WordPress plugin vulnerabilities: week 32, 2026
253 vulnerabilities published Aug 3 – Aug 9, 2026 in 197 plugins we track, by day.
27 critical 94 high 124 medium 8 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, August 9, 2026 · 13
-
critical 9.1 WP Directory Kit
-
medium 6.5 Create
-
high 7.5 WP Data Access
-
high 8.6 Iptanus File Upload
-
high 8.1 CubeWP Framework
-
medium 5.3 WP Photo Album Plus
Security issue
-
medium 6.5 Create
-
low 3.8 Nexter Blocks
Security issue
-
high 7.5 GeoDirectory
-
low 2.7 Slim SEO
-
medium 4.3 Solace Extra
-
medium 6.1 LWS Optimize
-
critical 9.8 InfiniteWP Client
Saturday, August 8, 2026 · 18
-
medium 5.0 AI Engine
-
medium 4.8 AI Engine
-
medium 5.3 Download Monitor
-
high 8.1 Solace Extra
-
medium 6.5 WP Directory Kit
-
high 7.5 Admin Safety Guard
-
medium 6.1 Link Library
-
medium 6.5 WP Statistics
-
high 7.5 WP Directory Kit
-
medium 6.5 WP Directory Kit
-
high 7.7 WP Directory Kit
-
medium 6.8 YMC Filter
-
medium 5.4 YMC Filter
-
medium 5.3 Appointment Hour Booking
-
medium 4.8 Newsletters
-
high 8.1 Newsletters
-
critical 9.8 AI Copilot
-
medium 6.4 Easy Accordion
Friday, August 7, 2026 · 20
-
medium 5.3 Simple CAPTCHA with Cloudflare Turnstile
Security issue
-
medium 5.9 Subscriptions for WooCommerce
Security issue
-
critical 9.8 Ajax Search Lite
-
high 7.5 Estatik Real Estate Plugin
-
high 7.5 MStore API
-
medium 6.5 MStore API
-
medium 6.5 WP Maps
-
high 8.8 WP Maps
-
medium 5.4 BNE Testimonials
-
medium 5.4 Meow Gallery
-
critical 9.1 MStore API
-
high 8.1 MStore API
-
high 8.8 Subscriptions for WooCommerce
-
medium 4.3 Subscriptions for WooCommerce
-
medium 6.5 Templately
-
medium 6.1 Subscribe2
-
medium 6.5 Stream
-
critical 9.8 TrueBooker
-
critical 9.8 TrueBooker
-
medium 6.4 Ultra Addons for Contact Form 7
Thursday, August 6, 2026 · 116
-
high 7.5 miniOrange 2FA
Security issue
-
medium 4.8 Ninja Forms
-
medium 5.3 Events Made Easy
-
medium 5.3 Five Star Restaurant Reservations
-
medium 5.3 Simple Membership
Security issue
-
medium 5.3 WP Hotel Booking
Security issue
-
medium 5.3 WP Hotel Booking
Security issue
-
low 2.7 Easy Appointments
Security issue
-
medium 4.3 Tutor LMS
-
medium 5.3 Security Optimizer
Security issue
-
high 7.5 Payment Gateway for Redsys & WooCommerce Lite
Security issue
-
medium 5.3 WP Travel Engine
Security issue
-
medium 5.9 Formidable Forms
Security issue
-
high 8.6 Creative Mail
-
high 8.1 E2Pdf
-
high 7.5 Simple Membership
-
high 8.2 Total Upkeep
-
high 7.1 Meta for WooCommerce
-
medium 6.5 MailOptin
-
high 7.1 Meta pixel for WordPress
-
high 7.1 Rank Math SEO
-
medium 5.9 Subscribe to Comments
-
critical 9.1 Product Feed Manager for WooCommerce
-
medium 4.3 Colissimo shipping methods for WooCommerce
-
medium 5.3 Dokan
-
high 7.1 GiveWP
-
medium 4.3 Kadence Blocks
-
medium 5.3 User Profile Builder
-
medium 6.5 W3 Total Cache
-
medium 4.3 Advanced Custom Fields
-
medium 5.3 affects latest 2.0.16 Custom CSS and JavaScript
-
medium 5.3 Export Import Menus
-
medium 5.3 Featured Video Plus
-
medium 6.5 Plugins Garbage Collector (Database Cleanup)
-
high 7.1 GEO Plugin by Squirrly SEO
-
medium 4.3 Theme My Login
-
critical 9.8 ACF Frontend Admin by DynamiApps
-
high 7.1 ACF Frontend Admin by DynamiApps
-
high 7.1 Events Manager
-
medium 6.5 Legal Text Connector of the IT-Recht Kanzlei
-
high 7.1 WP Data Access
-
medium 6.5 Eventin
-
critical 9.3 Iptanus File Upload
-
high 7.1 WPIDE
-
medium 6.5 Gutena Forms
-
high 7.1 Advanced AJAX Product Filters
-
high 7.1 Houzez Property Feed
-
high 8.1 OTP Login With Phone Number, OTP Verification
Security issue
-
high 7.1 Survey Maker by AYS
-
high 8.5 WP Job Portal
-
high 7.1 AnsPress
-
critical 9.8 Export User Data
-
critical 9.8 WPBruiser Security
-
high 7.2 Order Delivery Date for WooCommerce
-
critical 10.0 Spider Analyser
-
high 7.1 AI Engine
-
high 7.2 Jeg Kit for Elementor
-
high 7.5 Vimeo
-
critical 9.3 WP OAuth Server ( Login with WordPress )
-
high 7.1 Simply Schedule Appointments
-
high 7.3 Staff Training
-
high 7.1 Easy PayPal & Stripe Buy Now Button
-
high 7.1 wpDataTables
-
critical 9.8 AI Copilot
-
medium 5.3 Element Pack Addons for Elementor
Security issue
-
high 7.5 BOX NOW Delivery Croatia + Slovenia
-
high 7.1 Media Library Assistant
-
high 7.1 Ninja Tables
-
critical 9.3 Simply Schedule Appointments
-
high 7.1 SiteGuard WP Plugin
-
high 7.1 EmbedPress
-
medium 6.5 Business Directory Plugin
-
medium 5.3 CAPTCHA 4WP
Security issue
-
high 7.2 PublishPress Capabilities
-
medium 5.3 SureCart
-
medium 5.9 FiboSearch
-
high 7.1 Popup Maker
-
medium 6.5 Powerkit
-
high 7.1 Tracking Code Manager
-
medium 6.5 Unlimited Elements for Elementor
-
medium 5.3 Mercado Pago payments for WooCommerce
-
critical 9.8 Ajax Search Lite
-
high 7.1 Forminator Forms
-
high 8.8 Forminator Forms
-
high 7.5 JetFormBuilder
-
critical 9.8 Kadence WooCommerce Email Designer
-
medium 6.5 Ultimate Store Kit
-
medium 4.3 RealHomes Memberships
-
medium 6.4 UsersWP
-
medium 5.3 Element Pack Addons for Elementor
Security issue
-
medium 6.4 Appointment Booking Plugin
-
medium 5.3 Ad Inserter
-
high 7.2 FormGent
-
medium 6.4 Slider, Gallery, and Carousel by MetaSlider
-
high 7.2 TranslatePress
-
medium 6.5 AI Engine
-
high 7.5 Events Manager
-
high 8.2 Newsletters
-
medium 6.5 Welcart e-Commerce
-
high 7.5 Stripe Payment Forms by WP Full Pay
-
high 7.5 Gutenberg Essential Blocks
-
high 7.5 Gutenberg Essential Blocks
-
medium 5.4 SEO Redirection Plugin
-
medium 6.1 Nexter Blocks
-
critical 9.1 WPCargo Track & Trace
-
high 7.2 Forminator Forms
-
high 7.2 FluentSMTP
-
high 8.8 File Manager
Wednesday, August 5, 2026 · 54
-
high 7.5 wiseCampaign
-
medium 6.5 Udimi Tools
-
high 7.2 Independent Analytics
-
high 8.1 Content Egg
-
medium 4.7 Smash Balloon Social Photo Feed
-
high 7.2 Backup Migration
-
medium 6.5 Layouts for WPBakery
-
high 8.1 Mailmunch Forms for Mailchimp
-
high 8.1 Search Analytics for WP
-
medium 6.4 Simple Yearly Archive
-
medium 4.3 Xpro Addons
-
high 7.5 AI Copilot
-
high 8.8 LightSync Pro
-
medium 6.4 SKT Skill Bar
-
high 8.2 WPFormify
-
high 7.3 Material Dashboard
-
high 7.2 ShopLentor
Security issue
-
medium 4.9 Askeet
-
critical 9.1 Multi Uploader for Gravity Forms
-
medium 4.4 DTX
-
medium 4.4 Super Progressive Web Apps
-
critical 9.1 Easy Post Submission
-
high 7.5 TableOn
-
medium 6.1 Seraphinite Accelerator
-
medium 6.1 TranslatePress
-
high 7.5 Page and Post Restriction
-
medium 6.5 User Access Manager
-
medium 6.5 WP Post Author
-
medium 4.9 WP TripAdvisor Review Slider
-
medium 4.9 JoomSport
-
medium 6.5 Groundhogg
-
medium 4.3 GDPR Cookie Compliance
-
medium 6.5 GeoDirectory
-
high 7.5 User Registration & Membership
-
critical 9.1 Ajax Load More
-
high 7.5 Bit Form
-
high 7.5 Contest Gallery
-
high 7.5 miniOrange 2FA
-
high 7.5 Sunshine Photo Cart
-
medium 6.1 Orbit Fox
-
high 7.5 WP 2FA
-
high 8.1 YayPricing
-
critical 9.1 OTP Login With Phone Number, OTP Verification
-
low 3.5 GeoDirectory
-
medium 6.5 Cost Calculator Builder
-
high 8.8 Dokan
-
medium 6.1 Football Pool
-
critical 9.3 Membership Plugin
-
medium 4.9 PrettyLinks
-
high 8.8 Customer Engagement System
-
medium 6.5 ERP
-
medium 6.5 Relevanssi
Tuesday, August 4, 2026 · 17
-
medium 4.7 Clearfy Cache
-
medium 4.3 Clearfy Cache
-
medium 4.3 Wired Impact Volunteer Management
-
medium 5.9 REST API Log
-
low 2.7 Brizy
-
medium 6.8 Brizy
-
low 3.5 Brizy
-
medium 4.3 Contest Gallery
-
medium 4.3 miniOrange 2FA
-
medium 6.8 PowerPress Podcasting plugin by Blubrry
-
medium 4.8 Nested Pages
-
medium 5.8 EmbedPress
-
medium 6.5 The GDPR Framework By Data443
-
medium 5.4 Paid Membership Subscriptions
-
medium 4.8 Quiz and Survey Master (QSM)
-
medium 4.3 wpForo Forum
Monday, August 3, 2026 · 15
-
medium 5.4 Unlimited Elements for Elementor
-
medium 6.5 Academy LMS
-
low 2.7 Classified Listing
-
low 2.7 Classified Listing
-
medium 4.1 Clearfy Cache
-
critical 9.1 Import and export users and customers
-
critical 9.1 Link Library
-
medium 6.1 Blog Floating Button
-
medium 6.5 Contest Gallery
-
medium 4.3 GEO my WP
-
medium 6.1 Simple Membership
-
critical 9.4 Simple Membership
-
medium 6.5 Simply Schedule Appointments
-
medium 6.1 SVG Support
-
medium 4.9 Import and export users and customers
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.