WordPress plugin vulnerabilities: week 31, 2026
269 vulnerabilities published Jul 27 – Aug 2, 2026 in 199 plugins we track, by day.
14 critical 79 high 160 medium 16 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, August 2, 2026 · 18
-
medium 6.4 Exclusive Addons for Elementor
-
medium 5.4 Frontend File Manager Plugin
-
high 7.5 Simply Schedule Appointments
-
high 7.5 Product Attachment for WooCommerce
-
medium 4.3 LWS Optimize
-
medium 5.4 Event Booking Manager for WooCommerce
-
medium 5.4 Event Booking Manager for WooCommerce
-
medium 6.6 Event Booking Manager for WooCommerce
-
medium 5.5 Meta Box
-
medium 5.4 RT Mega Menu
-
high 7.5 AI ChatBot for WooCommerce
-
high 7.5 Five Star Restaurant Reservations
-
high 8.2 AcyMailing
-
medium 6.1 King Addons for Elementor
-
medium 6.8 Element Pack Addons for Elementor
-
medium 4.8 Charitable
-
high 7.5 CubeWP Framework
-
high 7.5 User Access Manager
Saturday, August 1, 2026 · 58
-
medium 6.5 CubeWP Framework
-
medium 6.4 Kadence Blocks
-
medium 6.4 Kadence Blocks
-
medium 6.1 Responsive Thumbnail Slider
-
medium 6.5 Advanced Views
-
medium 6.4 Download Manager
-
medium 6.4 Easy Property Listings
-
medium 6.1 Fluent Forms
-
medium 5.3 PixelYourSite
-
medium 4.9 WPvivid
-
medium 4.9 GSheetConnector
-
medium 6.4 GamiPress
-
medium 6.4 GamiPress
-
medium 6.5 Icegram Engage
-
medium 4.9 Icegram Mailer
-
high 8.1 Kali Forms
-
high 8.8 Pronamic Pay
-
critical 9.8 Single Sign On For TNG
-
medium 6.4 Advanced Woo Labels
-
medium 6.4 Cozy Blocks
-
medium 4.9 Kirki
-
high 8.1 NEX-Forms
-
medium 6.4 Powerkit
-
medium 6.4 Powerkit
-
medium 6.4 Powerkit
-
medium 5.3 Database Collation Fix
-
medium 6.4 GenerateBlocks
-
medium 5.3 Gutena Forms
-
medium 4.3 RealHomes Memberships
-
medium 5.3 WooCommerce PayPal Payments
-
high 8.8 AI Engine
-
medium 4.3 Jeg Kit for Elementor
-
medium 4.3 Theme Editor
-
high 8.1 User Profile Builder
-
medium 5.3 Support Genix
-
medium 5.3 YOP Poll
Security issue
-
medium 5.4 Download Manager
-
low 2.2 Event Tickets and Registration
-
medium 5.3 Event Tickets and Registration
-
high 7.5 Mapster WP Maps
-
low 2.7 Brizy
-
low 3.8 Fluent Support
-
critical 9.1 Participants Database
-
medium 4.3 Podlove Podcast Publisher
-
low 3.7 Builderall for WordPress
-
low 3.5 Spectra Legacy
Security issue
-
medium 5.4 wpForo Forum
-
medium 4.8 Bit Form
-
critical 9.1 FormGent
-
medium 6.4 SureForms
-
high 7.5 Bit integrations
-
medium 4.9 Pinpoint Booking System
-
medium 6.4 SendPulse Email Marketing Newsletter
-
high 8.8 Subscriptions for WooCommerce
Friday, July 31, 2026 · 30
-
medium 5.3 MasterStudy LMS WordPress Plugin
Security issue
-
medium 4.3 WP Maps
-
medium 5.3 Fluent Forms
-
medium 5.3 MailerPress
-
medium 5.3 MailerPress
-
medium 5.4 BuddyPress
-
low 3.7 WP Go Maps
-
high 7.5 Geeky Bot
-
medium 6.5 JS Help Desk
