WordPress plugin vulnerabilities: week 33, 2026

254 vulnerabilities published Aug 10 – Aug 16, 2026 in 198 plugins we track, by day.

37 critical 94 high 120 medium 3 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, August 16, 2026 · 55

• critical 9.8 Contact Form, Survey, Quiz & Popup Form Builder

  PHP object injection

  CVE-2024-13784 · affected 1.8.5 and older · fix not stated

• high 7.2 Gallery by BestWebSoft

  SQL injection

  CVE-2026-2497 · affected 4.7.9 and older · fixed in 4.8.0 *

• medium 6.4 Bold Page Builder

  Stored cross-site scripting (XSS)

  CVE-2026-2357 · affected 5.6.8 and older · fixed in 5.6.9 *

• high 7.2 Online Scheduling and Appointment Booking System

  Stored cross-site scripting (XSS)

  CVE-2026-13424 · affected 27.7 and older · fixed in 27.8 *

• medium 5.3 Forminator Forms

  Missing authorization check

  CVE-2026-12998 · affected 1.55.0.2 and older · fixed in 1.55.1 *

• high 7.2 Infility Global

  Stored cross-site scripting (XSS)

  CVE-2026-10734 · affected 2.15.21 and older · fixed in 2.16.24 *

• medium 4.3 Kirki

  Missing authorization check

  CVE-2026-18347 · affected 6.1.1 and older · fixed in 6.2.0 *

• medium 4.9 Kirki

  Path traversal / file read

  CVE-2026-17604 · affected 6.1.1 and older · fixed in 6.2.0 *

• medium 6.5 WP Compress

  Cross-site request forgery (CSRF)

  CVE-2026-17608 · affected 7.10.09 and older · fixed in 7.20.01 *

• high 7.5 WP Travel Engine

  Cross-site request forgery (CSRF)

  CVE-2026-17087 · affected 6.8.4 and older · fixed in 6.8.5 *

• medium 6.5 The School Management

  Cross-site request forgery (CSRF)

  CVE-2026-9767 · affected 5.4 and older · fixed in 5.5 *

• medium 4.9 User Login History

  SQL injection

  CVE-2026-2283 · affected 2.1.7 and older · fixed in 2.1.8 *

• high 7.5 Extra Product Options Builder for WooCommerce

  Missing authorization check

  CVE-2026-19728 · affected older than 1.2.176 · fixed in 1.2.176

• medium 6.1 Masteriyo LMS

  Stored cross-site scripting (XSS)

  CVE-2026-19712 · affected older than 2.3.3 · fixed in 2.3.3

• critical 9.1 Simple JWT Login

  Authentication bypass

  CVE-2026-19714 · affected older than 3.6.8 · fixed in 3.6.8

• medium 6.5 Visualizer

  Missing authorization check

  CVE-2026-19726 · affected older than 4.0.7 · fixed in 4.0.7

• medium 6.5 Premium Packages

  Missing authorization check

  CVE-2026-19711 · affected older than 7.0.7 · fixed in 7.0.7

• critical 9.1 WPvivid

  Path traversal / file read

  CVE-2026-19725 · affected older than 0.9.131 · fixed in 0.9.131

• high 7.2 All-in-One WP Migration and Backup

  Privilege escalation

  CVE-2026-17533 · affected older than 7.108 · fixed in 7.108

• medium 6.4 Smash Balloon Social Post Feed

  Stored cross-site scripting (XSS)

  CVE-2026-16775 · affected 4.9.0 and older · fixed in 4.10.0 *

• medium 6.4 Snippet Shortcodes

  Stored cross-site scripting (XSS)

  CVE-2026-16758 · affected 5.2.0 and older · fixed in 5.2.1 *

• medium 4.9 Slider Hero with Video Background, Animation

  SQL injection

  CVE-2026-17582 · affected 9.1.7 and older · fixed in 9.1.8 *

• critical 9.1 Solace Extra

  Missing authorization check

  CVE-2026-18316 · affected 1.6.0 and older · fixed in 1.6.1 *

• medium 6.4 SureDash

  Stored cross-site scripting (XSS)

  CVE-2026-18402 · affected 1.10.3 and older · fixed in 1.10.4 *

• high 7.2 WCPOS

  Remote code execution

  CVE-2026-17581 · affected 1.9.14 and older · fixed in 1.9.15 *

• high 7.2 WP Directory Kit

  SQL injection

  CVE-2026-18653 · affected older than 1.5.7 · fixed in 1.5.7

• medium 4.3 ShortPixel Adaptive Images

  Missing authorization check

  CVE-2026-15345 · affected 3.11.5 and older · fixed in 3.11.6 *

• medium 6.5 StoreEngine

  Path traversal / file read

  CVE-2026-15056 · affected 2.1.1 and older · fixed in 2.2.0 *

• medium 6.4 Toocheke Companion

  Stored cross-site scripting (XSS)

  CVE-2026-15604 · affected 2.10 and older · fixed in 2.11 *

• medium 4.9 WC Vendors

  SQL injection

  CVE-2026-15351 · affected 2.7.0 and older · fixed in 2.7.1 *

• medium 6.4 Video Gallery

  Stored cross-site scripting (XSS)

  CVE-2026-15790 · affected 4.0.4 and older · fixed in 4.0.5 *

• medium 6.6 Turnkey bbPress by WeaverTheme

  PHP object injection

  CVE-2026-10035 · affected 1.7.1 and older · fixed in 1.8 *

• critical 9.8 ACF Frontend Admin by DynamiApps

  Privilege escalation

  CVE-2026-18432 · affected 3.29.9 and older · fixed in 3.29.10 *

• high 8.8 Royal Addons for Elementor

  Server-side request forgery (SSRF)

  CVE-2026-17123 · affected 1.7.1064 and older · fixed in 1.7.1065 *

• medium 5.4 ProfilePress

  Remote code execution

  CVE-2026-18385 · affected 4.16.19 and older · fixed in 4.17.0 *

• medium 6.4 Serious Slider

  Stored cross-site scripting (XSS)

  CVE-2026-15726 · affected 1.4.0 and older · fixed in 1.4.1 *

• medium 6.5 Fullscreen Galleria

  SQL injection

  CVE-2026-16079 · affected 1.6.12 and older · fixed in 1.6.13 *

• medium 4.3 Kubio AI Page Builder

  Missing authorization check

  CVE-2026-16779 · affected 2.8.5 and older · fixed in 2.8.6 *

• medium 4.9 NEX-Forms

  SQL injection

  CVE-2026-15602 · affected 9.2.4 and older · fixed in 9.2.5 *

• high 8.8 Podlove Podcast Publisher

  Arbitrary file deletion

  CVE-2026-16099 · affected 4.5.3 and older · fixed in 4.5.4 *

• critical 9.8 ProSolution WP Client

  Arbitrary file upload

  CVE-2026-16098 · affected 2.0.10 and older · fixed in 2.0.18 *

• medium 6.5 Quiz and Survey Master (QSM)

  SQL injection

  CVE-2026-15963 · affected 11.2.1 and older · fixed in 11.2.2 *

• medium 5.3 Product Table & List Builder for WooCommerce

  Content injection

  CVE-2026-15441 · affected 5.6.0 and older · fixed in 5.6.5 *

• medium 4.3 Everest Forms

  Missing authorization check

  CVE-2026-13167 · affected 3.5.2 and older · fixed in 3.5.3 *

• medium 6.1 Advanced File Manager

  Stored cross-site scripting (XSS)

  CVE-2026-15009 · affected 5.4.12 and older · fixed in 5.4.13 *

• medium 6.4 Loco Translate

  Stored cross-site scripting (XSS)

  CVE-2026-15066 · affected 2.8.7 and older · fixed in 2.8.8 *

• high 7.2 Autopay

  Stored cross-site scripting (XSS)

  CVE-2026-15002 · affected 5.0.0 and older · fixed in 5.0.1 *

• critical 9.1 ProSolution WP Client

  Arbitrary file deletion

  CVE-2026-14524 · affected 2.0.8 and older · fixed in 2.0.18 *

• high 8.8 Query Wrangler

  Remote code execution

  CVE-2026-14498 · affected 1.5.57 and older · fix not stated

• medium 6.5 Simply Schedule Appointments

  Missing authorization check

  CVE-2026-13358 · affected 1.6.12.10 and older · fixed in 1.6.12.11 *

• medium 4.3 Online Scheduling and Appointment Booking System

  Missing authorization check

  CVE-2026-12905 · affected 27.7 and older · fixed in 27.8 *

• medium 6.4 Quiz and Survey Master (QSM)

  Stored cross-site scripting (XSS)

  CVE-2026-11780 · affected 11.2.1 and older · fixed in 11.2.2 *

• medium 4.4 Gravity Booster

  Stored cross-site scripting (XSS)

  CVE-2026-12477 · affected 5.26 and older · fixed in 6.0 *

• medium 4.3 PPWP

  Missing authorization check

  CVE-2025-10005 · affected 1.9.20 and older · fixed in 1.9.21 *

• medium 4.4 Admin Custom Login

  Stored cross-site scripting (XSS)

  CVE-2026-2487 · affected 3.6.4 and older · fixed in 3.6.5 *

Saturday, August 15, 2026 · 31

• critical 9.1 Link Library

  Arbitrary file deletion

  CVE-2026-18855 · affected 7.9.4 and older · fixed in 7.9.5 *

• critical 9.8 Pods

  Privilege escalation

  CVE-2026-19598 · affected 2.8 to 2.8.23.3, 2.9 to 2.9.19.3, 3.0 to 3.0.10.3, 3.1 to 3.1.4.1, 3.2 to 3.2.8.2, 3.3 to 3.3.9 · fixed in 3.3.9.1 *

• medium 6.5 WPML Multilingual CMS

  SQL injection

  CVE-2026-12248 · affected 4.9.5 and older · fix not stated

• high 8.8 Templately

  Remote code execution

  CVE-2026-18438 · affected 3.7.1 and older · fixed in 3.7.2 *

• critical 9.8 TrueBooker

  Missing authorization check

  CVE-2026-16142 · affected 1.2.6 and older · fixed in 1.2.7 *

• critical 9.8 User Profile Builder

  Authentication bypass

  CVE-2026-15826 · affected 3.16.4 and older · fixed in 3.16.5 *

• high 8.8 Wholesale Market

  Privilege escalation

  CVE-2026-14279 · affected 2.2.2 and older · fix not stated

• medium 6.5 Backup Migration

  Authentication bypass

  CVE-2026-18216 · affected older than 2.1.7 · fixed in 2.1.7

• medium 6.5 Simply Schedule Appointments

  Information disclosure

  CVE-2026-16541 · affected older than 1.6.12.17 · fixed in 1.6.12.17

• high 7.5 Product Feed PRO for WooCommerce by AdTribes

  Information disclosure

  CVE-2026-16611 · affected older than 13.5.7 · fixed in 13.5.7

• medium 6.5 Groundhogg

  SQL injection

  CVE-2026-18387 · affected 4.5.14 and older · fixed in 4.5.15 *

• medium 6.4 Beaver Builder Page Builder

  Stored cross-site scripting (XSS)

  CVE-2026-17090 · affected 2.10.2.2 and older · fixed in 2.10.3.2 *

• medium 6.5 Contest Gallery

  SQL injection

  CVE-2026-16586 · affected 30.0.7 and older · fixed in 31.0.0 *

• medium 4.9 Invisible Anti-Spam & CAPTCHA

  SQL injection

  CVE-2026-16146 · affected 5.1 and older · fixed in 5.1.1 *

• high 7.2 Invisible Anti-Spam & CAPTCHA

  Stored cross-site scripting (XSS)

  CVE-2026-16145 · affected 5.1 and older · fixed in 5.1.1 *

• medium 5.3 Form Maker by 10Web

  SQL injection

  CVE-2026-15993 · affected 1.15.44 and older · fixed in 1.15.45 *

• medium 4.9 Invisible Anti-Spam & CAPTCHA

  SQL injection

  CVE-2026-16094 · affected 5.1 and older · fixed in 5.1.1 *

• medium 6.4 Hydra Booking

  Stored cross-site scripting (XSS)

  CVE-2026-15948 · affected 1.2.2 and older · fixed in 1.2.3 *

• medium 6.5 KiviCare

  SQL injection

  CVE-2026-15453 · affected 4.5.1 and older · fixed in 4.5.2 *

• high 7.2 WPLP Cookie Consent

  Stored cross-site scripting (XSS)

  CVE-2026-13360 · affected 4.3.5 and older · fixed in 4.3.6 *

• medium 5.3 Booking calendar, Appointment Booking System

  Missing authorization check

  CVE-2026-8840 · affected 3.2.36 and older · fix not stated

• medium 6.5 Image Uploader for Welcart

  SQL injection

  CVE-2026-16080 · affected 1.4.6 and older · fix not stated

• high 8.8 MaxUpload

  Arbitrary file upload

  CVE-2026-15965 · affected 1.4.0 and older · fix not stated

• critical 9.8 6Storage Rentals

  Authentication bypass

  CVE-2026-15303 · affected 2.27.0 and older · fix not stated

• high 8.8 bLoyal

  Privilege escalation

  CVE-2026-15001 · affected 3.1.611.78 and older · fixed in 3.1.611.90 *

• high 7.2 Online Booking & Scheduling Calendar by vcita

  Stored cross-site scripting (XSS)

  CVE-2026-14433 · affected 4.6.0 and older · fixed in 4.6.1 *

• high 7.5 Object Sync for Salesforce

  SQL injection

  CVE-2026-15162 · affected 2.2.13 and older · fix not stated

• high 8.8 Propovoice

  Privilege escalation

  CVE-2026-15312 · affected 1.7.8 and older · fix not stated

• critical 9.1 RapiSafe

  Arbitrary file deletion

  CVE-2026-14484 · affected 1.0.4 and older · fix not stated

• critical 9.8 User Session Synchronizer

  Authentication bypass

  CVE-2026-15341 · affected 1.4.0 and older · fix not stated

• medium 5.3 Pinpoint Booking System

  Security issue

  CVE-2026-12128 · affected 2.9.9.6.8 and older · fixed in 2.9.9.6.9 *

Friday, August 14, 2026 · 7

• high 7.2 WP-Stats

  Stored cross-site scripting (XSS)

  CVE-2026-19794 · affected 2.56 and older · fixed in 2.56.1 *

• high 8.1 Essential Addons for Elementor

  Privilege escalation

  CVE-2026-18039 · affected 5.8.6 up to (not including) 6.7.2 · fixed in 6.7.2

• medium 6.5 Bit Form

  SQL injection

  CVE-2026-16810 · affected 3.2.0 and older · fixed in 3.2.1 *

• high 8.6 Paymob for WooCommerce

  SQL injection

  CVE-2026-15205 · affected older than 4.1.9 · fixed in 4.1.9

• medium 4.9 affiliate-toolkit

  SQL injection

  CVE-2026-12743 · affected 3.8.8 and older · fixed in 3.8.9 *

• medium 4.3 Astro Booking Engine

  Cross-site request forgery (CSRF)

  CVE-2025-10308 · affected 1.4.0 and older · fixed in 1.4.1 *

• high 7.2 W3 Total Cache

  Stored cross-site scripting (XSS)

  CVE-2026-18109 · affected 2.10.3 and older · fixed in 2.10.4 *

Thursday, August 13, 2026 · 96

• medium 6.5 GiveWP

  Cross-site scripting (XSS)

  CVE-2026-73357 · affected older than 4.16.6 · fixed in 4.16.6

• medium 5.3 GiveWP

  Missing authorization check

  CVE-2026-73349 · affected older than 4.16.6 · fixed in 4.16.6

• medium 5.3 InstaWP Connect

  Missing authorization check

  CVE-2026-73401 · affected 0.1.3.7 and older · fixed in 0.1.3.8

• medium 5.3 Revolut Gateway for WooCommerce

  Missing authorization check

  CVE-2026-73353 · affected older than 4.22.10 · fixed in 4.22.10

• medium 5.3 User Registration & Membership

  Missing authorization check

  CVE-2026-73403 · affected 5.2.6 and older · fixed in 5.2.7

• medium 6.5 Featured Image from URL (FIFU)

  Cross-site scripting (XSS)

  CVE-2026-73340 · affected 5.3.3 and older · fixed in 6.0.0

• high 7.6 Mailchimp for WooCommerce

  SQL injection

  CVE-2026-73346 · affected older than 6.2 · fixed in 6.2

• medium 5.9 WP Data Access

  Cross-site scripting (XSS)

  CVE-2026-73344 · affected 5.5.79 and older · fixed in 5.5.80

• high 7.2 Gutenverse Companion

  Server-side request forgery (SSRF)

  CVE-2026-66704 · affected 2.5.1 and older · fixed in 2.5.2

• medium 6.3 Anti Spam and list cleaner

  Missing authorization check

  CVE-2026-66689 · affected 2.0.0 and older · fixed in 2.0.1

• high 7.1 Smart Online Order for Clover

  Cross-site scripting (XSS)

  CVE-2026-66700 · affected 1.6.1 and older · fixed in 1.6.2

• high 7.1 Colissimo shipping methods for WooCommerce

  Cross-site scripting (XSS)

  CVE-2026-66697 · affected 2.10.0 and older · fixed in 3.0.0

• medium 6.5 Motors

  Missing authorization check

  CVE-2026-66693 · affected 1.4.113 and older · fixed in 1.4.114

• high 7.1 SureDash

  Cross-site scripting (XSS)

  CVE-2026-66698 · affected 1.10.1 and older · fixed in 1.10.2

• medium 6.5 Contact Form 7

  Missing authorization check

  CVE-2026-66660 · affected 2.5.1 and older · fixed in 2.5.2 *

• high 7.1 MultiParcels Shipping For WooCommerce

  Cross-site scripting (XSS)

  CVE-2026-66655 · affected 1.30.36 and older · fixed in 1.30.37 *

• medium 6.5 Appointment Booking Plugin for WooCommerce

  Cross-site scripting (XSS)

  CVE-2026-66687 · affected 1.3.2 and older · fixed in 1.4.0

• medium 6.5 Accordions

  Cross-site scripting (XSS)

  CVE-2026-66471 · affected 3.0.6 and older · fixed in 3.0.7 *

• critical 9.3 Church Admin

  SQL injection

  CVE-2026-66478 · affected 5.1.1 and older · fixed in 5.1.2

• critical 9.3 Everest Backup

  SQL injection

  CVE-2026-66472 · affected 2.3.12 and older · fixed in 2.3.13 *

• medium 6.5 FluentCommunity

  Cross-site scripting (XSS)

  CVE-2026-66467 · affected 2.7.5 and older · fixed in 2.7.7

• high 7.5 Arvow AI SEO Writer

  Missing authorization check

  CVE-2026-66469 · affected 1.5.3 and older · fixed in 1.5.4

• high 7.1 Local Delivery Drivers for WooCommerce

  Cross-site scripting (XSS)

  CVE-2026-66468 · affected 3.0.0 and older · fixed in 3.0.1 *

• medium 6.5 AfterShip Tracking

  Cross-site scripting (XSS)

  CVE-2026-66460 · affected 1.18.1 and older · fixed in 1.18.2 *

• high 7.5 affects latest 2.9 iCARRY

  Information disclosure

  CVE-2026-66463 · affected 2.9 and older · no fix listed yet

• medium 6.5 Website Internal Link Optimiser

  Missing authorization check

  CVE-2026-66464 · affected 5.2.7 and older · fixed in 5.3.0 *

• high 7.5 SMEPay

  Missing authorization check

  CVE-2026-66461 · affected 1.0.5 and older · fixed in 1.0.6 *

• high 7.5 StoreGrowth

  Missing authorization check

  CVE-2026-66466 · affected 2.1.1 and older · fixed in 2.1.2 *

• medium 6.5 SOOZ

  Missing authorization check

  CVE-2026-66459 · affected 2.4.2 and older · fixed in 2.4.3

• high 8.1 Geo Mashup

  File inclusion

  CVE-2026-66450 · affected 1.13.18 and older · fixed in 1.13.19

• high 7.1 Geo Mashup

  Cross-site scripting (XSS)

  CVE-2026-66449 · affected 1.13.18 and older · fixed in 1.13.19

• medium 6.5 Profile Extra Fields by BestWebSoft

  Cross-site scripting (XSS)

  CVE-2026-66456 · affected 1.3.4 and older · fixed in 1.3.5 *

• medium 6.0 ReactPress

  Missing authorization check

  CVE-2026-66455 · affected 3.4.0 and older · fixed in 3.4.1 *

• critical 9.3 RealPress

  SQL injection

  CVE-2026-66458 · affected 1.1.2 and older · fixed in 1.1.3 *

• critical 9.8 Salon Booking System

  Authentication bypass

  CVE-2026-66453 · affected 10.30.26 and older · fixed in 10.30.27

• medium 6.5 affects latest 1.5 WP Social Avatar

  Missing authorization check

  CVE-2026-66454 · affected 1.5 and older · no fix listed yet

• high 7.5 Bitcoin Lightning Payment Gateway for WooComme…

  Missing authorization check

  CVE-2026-66431 · affected 1.0.7 and older · fixed in 1.0.8

• high 7.5 MultiVendorX

  Missing authorization check

  CVE-2026-66441 · affected 5.0.10 and older · fixed in 5.0.11

• critical 9.3 If-So Dynamic Content

  SQL injection

  CVE-2026-66446 · affected 1.10 and older · fixed in 1.10.0.1

• medium 6.5 Payment Forms for Paystack

  Information disclosure

  CVE-2026-66444 · affected 4.0.5 and older · fixed in 4.0.6 *

• critical 9.3 Active Woot Products Tables for WooCommerce. 1…

  SQL injection

  CVE-2026-66436 · affected 1.1.1 and older · fixed in 2.1.2

• high 7.5 REST API Log

  Information disclosure

  CVE-2026-66443 · affected 1.7.1 and older · fixed in 1.7.2

• high 7.5 WPJAM Basic

  Information disclosure

  CVE-2026-66432 · affected 7.0.2.1 and older · fixed in 7.0.3

• critical 9.8 SMS Alert

  Privilege escalation

  CVE-2026-66424 · affected 3.9.7 and older · fixed in 3.9.8

• high 7.1 WP-Stats

  Cross-site scripting (XSS)

  CVE-2026-66426 · affected 2.56 and older · fixed in 2.56.1

• critical 9.3 Listdom

  SQL injection

  CVE-2026-61969 · affected 5.6.0 and older · fixed in 5.7.0

• high 7.1 Mang Board

  Cross-site scripting (XSS)

  CVE-2026-61974 · affected 2.3.4 and older · fixed in 2.3.5

• high 8.1 SAML Single Sign On

  Privilege escalation

  CVE-2026-61979 · affected 5.4.3 and older · fixed in 5.4.4

• medium 6.5 WebHosting4U Secure Card Gateway for ePay Payc…

  Missing authorization check

  CVE-2026-61978 · affected 1.0.32 and older · fixed in 1.0.33

• high 7.5 WPMobile.App

  Missing authorization check

  CVE-2026-61984 · affected 11.77 and older · fixed in 11.78

• high 7.1 Geeky Bot

  Cross-site scripting (XSS)

  CVE-2026-61965 · affected 1.2.6 and older · fixed in 1.2.7

• critical 9.8 miniOrange OTP Login, Verification and SMS Not…

  Privilege escalation

  CVE-2026-61967 · affected 5.5.1 and older · fixed in 5.5.2

• critical 10.0 WP BASE Booking of Appointments, Services and…

  Remote code execution

  CVE-2026-61962 · affected 6.3.0 and older · fixed in 6.3.1

• high 7.1 Stripe Payment Forms by WP Full Pay

  Cross-site scripting (XSS)

  CVE-2026-61960 · affected 8.5.0 and older · fixed in 8.5.1

• critical 9.3 WPJAM Basic

  SQL injection

  CVE-2026-61966 · affected 7.0.1 and older · fixed in 7.0.2

• high 7.4 Participants Database

  Arbitrary file deletion

  CVE-2026-28189 · affected 2.7.8.4 and older · fixed in 2.7.8.5

• high 7.1 Echo Knowledge Base

  Cross-site scripting (XSS)

  CVE-2026-28187 · affected 17.211.0 and older · fixed in 17.212.0

• high 7.3 Hydra Booking

  Missing authorization check

  CVE-2026-28188 · affected 1.2.2 and older · fixed in 1.2.3

• critical 9.8 Log in with Google

  Security issue

  CVE-2026-28185 · affected 1.4.2 and older · fixed in 1.4.3

• high 8.1 Tourfic Toolkit

  Missing authorization check

  CVE-2026-28186 · affected 1.5.1 and older · fixed in 1.5.2

• medium 6.5 AcyMailing

  Cross-site scripting (XSS)

  CVE-2026-28182 · affected 10.11.1 and older · fixed in 11.0.0

• medium 6.5 AcyMailing

  Missing authorization check

  CVE-2026-28181 · affected 10.11.1 and older · fixed in 11.0.0

• high 7.1 Blog Floating Button

  Cross-site scripting (XSS)

  CVE-2026-28170 · affected 1.4.20 and older · fixed in 1.4.21

• high 8.8 Booking Activities

  PHP object injection

  CVE-2026-28176 · affected 1.18.4 and older · fixed in 1.18.5

• high 8.5 CubeWP Framework

  SQL injection

  CVE-2026-28168 · affected 1.1.30 and older · fixed in 1.1.31

• high 7.1 Visitor Traffic Real Time Statistics

  Cross-site scripting (XSS)

  CVE-2026-28175 · affected 8.11 and older · fixed in 8.12

• medium 6.5 Eventin

  Information disclosure

  CVE-2026-28174 · affected 4.1.18 and older · fixed in 4.1.19

• high 7.1 Eventin

  Missing authorization check

  CVE-2026-28173 · affected 4.1.19 and older · fixed in 4.1.20

• critical 9.8 Headless SSO Plugin for WP

  PHP object injection

  CVE-2026-28149 · affected 1.6 and older · fixed in 1.6.1

• high 7.1 ToneDen Shortcode

  Cross-site scripting (XSS)

  CVE-2026-28158 · affected 358 and older · fix not stated

• high 7.5 ToneDen Shortcode

  Path traversal / file read

  CVE-2026-28157 · affected 358 and older · fix not stated

• high 8.5 ToneDen Shortcode

  SQL injection

  CVE-2026-28156 · affected 358 and older · fix not stated

• medium 6.5 ToneDen Shortcode

  Missing authorization check

  CVE-2026-28155 · affected 358 and older · fix not stated

• high 8.5 Booktics

  SQL injection

  CVE-2026-28002 · affected 1.0.22 and older · fixed in 1.0.23

• high 7.1 Business Directory Plugin

  Cross-site scripting (XSS)

  CVE-2026-28004 · affected 6.4.25 and older · fixed in 6.4.26 *

• high 7.1 Spam Protection

  Cross-site scripting (XSS)

  CVE-2026-28003 · affected 2.9.1 and older · fixed in 2.9.2

• critical 9.8 Headless SSO Plugin for WP

  Security issue

  CVE-2026-28148 · affected 1.6 and older · fixed in 1.6.1

• critical 9.8 OAuth Single Sign On

  Security issue

  CVE-2026-28008 · affected 7.0.0 and older · fixed in 7.0.1

• medium 6.5 Tourfic

  Missing authorization check

  CVE-2026-27999 · affected 2.23.1 and older · fixed in 2.23.2

• critical 9.3 Web Directory plugin Free

  SQL injection

  CVE-2026-28142 · affected 1.7.13 and older · fixed in 2.0

• critical 9.3 WP Directory Kit

  SQL injection

  CVE-2026-28001 · affected 1.5.4 and older · fixed in 1.5.5

• high 7.1 MailChimp Subscribe Form, Optin Builder, PopUp…

  Cross-site scripting (XSS)

  CVE-2026-27536 · affected 4.3.3 and older · fixed in 4.3.4

• high 8.1 MStore API

  Privilege escalation

  CVE-2026-27543 · affected 4.20.0 and older · fixed in 4.21.0

• medium 6.5 Customer Engagement System

  Cross-site scripting (XSS)

  CVE-2026-27537 · affected 1.11.2 and older · fixed in 1.12.0

• critical 10.0 QA Assistants

  Remote code execution

  CVE-2026-27544 · affected 5.2.0.0 and older · fixed in 5.2.0.1

• high 7.1 Solace Extra

  Missing authorization check

  CVE-2026-27535 · affected 1.6.0 and older · fixed in 1.6.1

• high 7.1 Welcart e-Commerce

  Cross-site scripting (XSS)

  CVE-2026-27539 · affected 2.11.31 and older · fixed in 2.11.32

• high 7.5 WP Directory Kit

  SQL injection

  CVE-2026-27538 · affected 1.5.4 and older · fixed in 1.5.5

• high 7.2 Car Rental Manager

  PHP object injection

  CVE-2026-27380 · affected 1.3.9 and older · fixed in 1.4.0

• high 7.5 E-cab Taxi Booking Manager for Woocommerce

  Missing authorization check

  CVE-2026-27345 · affected 2.0.3 and older · fixed in 2.0.5

• medium 5.4 Ecwid by Lightspeed Ecommerce Shopping Cart

  Missing authorization check

  CVE-2026-14332 · affected older than 7.0.9 · fixed in 7.0.9

• medium 6.4 PPWP

  Stored cross-site scripting (XSS)

  CVE-2026-3639 · affected 1.9.21 and older · fixed in 1.9.22 *

• high 7.2 Fluent Forms

  Stored cross-site scripting (XSS)

  CVE-2026-18146 · affected 6.2.11 and older · fixed in 6.2.12 *

• low 3.7 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2026-14213 · affected older than 2.4.6 · fixed in 2.4.6

• medium 5.3 Prevent Direct Access

  Missing authorization check

  CVE-2026-3835 · affected 2.8.8.8 and older · fixed in 2.8.8.9 *

• medium 5.3 Food Menu

  Missing authorization check

  CVE-2026-13328 · affected older than 6.0.2 · fixed in 6.0.2

Wednesday, August 12, 2026 · 32

• medium 6.5 Kirki

  Content injection

  CVE-2026-16747 · affected older than 6.2.1 · fixed in 6.2.1

• medium 5.3 Quick PayPal Payments

  Security issue

  CVE-2026-17008 · affected 5.7.50 and older · fixed in 5.7.51 *

• medium 5.3 Payment Button for PayPal

  Security issue

  CVE-2026-16990 · affected 1.2.3.44 and older · fix not stated

• medium 5.3 Welcart e-Commerce

  Security issue

  CVE-2026-15213 · affected older than 2.11.33 · fixed in 2.11.33

• medium 6.5 Wallet System for WooCommerce

  Security issue

  CVE-2026-15045 · affected older than 2.7.10 · fixed in 2.7.10

• medium 5.3 Payment Gateway for PayPal on WooCommerce

  Security issue

  CVE-2026-16621 · affected older than 9.2.1 · fixed in 9.2.1

• critical 9.3 Tablesome Table

  SQL injection

  CVE-2026-66659 · affected 1.2.9 and older · fixed in 1.2.11 *

• medium 5.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-19217 · affected older than 1.7.1065 · fixed in 1.7.1065

• medium 4.3 ProSolution WP Client

  Missing authorization check

  CVE-2026-19052 · affected older than 2.0.9 · fixed in 2.0.9

• medium 6.4 ProSolution WP Client

  Missing authorization check

  CVE-2026-19050 · affected older than 2.0.9 · fixed in 2.0.9

• medium 4.3 WP Photo Album Plus

  Missing authorization check

  CVE-2026-18962 · affected older than 9.2.09.002 · fixed in 9.2.09.002

• high 7.5 Ezoic

  Missing authorization check

  CVE-2026-18789 · affected 2.6.35 up to (not including) 2.23.1 · fixed in 2.23.1

• high 8.6 WP Directory Kit

  SQL injection

  CVE-2026-18474 · affected older than 1.5.6 · fixed in 1.5.6

• critical 9.8 Events Manager

  Privilege escalation

  CVE-2026-18366 · affected 7.1 up to (not including) 7.4.1 · fixed in 7.4.1

• high 8.1 WP Directory Kit

  SQL injection

  CVE-2026-18230 · affected older than 1.5.6 · fixed in 1.5.6

• high 8.1 Events Manager

  SQL injection

  CVE-2026-18057 · affected older than 7.4.1 · fixed in 7.4.1

• high 7.5 WP Photo Album Plus

  Information disclosure

  CVE-2026-18049 · affected older than 9.2.07.002 · fixed in 9.2.07.002

• high 7.5 WP Photo Album Plus

  Security issue

  CVE-2026-18048 · affected older than 9.2.07.002 · fixed in 9.2.07.002

• medium 5.3 User Access Manager

  Missing authorization check

  CVE-2026-18035 · affected older than 2.3.15 · fixed in 2.3.15

• high 8.1 Form Maker by 10Web

  SQL injection

  CVE-2026-16977 · affected older than 1.15.45 · fixed in 1.15.45

• medium 6.1 WP Photo Album Plus

  Reflected cross-site scripting (XSS)

  CVE-2026-17013 · affected older than 9.2.07.002 · fixed in 9.2.07.002

• critical 9.1 Wallet for WooCommerce

  Missing authorization check

  CVE-2026-16538 · affected older than 1.6.10 · fixed in 1.6.10

• medium 5.3 WP Travel Engine

  Missing authorization check

  CVE-2026-16737 · affected older than 6.8.5 · fixed in 6.8.5

• high 7.5 Total Upkeep

  Information disclosure

  CVE-2026-16253 · affected older than 1.17.3 · fixed in 1.17.3

• high 7.1 PowerPress Podcasting plugin by Blubrry

  Server-side request forgery (SSRF)

  CVE-2026-16294 · affected older than 11.17.1 · fixed in 11.17.1

• medium 5.4 Welcart e-Commerce

  Cross-site scripting (XSS)

  CVE-2026-16066 · affected older than 2.11.34 · fixed in 2.11.34

• high 7.5 Import WP

  Information disclosure

  CVE-2026-14925 · affected older than 2.14.23 · fixed in 2.14.23

• medium 4.3 WP Crowdfunding

  Missing authorization check

  CVE-2026-14859 · affected older than 2.2.1 · fixed in 2.2.1

• medium 4.3 WP Crowdfunding

  Missing authorization check

  CVE-2026-14858 · affected older than 2.2.1 · fixed in 2.2.1

• medium 4.3 WP Crowdfunding

  Missing authorization check

  CVE-2026-14857 · affected older than 2.2.1 · fixed in 2.2.1

• medium 6.5 LearnPress

  Missing authorization check

  CVE-2026-12976 · affected older than 4.4.4 · fixed in 4.4.4

• high 8.1 Social Login, Passkeys, Magic Link & Email OTP

  Authentication bypass

  CVE-2026-18961 · affected 1.4.3 and older · fixed in 1.4.4 *

Tuesday, August 11, 2026 · 7

• high 8.8 ACF Frontend Admin by DynamiApps

  Missing authorization check

  CVE-2026-15606 · affected 3.29.9 and older · fixed in 3.29.10 *

• high 8.1 GeoDirectory

  Arbitrary file deletion

  CVE-2026-19091 · affected 2.8.169 and older · fixed in 2.8.170 *

• high 7.5 InstaWP Connect

  Remote code execution

  CVE-2026-13457 · affected 0.1.3.6 and older · fixed in 0.1.3.7 *

• high 8.8 AcyMailing

  Privilege escalation

  CVE-2026-15426 · affected 10.11.1 and older · fixed in 11.0.0 *

• medium 4.3 Ray Enterprise Translation

  Missing authorization check

  CVE-2026-14549 · affected 1.7.3 and older · fixed in 1.7.4 *

• medium 6.5 Ray Enterprise Translation

  Missing authorization check

  CVE-2026-14548 · affected 1.7.3 and older · fixed in 1.7.4 *

• medium 6.4 Kirki

  Stored cross-site scripting (XSS)

  CVE-2026-16974 · affected 6.2.0 and older · fixed in 6.2.1 *

Monday, August 10, 2026 · 26

• medium 5.4 WP Umbrella

  Cross-site request forgery (CSRF)

  CVE-2026-66642 · affected 2.24.2 to 2.26.2 · fixed in 2.27.0

• medium 5.3 Advanced Classifieds & Directory Pro

  Information disclosure

  CVE-2026-19074 · affected older than 3.4.3 · fixed in 3.4.3

• medium 5.0 All-in-One Video Gallery

  Server-side request forgery (SSRF)

  CVE-2026-19075 · affected older than 4.9.2 · fixed in 4.9.2

• medium 6.5 Duplicate Post

  Missing authorization check

  CVE-2026-19077 · affected older than 1.5.5 · fixed in 1.5.5

• critical 9.1 ProSolution WP Client

  SQL injection

  CVE-2026-19053 · affected older than 2.0.6 · fixed in 2.0.6

• high 8.8 CheckView

  Authentication bypass

  CVE-2026-18786 · affected 2.0.29 up to (not including) 2.3.2 · fixed in 2.3.2

• high 7.5 Contact Form to Any API

  Information disclosure

  CVE-2026-18946 · affected older than 3.0.7 · fixed in 3.0.7

• medium 5.5 RSS Aggregator by Feedzy

  Missing authorization check

  CVE-2026-18934 · affected older than 5.2.6 · fixed in 5.2.6

• medium 4.3 Library Management System

  SQL injection

  CVE-2026-18666 · affected older than 3.6.7 · fixed in 3.6.7

• high 8.6 ProSolution WP Client

  SQL injection

  CVE-2026-19049 · affected older than 2.0.9 · fixed in 2.0.9

• medium 4.8 Salon Booking System

  Missing authorization check

  CVE-2026-17023 · affected 10.30.33 and older · fixed in 10.30.34 *

• high 7.5 Salon Booking System

  Information disclosure

  CVE-2026-17022 · affected older than 10.30.34 · fixed in 10.30.34

• medium 5.3 Salon Booking System

  Missing authorization check

  CVE-2026-17021 · affected older than 10.30.34 · fixed in 10.30.34

• medium 4.3 Salon Booking System

  Missing authorization check

  CVE-2026-17020 · affected 10.31.0 and older · fixed in 10.31.1 *

• medium 4.9 CubeWP Framework

  Missing authorization check

  CVE-2026-17018 · affected 1.1.30 and older · fixed in 1.1.31 *

• critical 9.8 Single Sign On For TNG

  Authentication bypass

  CVE-2026-16299 · affected older than 2.2.0 · fixed in 2.2.0

• high 8.8 Squeeze

  Remote code execution

  CVE-2026-16985 · affected older than 1.7.12 · fixed in 1.7.12

• medium 5.3 Pinpoint Booking System

  Missing authorization check

  CVE-2026-15229 · affected 2.9.9.7.1 and older · fixed in 2.9.9.7.2 *

• medium 5.4 Customer Reviews for WooCommerce

  Missing authorization check

  CVE-2026-14941 · affected older than 5.116.0 · fixed in 5.116.0

• high 8.2 Arvow AI SEO Writer

  Authentication bypass

  CVE-2026-16257 · affected older than 1.5.4 · fixed in 1.5.4

• medium 5.4 MotoPress Hotel Booking

  Missing authorization check

  CVE-2026-15238 · affected older than 6.2.3 · fixed in 6.2.3

• medium 5.3 MotoPress Hotel Booking

  Missing authorization check

  CVE-2026-15237 · affected older than 6.2.3 · fixed in 6.2.3

• medium 6.8 s2Member

  Stored cross-site scripting (XSS)

  CVE-2026-15047 · affected older than 260805 · fixed in 260805

• low 3.8 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2026-14211 · affected 9.0 up to (not including) 9.7 · fix not stated

• high 7.5 HT Contact Form

  Information disclosure

  CVE-2026-14206 · affected older than 2.9.3 · fixed in 2.9.3

• low 2.2 LearnPress

  Server-side request forgery (SSRF)

  CVE-2026-12971 · affected older than 4.4.4 · fixed in 4.4.4

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan