1.8 and older · fixed in 1.1.9 *

• medium 4.3 GW AI Website Builder

  Missing authorization check

  CVE-2026-1946 · affected 1.0.1 and older · fix not stated

• medium 6.4 Hostel

  Stored cross-site scripting (XSS)

  CVE-2026-3907 · affected 1.1.7 and older · fixed in 1.1.8 *

• medium 4.3 Import and export users and customers

  Information disclosure

  CVE-2026-15026 · affected 2.4.0 and older · fixed in 2.4.1 *

• medium 4.3 Easy Appointments

  Missing authorization check

  CVE-2026-11992 · affected 3.12.27 and older · fixed in 3.12.28 *

• medium 4.3 FlowForms

  Missing authorization check

  CVE-2026-12400 · affected 1.1.1 and older · fixed in 1.1.2 *

• medium 4.3 WPLP Cookie Consent

  Missing authorization check

  CVE-2026-12955 · affected 4.3.6 and older · fixed in 4.3.7 *

• medium 4.4 Highlighting Code Block

  Stored cross-site scripting (XSS)

  CVE-2026-12108 · affected 2.2.0 and older · fixed in 2.2.1 *

• medium 6.4 Eventin

  Stored cross-site scripting (XSS)

  CVE-2026-12924 · affected 4.1.15 and older · fixed in 4.1.16 *

• medium 6.6 Happyforms

  File inclusion

  CVE-2025-11977 · affected 1.26.12 and older · fixed in 1.26.13 *

• high 7.5 Hide My WP Lite

  Path traversal / file read

  CVE-2026-13347 · affected 1.3 and older · fix not stated

• medium 5.3 LA-Studio Element Kit for Elementor

  Security issue

  CVE-2026-12276 · affected older than 1.6.1 · fixed in 1.6.1

• medium 6.4 All-in-One Video Gallery

  Server-side request forgery (SSRF)

  CVE-2026-12123 · affected 4.8.5 and older · fixed in 4.9.0 *

• medium 6.4 Animation Addons

  Stored cross-site scripting (XSS)

  CVE-2026-15299 · affected 2.6.3 and older · fixed in 2.6.4 *

• medium 5.3 ARMember

  Path traversal / file read

  CVE-2026-15302 · affected 4.0.27 and older · fix not stated

• critical 9.1 GEO my WP

  SQL injection

  CVE-2026-15300 · affected 4.5.4 and older · fixed in 4.5.5 *

• medium 6.4 BuddyHolis TableSearch

  Stored cross-site scripting (XSS)

  CVE-2026-15301 · affected 1.1.0 and older · fix not stated

• high 7.2 TelSender

  DOM-based cross-site scripting (XSS)

  CVE-2026-15298 · affected 1.14.14 and older · fixed in 1.14.15 *

• medium 6.4 affiliate-toolkit

  Stored cross-site scripting (XSS)

  CVE-2026-15296 · affected 3.7.0 and older · fixed in 3.7.7 *

• medium 5.9 Booking calendar, Appointment Booking System

  SQL injection

  CVE-2026-15289 · affected 3.2.17 and older · fix not stated

• high 7.5 ChatHelp

  Information disclosure

  CVE-2026-15291 · affected 3.1.3 and older · fixed in 3.1.4 *

• medium 6.1 Brevo

  Reflected cross-site scripting (XSS)

  CVE-2026-15297 · affected 3.1.77 and older · fixed in 3.1.78 *

• medium 6.4 Sudoku Shortcode

  Stored cross-site scripting (XSS)

  CVE-2026-15292 · affected 1.0.0 and older · fix not stated

• high 7.5 Ultimate Member

  SQL injection

  CVE-2026-15290 · affected 2.10.1 and older · fixed in 2.10.2 *

• high 8.0 WP Business Intelligence Lite

  Privilege escalation

  CVE-2026-15293 · affected 3.2.0 and older · fix not stated

• medium 6.5 rtMedia for WordPress, BuddyPress and bbPress

  SQL injection

  CVE-2026-15287 · affected 4.6.18 and older · fixed in 4.6.19 *

• medium 4.3 Kadence Blocks

  Missing authorization check

  CVE-2026-15286 · affected 3.5.32 and older · fixed in 3.6.0 *

• medium 6.4 King Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-15284 · affected 51.1.62 and older · fixed in 51.1.63 *

• high 7.5 SureForms

  Security issue

  CVE-2026-15288 · affected 2.2.1 and older · fixed in 2.2.2 *

• medium 6.4 The Plus Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-15285 · affected 6.4.11 and older · fixed in 6.4.12 *