-
medium 6.5 JS Help Desk
-
high 7.5 JS Help Desk
-
medium 4.3 JS Help Desk
-
medium 6.5 JS Help Desk
-
medium 6.1 WP Photo Album Plus
-
medium 5.3 Events Made Easy
-
medium 6.5 Mailgun for WordPress
-
medium 6.1 NewStatPress
-
low 3.7 Paid Membership Subscriptions
Security issue
-
medium 4.3 Paid Membership Subscriptions
-
low 3.7 Support Genix
-
low 3.5 ElementsKit Elementor Addons
-
high 7.2 ElementsKit Elementor Addons
-
high 8.6 Kirki
-
critical 9.8 Realtyna Organic IDX plugin + WPL Real Estate
-
medium 4.3 Academy LMS
-
high 7.5 Kirki
-
high 8.1 miniOrange 2FA
-
high 8.1 Ultimate Member
-
medium 5.4 wpForo Forum
Thursday, July 30, 2026 · 28
-
medium 4.3 FuseWP
-
high 7.2 Subscriptions for WooCommerce
-
low 3.7 Bit Form
-
medium 5.3 Appointment Booking Plugin
-
medium 5.4 Search Atlas SEO
-
medium 4.3 MotoPress Hotel Booking
-
medium 6.5 Sync Post With Other Site
-
medium 6.8 WP Hotel Booking
-
medium 5.3 WP Delicious
-
medium 4.3 Easy Appointments
-
medium 4.3 Easy Appointments
-
medium 4.3 LifterLMS
-
medium 5.4 Tutor LMS
-
low 3.8 Easy Appointments
-
low 3.8 Easy Appointments
-
low 2.7 Easy Appointments
-
medium 5.3 Essential Addons for Elementor
-
medium 4.8 Essential Addons for Elementor
-
medium 6.1 LifterLMS
-
medium 6.1 Fluent Forms
-
medium 5.9 Points and Rewards for WooCommerce
-
medium 4.3 WP Travel
-
medium 5.3 WP Travel
Security issue
-
high 7.5 WP Travel Engine
-
high 7.5 BuddyPress
-
medium 5.3 المنتور فارسی
Security issue
-
medium 6.5 Improved Save Button
Wednesday, July 29, 2026 · 25
-
medium 6.4 Booking System Trafft
-
medium 4.9 WP CTA
-
medium 6.5 MasterStudy LMS WordPress Plugin
-
medium 6.4 WPC Badge Management for WooCommerce
-
medium 5.3 Klubraum Membership Request
-
high 7.2 GTM4WP
-
high 7.2 Fluent Forms
-
critical 9.8 Spreadsheet Price Changer for WooCommerce and…
-
medium 4.3 Facturación Electrónica Costa Rica
-
high 7.2 Database for CF7
-
medium 4.9 WP-Lister Lite for eBay
-
medium 6.1 Link Library
-
medium 5.4 Easy Appointments
-
high 7.4 UsersWP
-
critical 9.8 Advanced Responsive Video Embedder for Rumble,…
-
medium 4.3 Survey Form Block
-
medium 4.9 WP Photo Album Plus
-
high 7.2 Easy Digital Downloads
-
medium 6.4 Contact Form to Any API
-
medium 4.3 Event Booking Manager for WooCommerce
-
medium 6.4 Newsletters
-
medium 6.4 WowStore
-
medium 6.4 WowStore
-
medium 6.4 Newsletters
-
high 8.8 Wholesale for WooCommerce
Tuesday, July 28, 2026 · 38
-
medium 4.9 SpeedyCache
-
medium 4.1 Media Cleaner
-
high 8.8 Teydea Login Security
-
medium 6.5 Plugin Organizer
-
medium 6.4 Cozy Blocks
-
medium 5.3 WPBot
-
medium 5.3 WPBot
-
medium 5.3 StoreGrowth
-
high 7.2 StoreGrowth
-
medium 5.3 StoreGrowth
-
medium 4.9 Tutor LMS
-
high 7.5 Uncanny Automator
-
high 8.8 Eazy Plugin Manager
-
high 7.5 Web Directory plugin Free
-
medium 5.0 Shortcodify
