WordPress plugin vulnerabilities: week 36, 2026
223 vulnerabilities published Aug 31 – Sep 6, 2026 in 156 plugins we track, by day.
19 critical 71 high 119 medium 14 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, September 6, 2026 · 11
-
medium 4.8 JetFormBuilder
Security issue
-
medium 4.8 Ninja Forms
-
medium 4.8 Redirection for Contact Form 7
-
medium 6.5 JetFormBuilder
-
medium 5.3 B2BKing
-
medium 6.8 Bold Page Builder
-
high 7.5 Kirki
-
medium 6.5 SureCart
-
high 8.8 SureCart
-
critical 9.8 ACF Frontend Admin by DynamiApps
-
high 7.5 HivePress Authentication
Saturday, September 5, 2026 · 41
-
critical 9.8 Mail Mint
-
medium 6.4 Pods
-
critical 9.8 Post Grid
-
high 7.2 Contact Form by Supsystic
-
medium 4.3 Custom Contact Forms
-
medium 6.4 FooGallery Photo Gallery
-
medium 6.1 Unlimited Elements for Elementor
-
medium 5.3 EmbedPress
-
low 2.7 EmbedPress
-
low 2.7 EmbedPress
-
medium 6.8 Video Player for YouTube
-
medium 6.8 Bold Page Builder
-
medium 6.8 Bold Page Builder
-
medium 6.8 King Addons for Elementor
-
low 2.2 Kirki
-
medium 6.8 Kirki
-
medium 6.8 Masteriyo LMS
-
high 8.6 Music Store
-
low 2.7 The Events Calendar
-
critical 9.8 SEO Flow by LupsOnline
-
low 2.7 Smart Post
-
medium 5.3 Smart Post
-
medium 5.3 Accept Stripe Payments
-
medium 4.3 Accept Stripe Payments
-
high 7.2 W3 Total Cache
-
medium 4.7 JetFormBuilder
-
high 7.5 JetFormBuilder
-
high 7.2 Ninja Forms
-
high 7.2 SureForms
-
high 8.8 Welcart e-Commerce
-
medium 5.4 Search Atlas SEO
-
medium 6.4 DearFlip
-
medium 6.4 DearFlip
-
critical 9.8 Hummingbird Performance
-
medium 4.3 Theme My Login
-
medium 5.4 Events Manager
-
high 7.2 iubenda
-
high 7.2 iubenda
-
critical 9.8 MStore API
-
medium 6.4 Social Chat
Friday, September 4, 2026 · 17
-
medium 5.3 E-cab Taxi Booking Manager for Woocommerce
Security issue
-
medium 5.3 Restaurant Menu and Food Ordering
Security issue
-
medium 5.3 MarketKing
-
medium 5.3 WCFM Membership
-
high 7.6 WooCommerce
-
low 3.1 Directorist
-
medium 4.1 WPLP Cookie Consent
-
medium 5.9 Ninja Forms
-
medium 5.3 WPFunnels
-
medium 5.5 WPvivid
Security issue
-
medium 5.5 WPvivid
-
medium 6.8 Pods
Security issue
-
medium 5.3 WPFunnels
-
medium 5.3 WPFunnels
-
high 7.1 Classified Listing
-
high 7.2 Hummingbird Performance
-
medium 5.3 WPFunnels
Thursday, September 3, 2026 · 41
-
medium 5.3 SureForms
-
medium 5.3 Ultimate Maps by Supsystic
-
medium 6.5 Booking and Rental Manager for Bike
-
medium 5.3 KP Agent Ready
-
medium 6.5 MountDev AI MCP Connector for WordPress
-
medium 5.3 Unlimited Elements for Elementor
-
medium 5.4 SEOPress
-
medium 6.5 WPKoi Templates for Elementor
-
high 7.1 Better Messages
-
critical 9.3 GeoDirectory
-
medium 6.5 Pre-Orders for WooCommerce
Security issue
-
high 7.1 Quick Event Manager
-
high 7.5 Quick Event Manager
-
high 7.1 SmartyParcel
-
high 8.1 Agentimus
-
medium 6.5 Business Directory Plugin
-
high 7.2 EWWW Image Optimizer
-
high 7.5 MalCare WordPress Security Plugin
-
high 7.5 Migrate Guru
-
high 7.4 Really Simple Security
-
critical 9.3 VikAppointments Services Booking Calendar
-
medium 6.1 WP Statistics
-
medium 5.3 Bookit
Security issue
-
high 7.1 Breadcrumb NavXT
-
high 7.2 LiteSpeed Cache
-
high 7.1 RTMKit for Elementor
-
medium 5.3 WP Easy Pay
Security issue
-
medium 6.5 Business Directory Plugin
-
high 7.1 WCFM Membership
-
high 8.2 WP Compress
-
medium 6.5 Mail Mint
-
critical 9.8 Mail Mint
-
high 8.8 RTMKit for Elementor
-
medium 6.5 Timetics
-
medium 6.5 WPFunnels
-
high 7.1 Calculation for contact form 7
-
medium 6.5 Choosly
-
high 7.1 Simple Payment
-
high 7.1 Under Construction
-
