WordPress plugin vulnerabilities: week 30, 2026
187 vulnerabilities published Jul 20 – Jul 26, 2026 in 147 plugins we track, by day.
17 critical 40 high 129 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, July 25, 2026 · 1
-
medium 6.4 Yoast SEO
Friday, July 24, 2026 · 21
-
high 8.1 Easy Appointments
-
medium 4.9 Ninja Forms
-
medium 6.4 SureDash
-
medium 6.4 Rich Showcase for Google Reviews
-
medium 6.1 VikBooking Hotel Booking Engine & PMS
-
medium 6.4 Brands for WooCommerce
-
medium 6.4 Fluent Support
-
medium 6.4 Open User Map
-
medium 6.4 Visualizer
-
medium 6.4 WP Hotel Booking
-
medium 6.4 Cozy Blocks
-
medium 6.4 Cozy Blocks
-
medium 5.3 Payment Plugins for Stripe WooCommerce
-
medium 6.4 Firelight Lightbox
-
medium 5.3 Kirki
-
medium 5.3 Participants Database
-
medium 4.3 Nexter Blocks
-
high 8.0 WPify Woo
-
medium 6.4 MapSVG
Thursday, July 23, 2026 · 137
-
critical 9.8 SAML Single Sign On
-
high 8.8 WPO365
-
high 7.1 Popup for CF7 with Sweet Alert
-
medium 5.9 Tabs Responsive
-
medium 5.9 affects latest 1.1.1 Custom links in Elementor Image Carousel
-
medium 4.3 Cyr to Lat Reloaded
-
high 7.1 Kwayy HTML Sitemap
-
medium 5.9 Machete
-
medium 6.5 افزونه حمل و نقل ووکامرس
-
high 7.6 افزونه پیامک ووکامرس
-
medium 4.8 affects latest 1.8.14 Qubely
-
medium 6.5 Smart SEO Tool
-
medium 4.3 TinyMCE Templates
-
medium 6.5 BSK PDF Manager
-
medium 5.3 Graphina
-
medium 6.5 LIQUID SPEECH BALLOON
-
medium 4.3 TemplateSpare
-
high 8.5 Visualizer
-
medium 6.5 Appointment Hour Booking
-
medium 6.5 Accept Donations with PayPal & Stripe
-
medium 6.5 Photo Gallery
-
high 7.2 affects latest 2.2.6 PeproDev Ultimate Invoice
-
high 7.1 affects latest 2.2.6 PeproDev Ultimate Invoice
-
medium 5.4 WP Activity Log
-
medium 5.3 WP Social Ninja
-
medium 5.3 Complianz GDPR/CCPA Cookie Consent Banner
-
medium 5.3 MP3 Audio Player
-
medium 6.5 affects latest 2.2.6 PeproDev Ultimate Invoice
-
medium 5.3 Shiptastic for WooCommerce
-
medium 5.3 Ultimate Store Kit
-
medium 6.5 Ultimate Store Kit
-
medium 4.4 Complianz GDPR/CCPA Cookie Consent Banner
-
medium 5.3 LA-Studio Element Kit for Elementor
-
medium 5.3 Create
-
medium 4.3 Query Wrangler
-
medium 6.3 Style Kits for Elementor
-
medium 5.3 Content Control
-
medium 5.3 Event Post
-
medium 5.9 HashThemes Demo Importer
-
high 7.1 LA-Studio Element Kit for Elementor
-
medium 6.5 affects latest 1.6.3 LA-Studio Element Kit for Elementor
-
medium 6.5 Modula Image Gallery
-
medium 5.3 Ninja Tables
-
medium 6.5 Virtue/Ascend/Pinnacle Toolkit
-
medium 5.3 AWP Classifieds
-
medium 5.3 Kit (formerly ConvertKit)
-
medium 6.5 Fluent Support
-
medium 5.4 GiveWP
-
medium 5.4 Masteriyo LMS
-
medium 4.3 Polylang
-
critical 9.1 Really Simple CSV Importer
-
high 7.6 Uncanny Automator
-
medium 4.3 ЮKassa для WooCommerce
-
medium 5.3 Ebook Store
-
medium 5.3 Ebook Store
-
critical 9.1 MapSVG
-
high 8.5 MapSVG
-
medium 6.5 MapSVG
-
high 8.5 Quiz and Survey Master (QSM)
-
high 7.5 PayU India
-
critical 9.3 Online Scheduling and Appointment Booking System
-
medium 6.5 Easy Appointments
-
high 7.1 Form Vibes
-
critical 9.8 TrueBooker
-
critical 9.3 TrueBooker