-
high 7.5 PickPlugins Question Answer
-
medium 6.5 Taskbuilder
-
high 7.5 TrueBooker
-
high 7.5 Premium Packages
-
medium 6.4 GamiPress
-
medium 4.4 SMS Alert
-
high 7.5 WP Fast Total Search
-
medium 4.9 SMS Alert
-
medium 4.9 SMS Alert
-
critical 9.8 SMS Alert
-
medium 4.3 Advanced Form Integration
-
medium 4.9 ShopLentor
-
medium 4.3 ShopLentor
-
high 7.2 Better Messages
-
medium 5.3 Demi
-
low 3.5 Event Tickets and Registration
-
medium 4.3 WPLP Cookie Consent
-
low 2.7 Quiz and Survey Master (QSM)
-
high 7.5 Tablesome Table
-
high 7.5 Demi
-
medium 5.3 PDFDraft
Monday, July 27, 2026 · 72
-
medium 6.5 Anti Spam and list cleaner
-
medium 6.5 Ad Invalid Click Protector (AICP)
-
high 7.1 BackWPup
-
high 7.1 Contest Gallery
-
high 7.1 GiveWP
-
high 7.1 Kali Forms
-
high 7.5 Xendit Payment
-
high 7.1 Message Filter for Contact Form 7
-
high 7.1 GetGenie
-
high 7.1 Ultra Addons for Contact Form 7
-
medium 4.9 Easy Digital Downloads
-
medium 5.9 Checkout Field Editor for WooCommerce
-
medium 5.3 Exclusive Addons for Elementor
-
medium 4.9 RSS Aggregator by Feedzy
-
medium 4.3 Insert Headers and Footers Code
-
medium 6.5 Open User Map
-
medium 6.5 Gallery PhotoBlocks
-
medium 5.4 YayPricing
-
medium 6.5 Location Weather
-
medium 5.0 Visual Composer Website Builder
-
medium 4.3 WP Google Review Slider
-
high 7.6 WP Google Review Slider
-
medium 5.4 AffiliateX
-
medium 6.5 BetterDocs
-
medium 5.3 Event Tickets and Registration
-
medium 5.3 MapPress
-
medium 6.5 Social Login, Social Sharing by miniOrange
-
medium 5.9 Orbit Fox
-
medium 5.9 Abandoned Cart Lite for WooCommerce
-
medium 6.8 Kirki
-
medium 6.5 RT Mega Menu
-
medium 6.5 ЮKassa для WooCommerce
-
medium 6.5 RT Mega Menu
-
medium 6.5 FundEngine
-
critical 9.3 AWP Classifieds
-
high 7.1 Product Feed Manager for WooCommerce
-
high 7.1 Booking Calendar
-
medium 6.5 Events Made Easy
-
high 7.2 Flipbook PDF Viewer & Embedder
-
critical 9.3 rtMedia for WordPress, BuddyPress and bbPress
-
high 7.5 Byteflows Travel & Hotel Booking
-
high 7.5 CoCart
-
critical 9.3 GamiPress
-
high 7.4 Hide My WP Ghost
-
high 7.5 Paid Membership Subscriptions
-
high 7.6 Sender
-
high 7.5 Booking and Rental Manager for Bike
Security issue
-
high 7.5 Ebook Store
-
high 7.5 Falcon
Security issue
-
critical 9.3 MapSVG
-
high 7.5 Post My CF7 Form
-
critical 9.3 Relevanssi Light
-
high 7.5 ShipTime
-
medium 6.8 Calendar
-
medium 5.3 Quiz and Survey Master (QSM)
-
high 7.5 Download Manager
-
critical 9.8 Realtyna Organic IDX plugin + WPL Real Estate
-
medium 6.1 Simply Schedule Appointments
-
medium 6.1 Sina Extension for Elementor
-
medium 4.8 Smart Manager
-
medium 6.1 Advanced Ads
-
medium 6.1 Document Gallery
-
critical 9.1 Masteriyo LMS
-
high 8.1 MainWP Child
-
medium 5.3 The Events Calendar
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.