high 7.1 affects latest 3.8.8 WP QuickLaTeX
-
medium 6.4 GutenKit
Wednesday, September 2, 2026 · 66
-
medium 5.4 Simple Membership MailChimp Integration
-
medium 6.8 Xpro Addons
-
medium 6.8 All in One SEO
-
medium 5.3 Restrict User Access
-
low 3.8 Timetics
-
medium 5.3 User Frontend
-
low 3.3 Weaver Show Posts
-
medium 5.3 RentSyst
-
medium 5.5 Broken Link Checker
-
medium 6.5 Gallery PhotoBlocks
-
medium 5.3 PublishPress Permissions
-
medium 5.3 Really Simple Security
-
medium 5.3 WP Go Maps
-
high 7.1 Activity Log
-
high 8.8 Mang Board
-
high 8.8 Simply Schedule Appointments
-
medium 5.3 Ultimate Gift Cards for WooCommerce
-
medium 5.4 Classified Listing
-
high 7.1 Estatik Real Estate Plugin
-
high 7.1 affects latest 1.6.30 MapGeo
-
high 7.1 TrustedSite
-
medium 6.5 WCFM Marketplace
-
high 7.5 Product Attachment for WooCommerce
-
medium 6.5 Eventin
-
critical 9.8 Authorizer
-
high 7.1 MP3 Audio Player
-
critical 9.3 WCFM Marketplace
-
high 8.8 User Frontend
-
high 7.2 Broken Link Checker
-
medium 6.4 Easy Waveform Player
-
high 7.1 affects latest 4.5.1 Login With Ajax
-
high 8.8 FAQ Builder AYS
-
medium 5.3 MasterStudy LMS WordPress Plugin
-
high 8.1 OAuth Single Sign On
-
high 8.8 Simple Ajax Chat
-
medium 5.4 Theme My Login
-
medium 6.5 WC Vendors
-
medium 4.3 WC Vendors
-
medium 4.3 WC Vendors
-
medium 4.1 WPvivid
-
high 8.1 Advanced Custom Fields
-
medium 5.3 FormLayer
-
low 3.8 MasterStudy LMS WordPress Plugin
-
medium 5.3 MasterStudy LMS WordPress Plugin
-
low 2.7 MasterStudy LMS WordPress Plugin
-
medium 5.3 MasterStudy LMS WordPress Plugin
-
medium 4.3 MasterStudy LMS WordPress Plugin
-
medium 4.3 GamiPress
-
medium 4.9 Rank Math SEO
-
low 2.7 Rank Math SEO
-
low 2.7 Rank Math SEO
-
low 2.7 Rank Math SEO
-
low 3.7 Rank Math SEO
-
medium 5.3 Rank Math SEO
-
medium 6.5 Booking for Appointments and Events Calendar
-
medium 4.3 Gutentor
-
medium 5.3 MotoPress Appointment Booking
-
medium 5.3 Solace Extra
-
medium 5.3 Ultimate Member
-
high 8.8 User Frontend
-
high 8.1 Advanced Custom Fields
-
high 7.1 Photo Gallery by 10Web
-
critical 9.8 Booking for Appointments and Events Calendar
Tuesday, September 1, 2026 · 25
-
medium 5.3 Simple Membership
-
high 7.2 Welcart e-Commerce
-
medium 6.4 Live Composer
-
medium 6.4 Live Composer
-
medium 4.8 MW WP Form
-
medium 6.5 WP Fastest Cache
Security issue
-
medium 6.4 BetterDocs
-
medium 6.5 Charitable
-
medium 6.1 User Profile Builder
-
medium 6.4 Blocksy Companion
-
medium 4.9 Photo Gallery by Ays
-
medium 4.9 LearnPress
-
medium 6.4 User Profile Builder
-
high 7.5 ACF Frontend Admin by DynamiApps
-
high 7.2 Affiliate Super Assistent
-
medium 5.3 Cozy Blocks
-
high 7.2 Listdom
-
high 7.2 Master Addons for Elementor
-
high 8.8 Support Genix
-
medium 6.5 Persistent Login
-
medium 6.4 Live Composer
-
medium 6.4 Live Composer
-
medium 4.9 WP EasyCart
-
medium 6.4 ACF Frontend Admin by DynamiApps
-
critical 9.8 WPLP Cookie Consent
Monday, August 31, 2026 · 22
-
medium 5.4 MapSVG
-
high 7.4 RegistrationMagic
-
high 7.1 RegistrationMagic
-
high 8.1 Security Optimizer
Security issue
-
high 7.1 Affiliate Program Suite
-
critical 9.8 Tickera
-
critical 10.0 Hash Form
-
medium 6.5 Booking and Rental Manager for Bike
-
high 7.1 Email Essentials
-
medium 6.3 OwnerRez
-
high 7.1 Tailored Tools
-
critical 9.3 Throws SPAM Away
-
high 7.1 LeadConnector
-
critical 9.3 Smart Marketing SMS and Newsletters Forms
-
critical 9.3 WP Data Access
-
medium 6.5 Barcode Generator
-
high 8.5 Charitable
-
medium 5.4 Post SMTP
-
critical 10.0 WPLP Cookie Consent
-
medium 5.3 bbPress
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.