• critical 9.8 Instant Appointment

  Arbitrary file upload

  CVE-2026-15282 · affected 1.2 and older · fix not stated

• medium 4.4 WPvivid Backup for MainWP

  Stored cross-site scripting (XSS)

  CVE-2026-15283 · affected 0.9.33 and older · fixed in 0.9.34 *

• medium 5.4 Fluent Forms

  Missing authorization check

  CVE-2026-5069 · affected 6.2.1 and older · fixed in 6.2.2 *

• high 7.2 Post Export Import with Media

  Arbitrary file upload

  CVE-2026-13430 · affected 1.13.1 and older · fixed in 1.13.2 *

• high 8.8 Salon Booking System

  Cross-site request forgery (CSRF)

  CVE-2026-15070 · affected 10.30.32 and older · fixed in 10.30.34 *

• medium 5.4 WPCafe

  Missing authorization check

  CVE-2026-11818 · affected 3.0.14 and older · fixed in 3.0.15 *

• medium 6.1 WP Hotel Booking

  Reflected cross-site scripting (XSS)

  CVE-2026-11392 · affected 2.3.1 and older · fixed in 2.3.2 *

Thursday, July 9, 2026 · 36

• high 8.8 UsersWP

  Arbitrary file deletion

  CVE-2026-13492 · affected 1.2.65 and older · fixed in 1.2.66 *

• medium 4.3 Colissimo shipping methods for WooCommerce

  Missing authorization check

  CVE-2026-9240 · affected 2.9.0 and older · fixed in 2.10.0 *

• medium 5.3 CorvusPay WooCommerce Payment Gateway

  Missing authorization check

  CVE-2026-9028 · affected 2.7.4 and older · fixed in 2.7.5 *

• medium 5.3 CorvusPay WooCommerce Payment Gateway

  Security issue

  CVE-2026-9027 · affected 2.7.4 and older · fixed in 2.7.5 *

• medium 4.3 DHL eCommerce (Benelux) for WooCommerce

  Missing authorization check

  CVE-2026-9235 · affected 2.2.3 and older · fixed in 2.2.4 *

• medium 4.3 Employee, Leave and Recruitment Management Sys…

  Missing authorization check

  CVE-2026-9237 · affected 1.2.2 and older · fixed in 1.2.3 *

• medium 5.3 Easy Invoice

  Missing authorization check

  CVE-2026-9021 · affected 2.2.19 and older · fixed in 2.3.1 *

• high 8.8 Divi Torque Lite

  Cross-site request forgery (CSRF)

  CVE-2026-4275 · affected 4.2.3 and older · fixed in 4.3.0 *

• medium 4.3 DSGVO All in one for WP

  Missing authorization check

  CVE-2026-4298 · affected 4.9 and older · fix not stated

• medium 6.5 Blocks for ACF Fields

  Missing authorization check

  CVE-2026-12428 · affected 1.6.2 and older · fixed in 1.6.3 *

• high 7.1 Bit Form

  Arbitrary file deletion

  CVE-2026-14372 · affected 3.1.1 and older · fixed in 3.1.2 *

• high 7.2 EventPrime

  Stored cross-site scripting (XSS)

  CVE-2026-13441 · affected 4.3.4.2 and older · fixed in 4.3.4.3 *

• critical 9.8 Blocksy Companion

  Arbitrary file upload

  CVE-2026-15158 · affected 2.1.46 and older · fixed in 2.1.47 *

• medium 4.3 Hydra Booking

  Missing authorization check

  CVE-2026-12433 · affected 1.2.1 and older · fixed in 1.2.2 *

• medium 6.4 Bookero.pl

  Stored cross-site scripting (XSS)

  CVE-2026-6910 · affected 2.2 and older · fix not stated

• high 7.2 Popup Maker

  Remote code execution

  CVE-2026-8848 · affected 1.22.0 and older · fixed in 1.23.0 *

• medium 5.3 Age Verification & Identity Verification by To…

  Missing authorization check

  CVE-2026-7558 · affected 4.0.2 and older · fixed in 4.0.3 *

• medium 6.5 Backup and Staging by WP Time Capsule

  Information disclosure

  CVE-2026-8996 · affected 1.22.26 and older · fixed in 1.22.27 *

• medium 6.4 Block, Suspend, Report for BuddyPress

  Stored cross-site scripting (XSS)

