WordPress plugin vulnerabilities: week 34, 2026
202 vulnerabilities published Aug 17 – Aug 23, 2026 in 171 plugins we track, by day.
31 critical 92 high 71 medium 8 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, August 23, 2026 · 3
-
high 8.8 Security Hardener
-
high 8.8 PPWP
Saturday, August 22, 2026 · 20
-
critical 9.8 WS Form LITE
-
medium 4.3 Greenshift
-
medium 6.4 MC4WP
-
high 7.5 Advanced Product Fields (Product Addons) for W…
Security issue
-
medium 6.4 Image Photo Gallery Final Tiles Grid
-
medium 4.3 Post Duplicator
-
medium 4.3 Post Duplicator
-
medium 5.3 kk Star Ratings
-
critical 9.8 Mailgun for WordPress
-
medium 6.6 Forminator Forms
-
high 7.2 Forminator Forms
-
medium 5.3 Conekta Payment Gateway
-
medium 6.8 Tutor LMS
Security issue
-
high 8.1 ManageWP Worker
-
low 2.7 Tutor LMS
-
medium 4.3 AutomatorWP
-
medium 4.3 AutomatorWP
-
medium 5.3 Themify Builder
-
high 8.8 WPeMatico RSS Feed Fetcher
Friday, August 21, 2026 · 11
-
low 3.7 Limit Login Attempts Security
Security issue
-
medium 5.3 Charitable
Security issue
-
critical 9.8 Wawp Country Code & Chat Widget for WooCommerce
-
high 7.2 AI Engine
-
low 2.7 Duplicate Post
-
low 2.7 Duplicate Post
-
medium 6.8 Link Whisper Free
-
medium 6.8 Media Library Assistant
-
medium 5.4 Welcart e-Commerce
Thursday, August 20, 2026 · 35
-
high 7.6 InfiniteWP Client
-
critical 9.6 Easy Elementor Addons
-
medium 5.3 New User Approve
-
high 7.1 affects latest 2.4.2 EPROLO-Dropshipping
-
high 8.5 affects latest 2.16.13 eShipper Commerce
-
critical 9.9 Query Wrangler
-
critical 9.8 FundEngine
-
high 8.5 WP w3all phpBB
-
high 7.1 Form Maker by 10Web
-
high 7.6 Leyka
-
critical 9.3 Locatoraid Store Locator
-
high 7.1 Podlove Podcast Publisher
-
high 7.1 GeoDirectory
-
high 7.1 Paymob for WooCommerce
-
high 7.1 SmartSMTP
-
high 7.1 GEO Plugin by Squirrly SEO
-
high 7.1 Swatchly
-
critical 9.3 rtMedia for WordPress, BuddyPress and bbPress
-
medium 6.5 Media Library Assistant
-
critical 9.1 Media Library Assistant
-
critical 9.3 Security Plugin, Firewall & Malware Scanner wi…
-
medium 5.9 WP Data Access
-
high 8.5 Persistent Login
-
high 7.1 wpDataTables
-
critical 9.8 Forminator Forms
-
high 7.1 Tagembed
-
high 7.1 TranslatePress
-
high 7.5 Events Made Easy
-
medium 6.8 Kirki
-
medium 6.8 Admin and Site Enhancements (ASE)
-
medium 5.3 AI Agent by SiteGround
-
high 7.2 Depicter
-
medium 6.6 Royal Addons for Elementor
Wednesday, August 19, 2026 · 41
-
critical 9.8 TrueBooker
-
high 7.5 Stitch Express
-
medium 6.5 E-cab Taxi Booking Manager for Woocommerce
-
critical 9.8 Flexible Subscriptions
-
high 7.5 affects latest 1.1.3 Outranking Plugin Options
-
high 7.5 affects latest 1.0.4 Pay with Contact Form 7
-
high 7.1 SimplyRETS Real Estate IDX
-
critical 9.8 TrueBooker
-
critical 9.3 NGG Smart Image Search
-
high 7.1 Newsletter
-
high 8.5 Community by PeepSo
-
high 7.1 Contest Gallery
-
high 7.2 TranslatePress
-
medium 6.4 EWWW Image Optimizer
-
high 7.2 WP Statistics
-
medium 5.3 Membership For WooCommerce
-
high 8.8 SAML Single Sign On
-
medium 5.4 WPS Bidouille
-
low 2.7 Easy Appointments
-
high 7.1 ProSolution WP Client
-
high 7.1 ProSolution WP Client
-
critical 9.0 Broken Link Checker
-
medium 5.4 WP Maps
-
medium 5.3 WP Directory Kit
-
medium 4.3 SmartCrawl SEO checker, analyzer & optimizer
-
critical 10.0 W3 Total Cache
-
high 8.8 Simple File List
-
high 8.6 Simple File List
-
high 7.1 NextScripts
-
high 7.5 User Verification by PickPlugins
-
medium 5.3 YayCurrency
-
low 2.7 Quiz and Survey Master (QSM)
-
low 2.7 Quiz and Survey Master (QSM)
-
medium 4.7 10Web Booster
-
medium 4.3 WCFM Marketplace
-
high 8.6 Dinatur
-
high 8.5 Advanced File Manager
Security issue
-
high 8.1 Atarim
-
medium 6.4 Speed Optimizer
Tuesday, August 18, 2026 · 92
-
medium 5.4 B2BKing
-
medium 6.5 Media Library Assistant
-
high 8.8 HashBar
-
medium 6.5 Draft List
-
medium 5.3 affects latest 2.17.24 Shortcodes and extra features for Phlox theme
-
medium 5.3 3D FlipBook
-
high 8.8 PublishPress Taxonomies
-
medium 5.4 Gravity Booster
-
medium 5.3 Razorpay for WooCommerce
-
medium 4.3 WP Table Builder
-
high 7.5 Charitable
-
high 7.5 Kadence Starter Templates
-
critical 9.8 Masteriyo LMS
-
medium 4.3 RTMForm
-
medium 5.4 User Registration & Membership
Security issue
-
medium 6.5 MasterStudy LMS WordPress Plugin
-
high 8.1 Restaurant Menu and Food Ordering
-
medium 6.5 Flutterwave WooCommerce
-
medium 6.5 affects latest 3.2.0 Piraeus Bank WooCommerce Payment Gateway
-
critical 9.8 affects latest 1.3.7 Youzify
-
medium 6.5 Booking calendar, Appointment Booking System
-
high 7.1 MWB HubSpot for WooCommerce
-
critical 9.1 Customer Engagement System
-
critical 9.8 Customer Engagement System
-
high 7.1 Site Reviews
-
high 7.1 Subscribe2
-
medium 4.9 Product Feed Manager for WooCommerce
-
medium 6.5 Contact Form by Supsystic
-
high 7.1 Contact Form by Supsystic
-
high 7.2 Easy Google Maps by Supsystic
-
high 7.5 Ultimate Maps by Supsystic
-
critical 9.8 Ultimate Maps by Supsystic
-
high 7.1 Ultimate Maps by Supsystic
-
high 7.1 Affiliates Manager
-
medium 6.5 WPLP Cookie Consent
-
critical 9.8 Easy Google Maps by Supsystic
-
high 7.1 Recipe Card Blocks Lite
-
high 7.1 URL Shortify
-
critical 9.3 Affiliates Manager
-
high 8.2 Breeze Cache
-
medium 6.5 GiveWP
-
medium 6.5 GiveWP
-
high 7.1 License Manager for WooCommerce
-
high 8.2 SupportCandy
-
critical 9.8 RegistrationMagic
-
high 7.1 Autopay
-
critical 10.0 WP Compress
-
high 7.1 WP Multilang
-
high 7.1 Premium Packages
-
critical 9.3 Sticky Chat Widget
-
high 7.1 EasyTest
-
medium 6.5 GeoDirectory
-
medium 6.3 MasterStudy LMS WordPress Plugin
-
medium 6.5 affects latest 1.3.7 Typing Effect
-
medium 6.5 Appointment Hour Booking
-
medium 6.5 MultiVendorX
-
medium 6.5 Table Of Contents Block
-
high 7.1 Templately
-
medium 6.5 affects latest 1.2.11 WP Tab Widget
-
medium 6.5 Wufoo Shortcode
-
medium 6.5 ACF Frontend Admin by DynamiApps
-
medium 6.5 Featured Video Plus
-
medium 6.5 affects latest 4.5.1 Login With Ajax
-
high 7.4 affects latest 1.2.63 Slider by 10Web
-
medium 6.5 Video Conferencing with Zoom
-
medium 6.5 Wise Chat
-
medium 6.5 WPZOOM Forms
-
high 7.5 Depicter
-
high 7.1 Kirki
-
high 7.2 OptionTree
-
high 7.1 Better Messages
-
high 7.5 Ezoic
-
high 7.5 ThumbPress
-
high 7.2 OttoKit
-
critical 9.9 Templatiq
-
high 7.5 affects latest 1.3.0 Online Contact Widget-多合一在线客服插件
-
high 7.2 affects latest 1.0.4 PDF Smart Viewer for Elementor
-
critical 9.8 FundEngine
-
high 7.5 affects latest 2.11.14 Duitku Payment Gateway
-
medium 6.0 affects latest 2.0.1 [凹凸曼] 一键采集微信文章
-
high 8.8 Essential Real Estate
-
critical 9.9 affects latest 1.9.3 Sync Post With Other Site
-
high 8.1 affects latest 2.9.1 Theme Test Drive
-
high 7.1 Quill Forms
-
high 7.5 Contact Form to Chat Apps
-
high 7.1 affects latest 4.7.43 SSL Zen
-
high 7.5 WP Sort Order
-
high 7.2 Quill Forms
-
critical 9.8 Forminator Forms
-
high 7.5 WPAdverts
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.