-
medium 6.5 Notifima
-
critical 9.3 Premium Packages
-
critical 9.9 Advanced Views
-
high 7.7 Kali Forms
-
high 8.1 miniOrange Discord Integration
-
critical 10.0 Participants Database
-
high 7.5 Premium Packages
-
high 7.5 Ziina
Security issue
-
medium 6.5 Easy Digital Downloads
-
high 7.1 Easy Form Builder by WhiteStudio
-
medium 6.5 ERP
-
critical 9.3 Participants Database
-
critical 9.8 SMS Alert
-
medium 6.5 Masteriyo LMS
-
medium 6.5 WP Easy Pay
-
medium 6.5 Knit Pay
-
high 7.1 MailPoet
-
high 7.1 Picture Gallery
-
high 7.1 Slider Pro
-
high 7.1 Smart Manager
-
medium 6.3 Sunshine Photo Cart
-
medium 5.3 Broadcast Live Video
-
medium 6.5 Autopay dla WooCommerce
-
high 7.1 Sprout Clients
-
medium 5.3 WP Fast Total Search
-
medium 5.3 MarketKing
-
medium 4.3 Participants Database
-
medium 6.5 Hubbub Lite
-
medium 4.3 affects latest 2.2.0 Directory Listings WordPress plugin
-
medium 5.4 affects latest 2.2.0 Directory Listings WordPress plugin
-
medium 5.3 Video Player for YouTube
-
medium 5.3 Ditty
-
medium 6.5 affects latest 2.2.6 PeproDev Ultimate Invoice
-
critical 9.1 Mailster WordPress Newsletter Plugin
-
medium 5.4 eRoom
-
medium 5.3 WP Go Maps
-
high 8.5 eRoom
-
medium 4.3 Mediavine Control Panel
-
medium 5.9 Photo Gallery by Supsystic
-
high 8.5 Create
-
medium 4.4 Photo Block
-
medium 4.3 WP Accessibility Helper (WAH)
-
medium 5.9 WP-Polls
-
medium 6.4 Grid/List View for WooCommerce
-
medium 5.3 GutenKit
-
medium 6.5 Tickera
-
medium 6.5 WCPOS
-
medium 4.4 WP Encryption
-
medium 6.5 Premium Packages
-
medium 4.4 Brands for WooCommerce
-
medium 6.4 Brands for WooCommerce
-
medium 6.4 Header Footer Script Adder
-
medium 6.4 Bulk Page Generator
-
high 8.8 MDJM Event Management
-
critical 9.8 MountDev AI MCP Connector for WordPress
-
medium 6.5 Tickera
-
medium 6.3 Premium Packages
-
medium 6.4 Equalize Digital Accessibility Checker
-
critical 9.8 GoDAM
-
medium 6.5 Registrations for the Events Calendar
-
critical 9.8 Customer Support Ticket System & Helpdesk
-
medium 6.5 AI Copilot
-
medium 6.4 Web Push Notifications
-
medium 6.4 WP Shortcode by MyThemeShop
-
medium 6.1 WP Compress
Wednesday, July 22, 2026 · 4
-
medium 6.5 affects latest 5.0.7 DTX
-
medium 6.4 Ultimate Addons for Elementor
-
high 7.5 Events Manager
-
medium 5.3 Timetics
Tuesday, July 21, 2026 · 10
-
medium 6.4 Essential Addons for Elementor
-
high 7.2 MapSVG
-
medium 4.3 Tutor LMS Elementor Addons
-
medium 5.4 Academy LMS
-
medium 4.3 Classified Listing
-
medium 6.5 Bit Form
-
medium 5.9 Bit Form
-
critical 9.8 Easy Form Builder by WhiteStudio
-
medium 4.9 WPForms
-
medium 6.4 Essential Addons for Elementor
Monday, July 20, 2026 · 14
-
medium 6.4 Spectra Legacy
-
medium 4.9 Elementor Website Builder
-
medium 6.5 All-in-One WP Migration and Backup
-
critical 9.1 Kirki
-
high 7.1 LearnPress
-
medium 6.5 PayPlus Payment Gateway
-
medium 5.3 PayPlus Payment Gateway
-
low 2.7 All in One SEO
-
medium 4.3 Kirki
Security issue
-
medium 5.3 Kirki
-
high 7.5 SlimStat Analytics
-
medium 5.3 WP Travel
-
high 8.8 Unlimited Elements for Elementor
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.