  CVE-2026-4653 · affected 3.6.4 and older · fixed in 3.6.5 *

• high 7.2 Connect Contact Form 7 to Mailchimp, Brevo, Ma…

  Stored cross-site scripting (XSS)

  CVE-2026-15000 · affected 0.9.78.06 and older · fixed in 26.11.01.19 *

• medium 6.4 Download Manager

  Stored cross-site scripting (XSS)

  CVE-2026-14343 · affected 3.3.61 and older · fixed in 3.3.62 *

• medium 4.9 Mail Mint

  SQL injection

  CVE-2026-14342 · affected 1.24.2 and older · fixed in 1.24.3 *

• medium 6.4 Customer Reviews for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2026-13771 · affected 5.113.0 and older · fixed in 5.114.0 *

• medium 6.5 ERP

  SQL injection

  CVE-2026-13011 · affected 1.17.5 and older · fixed in 1.17.6 *

• medium 5.3 GamiPress

  Missing authorization check

  CVE-2026-13450 · affected 7.9.4 and older · fixed in 7.9.9 *

• medium 6.1 Mang Board

  Reflected cross-site scripting (XSS)

  CVE-2026-13334 · affected 2.3.4 and older · fixed in 2.3.5 *

• critical 9.8 miniOrange OTP Login, Verification and SMS Not…

  Authentication bypass

  CVE-2026-14245 · affected 5.5.1 and older · fixed in 5.5.2 *

• medium 6.4 Post Grid Blocks & Templates for News, Magazin…

  Stored cross-site scripting (XSS)

  CVE-2026-13253 · affected 5.0.31 and older · fix not stated

• medium 5.3 User Frontend

  Missing authorization check

  CVE-2026-12418 · affected 4.3.7 and older · fixed in 4.3.8 *

• medium 6.6 WPFunnels

  File inclusion

  CVE-2026-13080 · affected 3.12.7 and older · fixed in 3.12.8 *

• medium 6.4 AcyMailing

  Stored cross-site scripting (XSS)

  CVE-2026-12170 · affected 10.10.2 and older · fixed in 10.11.1 *

• medium 4.3 Memberships and User Profiles for WooCommerce

  Missing authorization check

  CVE-2026-11359 · affected 3.4 and older · fixed in 3.4.1 *

• medium 5.3 User Frontend

  Missing authorization check

  CVE-2026-12406 · affected 4.3.7 and older · fixed in 4.3.8 *

• medium 6.5 Everest Forms

  Security issue

  CVE-2026-12270 · affected 3.4.2 up to (not including) 3.5.0 · fixed in 3.5.0

• high 7.5 Everest Forms

  Security issue

  CVE-2026-11571 · affected older than 3.5.0 · fixed in 3.5.0

• medium 5.3 WP DSGVO Tools (GDPR)

  Security issue

  CVE-2026-11869 · affected older than 3.1.40 · fixed in 3.1.40

Wednesday, July 8, 2026 · 30

• medium 6.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-6459 · affected 6.6.2 and older · fixed in 6.6.3 *

• medium 6.4 Nexter Blocks

  Stored cross-site scripting (XSS)

  CVE-2026-6740 · affected 4.7.4 and older · fixed in 4.7.5 *

• high 7.2 VikBooking Hotel Booking Engine & PMS

  Stored cross-site scripting (XSS)

  CVE-2026-6820 · affected 1.8.8 and older · fixed in 1.8.9 *

• high 7.5 Appointment Booking Plugin

  Missing authorization check

  CVE-2026-5356 · affected 5.4.0 and older · fixed in 5.4.1 *

• medium 5.3 User Frontend

  Missing authorization check

  CVE-2026-5459 · affected 4.3.1 and older · fixed in 4.3.2 *

• medium 4.7 Smash Balloon Social Photo Feed

  Cross-site request forgery (CSRF)

  CVE-2026-12002 · affected 6.11.1 and older · fixed in 6.11.2 *

• high 7.5 My Calendar

  SQL injection

  CVE-2026-6854 · affected 3.7.8 and older · fixed in 3.7.18 *

• high 7.2 VikBooking Hotel Booking Engine & PMS

  Stored cross-site scripting (XSS)

  CVE-2026-6818 · affected 1.8.8 and older · fixed in 1.8.9 *

• medium 6.4 Advanced iFrame

  Stored cross-site scripting (XSS)

