WordPress plugin vulnerabilities: week 35, 2026
158 vulnerabilities published Aug 24 – Aug 30, 2026 in 106 plugins we track, by day.
11 critical 55 high 87 medium 5 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, August 30, 2026 · 5
-
high 8.8 Groundhogg
-
low 3.5 MW WP Form
-
medium 6.6 Really Simple Security
-
high 8.8 Customer Reviews for WooCommerce
-
medium 6.6 WPvivid
Saturday, August 29, 2026 · 18
-
high 7.5 SAML Single Sign On
-
medium 4.7 MasterStudy LMS WordPress Plugin
-
low 2.7 MasterStudy LMS WordPress Plugin
-
medium 4.8 MasterStudy LMS WordPress Plugin
-
medium 4.3 Stripe Payment Forms by WP Full Pay
-
medium 4.1 WP Ultimate CSV Importer
-
medium 4.9 Rank Math SEO
-
medium 6.5 HEL Online Classroom
-
medium 6.5 HEL Online Classroom
-
high 7.5 HEL Online Classroom
-
high 8.2 User Profile Builder
-
medium 6.6 User Profile Builder
-
medium 6.8 User Profile Builder
-
medium 6.5 MStore API
-
medium 6.5 MStore API
-
medium 5.4 Newsletters
-
medium 4.8 Newsletters
Security issue
Friday, August 28, 2026 · 35
-
high 8.5 WPBulky
-
medium 5.3 Forminator Forms
Security issue
-
medium 4.3 Event Booking Manager for WooCommerce
-
medium 5.4 Event Booking Manager for WooCommerce
-
high 7.2 Rank Math SEO
-
high 7.5 Simple Payment
-
medium 4.3 Advanced Custom Fields
-
medium 4.3 WP Job Portal
-
high 7.5 Smush
-
high 7.2 Customer Reviews for WooCommerce
-
medium 5.3 Everest Forms
-
medium 6.4 Envira Gallery
-
medium 5.3 Essential Addons for Elementor
-
critical 10.0 GiveWP
-
medium 6.4 GiveWP
-
medium 5.3 Breeze Cache
-
low 2.7 Quiz and Survey Master (QSM)
-
high 7.2 User Registration & Membership
-
medium 4.3 User Registration & Membership
-
medium 5.3 WCFM Marketplace
-
high 7.5 wpForo Forum
-
medium 5.3 Shared Files
-
medium 6.8 Shared Files
-
high 8.1 Ultimate Member
-
medium 5.3 User Frontend
-
high 7.2 User Frontend
-
high 7.2 Optimole
-
high 7.2 TranslatePress
-
medium 6.4 LiteSpeed Cache
-
high 7.5 One User Avatar
-
high 7.2 Forminator Forms
-
high 7.2 LiteSpeed Cache
-
medium 6.4 Smart Slider 3
-
medium 6.5 Tutor LMS
Thursday, August 27, 2026 · 25
-
critical 9.8 Tutor LMS
-
medium 5.3 Ditty
-
medium 5.3 Kali Forms
-
medium 5.4 Push Notification for Post and BuddyPress
-
high 8.5 Suggestion Engine for WooCommerce
-
critical 9.3 Beautiful taxonomy filters
-
critical 9.8 Geo Controller
-
high 8.8 GeoDirectory
-
critical 9.8 Hash Form
-
high 8.5 Like Button Rating ♥ LikeBtn
-
high 7.5 SureFeedback Client Site
-
high 7.1 WP w3all phpBB
-
high 7.1 CP Media Player
-
high 7.1 Music Player for WooCommerce
-
high 8.8 Booking and Rental Manager for Bike
-
critical 9.3 ePayco plugin for WooCommerce
-
high 8.6 Mobile App for WooCommerce
-
high 8.8 12 Step Meeting List
-
medium 4.3 Finale Lite
-
medium 5.9 UpdraftPlus
-
medium 5.3 Document Embedder
-
medium 4.3 Mobile App for WooCommerce
-
medium 4.3 Mobile App for WooCommerce
Wednesday, August 26, 2026 · 30
-
medium 6.4 Greenshift
-
medium 5.3 WP Data Access
-
critical 9.8 ERP
-
medium 6.4 Reviews and Rating
-
high 8.8 Mang Board
-
high 7.2 Formidable Forms
-
medium 6.4 Gutenverse
-
medium 5.4 Directorist
-
medium 5.3 Kirki
-
medium 6.5 Return Refund and Exchange For WooCommerce
-
medium 4.3 Stripe Payment Forms by WP Full Pay
-
medium 5.3 Stripe Payment Forms by WP Full Pay
-
medium 5.3 AI Engine
-
high 7.7 AI Engine
-
medium 4.3 Project Manager
-
medium 5.4 Project Manager
-
high 7.2 Pods
-
high 7.5 Project Manager
-
high 7.2 WP Fastest Cache
-
medium 5.3 Booking Package
-
low 3.7 Forminator Forms
-
high 8.1 MalCare WordPress Security Plugin
-
medium 6.8 Royal Addons for Elementor
-
medium 5.3 Tutor LMS
-
medium 6.5 Booking for Appointments and Events Calendar
-
medium 4.7 Booking for Appointments and Events Calendar
-
medium 5.3 Royal Addons for Elementor
-
medium 5.3 Royal Addons for Elementor
-
critical 9.8 TranslatePress
Tuesday, August 25, 2026 · 25
-
high 7.5 WP Fastest Cache
-
medium 4.9 Media Sweep
-
high 7.2 ShopEngine
-
medium 4.3 Newsletters
-
high 8.8 All-in-One WP Migration and Backup
-
medium 6.4 Ultimate Member
-
medium 5.3 My Agile Privacy®
-
medium 6.4 eCommerce Product Catalog
-
high 8.8 CM Map Locations
-
high 7.2 Forminator Forms
-
high 7.2 Forminator Forms
-
medium 6.4 MetForm
-
medium 6.4 TranslatePress
-
medium 6.4 FundEngine
-
medium 4.3 FundEngine
-
medium 6.4 Gutenverse
-
medium 6.1 Events Manager
-
medium 6.6 Events Manager
-
medium 4.4 LearnPress
-
medium 6.4 Cozy Blocks
-
medium 5.3 Events Manager
-
medium 6.4 PPWP
-
medium 4.3 BetterLinks
-
medium 6.5 Events Manager
-
medium 4.3 WP Courses LMS
Monday, August 24, 2026 · 20
-
high 8.6 MasterStudy LMS WordPress Plugin
-
medium 6.5 AutomatorWP
-
high 7.1 Event Tickets and Registration
-
high 7.1 Accept Stripe Payments
-
critical 9.8 The Events Calendar
-
critical 9.8 TranslatePress
-
critical 9.8 Project Manager
-
medium 6.5 Style Kits for Elementor
-
medium 5.3 RepairBuddy
-
medium 4.3 Hash Form
-
medium 6.5 Magazine Blocks
-
medium 5.3 Booking and Rental Manager for Bike
-
medium 6.4 Shared Files
-
high 7.1 12 Step Meeting List
-
high 7.1 WPComplete
-
high 7.1 Events Made Easy
-
high 7.5 Notification Master
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.