  CVE-2026-6742 · affected 2026.1 and older · fixed in 2026.3 *

• high 7.5 Tainacan

  SQL injection

  CVE-2026-6230 · affected 1.0.3 and older · fixed in 1.1.0 *

• medium 6.3 TH Login Registration

  Privilege escalation

  CVE-2026-14250 · affected 1.0.2 and older · fixed in 1.0.3 *

• high 8.1 WCFM Membership

  Missing authorization check

  CVE-2026-3688 · affected 2.11.10 and older · fixed in 2.11.11 *

• medium 4.9 Recurio

  SQL injection

  CVE-2026-12936 · affected 1.1.3 and older · fixed in 1.1.4 *

• medium 6.4 Website Builder by SeedProd

  Stored cross-site scripting (XSS)

  CVE-2025-14785 · affected 6.20.2 and older · fixed in 6.20.3 *

• high 7.5 Eventer

  SQL injection

  CVE-2026-9700 · affected 4.4.2 and older · fix not stated

• medium 4.3 Wp Js Detect

  Cross-site request forgery (CSRF)

  CVE-2026-9731 · affected 1.0.9 and older · fix not stated

• medium 5.3 Bulk Order Update for WooCommerce

  Path traversal / file read

  CVE-2026-14500 · affected 1.6 and older · fix not stated

• high 8.8 DoLogin Security

  Authentication bypass

  CVE-2026-14495 · affected 4.3 and older · fixed in 4.4 *

• critical 9.8 WP Learn Manager

  Missing authorization check

  CVE-2026-12153 · affected 1.1.8 and older · fix not stated

• medium 5.3 User Management

  Missing authorization check

  CVE-2026-12097 · affected 1.2 and older · fixed in 1.4 *

• high 8.8 WHMCS Bridge

  Arbitrary file upload

  CVE-2026-14489 · affected 6.9 and older · fix not stated

• medium 4.4 Chatra Live Chat + ChatBot + Cart Saver

  Stored cross-site scripting (XSS)

  CVE-2026-12041 · affected 1.0.12 and older · fixed in 1.0.13 *

• medium 6.1 Social Share, Social Login and Social Comments…

  Reflected cross-site scripting (XSS)

  CVE-2026-11798 · affected 7.14.5 and older · fix not stated

• medium 6.4 Sympl Repeater for ACF and Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-10570 · affected 2.3 and older · fix not stated

• high 7.5 Backstage

  Privilege escalation

  CVE-2026-9842 · affected 1.4.2 and older · fix not stated

• critical 9.8 Eventer

  SQL injection

  CVE-2026-9701 · affected 4.4.2 and older · fix not stated

• high 8.8 多说社会化评论框

  Privilege escalation

  CVE-2026-14482 · affected 1.2 and older · fix not stated

• high 7.5 Jssor Slider by jssor.com

  Path traversal / file read

  CVE-2026-14244 · affected 3.1.24 and older · fix not stated

• critical 9.1 Simple Coherent Form

  Arbitrary file deletion

  CVE-2026-14487 · affected 2.4.13 and older · fix not stated

• high 8.8 Widget Logic Visual

  Remote code execution

  CVE-2026-14158 · affected 1.52 and older · fix not stated

Tuesday, July 7, 2026 · 5

• high 7.5 AMP for WP

  Remote code execution

  CVE-2026-6101 · affected 1.1.12 and older · fixed in 1.1.13 *

• critical 9.8 WPFunnels

  Remote code execution

  CVE-2026-14345 · affected 3.12.7 and older · fixed in 3.12.8 *

• high 8.7 Frontend File Manager Plugin

  Security issue

  CVE-2026-12277 · affected 23.6 and older · fix not stated

• medium 4.6 WP Travel Engine

  Security issue

  CVE-2026-10834 · affected older than 6.8.1 · fixed in 6.8.1

• medium 6.4 Exclusive Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-11328 · affected 2.7.9.8 and older · fixed in 2.7.9.9 *

Monday, July 6, 2026 · 4

• medium 6.4 Reviews Widgets for Google, TripAdvisor, Yelp…

  Stored cross-site scripting (XSS)

  CVE-2026-12154 · affected 2.7.3 and older · fixed in 2.8 *

• high 8.1 Admin and Site Enhancements (ASE)

  Security issue

  CVE-2026-12083 · affected 7.6.3 up to (not including) 8.8.4 · fixed in 8.8.4

• high 8.8 Simple Membership

  Cross-site scripting (XSS)

  CVE-2026-11855 · affected older than 4.7.5 · fixed in 4.7.5

• high 8.0 Ultimate Member

  Security issue

  CVE-2026-11766 · affected older than 2.12.0 · fixed in 2.12.0

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan