WordPress plugin vulnerabilities: week 37, 2026

203 vulnerabilities published Sep 7 – Sep 13, 2026 in 156 plugins we track, by day.

8 critical 67 high 122 medium 6 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, September 13, 2026 · 10

• high 7.5 MDJM Event Management

  Missing authorization check

  CVE-2026-88802 · affected older than 1.7.8.5 · fixed in 1.7.8.5

• medium 4.3 Quads Ads Manager for Google AdSense

  Security issue

  CVE-2026-89050 · affected 3.0.4 up to (not including) 3.0.5 · fixed in 3.0.5

• medium 5.3 Bookit

  Information disclosure

  CVE-2026-88995 · affected older than 2.6.0.1 · fixed in 2.6.0.1

• medium 4.2 rtMedia for WordPress, BuddyPress and bbPress

  Missing authorization check

  CVE-2026-88912 · affected older than 4.7.12 · fixed in 4.7.12

• high 7.5 Really Simple Security

  Authentication bypass

  CVE-2026-89080 · affected 9.5.10.1 up to (not including) 9.8.1 · fixed in 9.8.1

• medium 5.4 Simple Membership

  Privilege escalation

  CVE-2026-88764 · affected older than 4.7.8 · fixed in 4.7.8

• low 3.7 User Registration & Membership

  Information disclosure

  CVE-2026-86407 · affected 5.0 up to (not including) 5.2.8 · fixed in 5.2.8

• high 7.5 User Registration & Membership

  Privilege escalation

  CVE-2026-86406 · affected 4.4.6 up to (not including) 5.2.8 · fixed in 5.2.8

• medium 4.7 User Registration & Membership

  Open redirect

  CVE-2026-80072 · affected older than 5.2.8 · fixed in 5.2.8

• high 7.2 User Registration & Membership

  Privilege escalation

  CVE-2026-80071 · affected older than 5.2.8 · fixed in 5.2.8

Saturday, September 12, 2026 · 21

• medium 6.4 Booking for Appointments and Events Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-10148 · affected 2.4.9 and older · fixed in 2.4.10 *

• high 7.5 GEO my WP

  Remote code execution

  CVE-2026-85200 · affected 4.5.5.3 and older · fixed in 4.5.5.4 *

• medium 6.5 MPG

  SQL injection

  CVE-2026-85198 · affected 4.2.1 and older · fixed in 4.2.2 *

• medium 6.5 Smart Marketing SMS and Newsletters Forms

  SQL injection

  CVE-2026-77161 · affected 5.1.24 and older · fixed in 5.1.25 *

• critical 9.8 The Events Calendar

  Remote code execution

  CVE-2026-78159 · affected 6.17.3 and older · fixed in 6.17.3.1 *

• critical 9.8 The Events Calendar

  Remote code execution

  CVE-2026-78006 · affected 6.17.4 and older · fixed in 6.17.4.1 *

• high 8.8 Tutor LMS

  PHP object injection

  CVE-2026-78175 · affected 4.0.7 and older · fixed in 4.0.8 *

• high 7.5 rtMedia for WordPress, BuddyPress and bbPress

  SQL injection

  CVE-2026-16482 · affected 4.7.11 and older · fixed in 4.7.12 *

• medium 5.3 Royal Addons for Elementor

  Information disclosure

  CVE-2026-17585 · affected 1.7.1066 and older · fixed in 1.7.1067 *

• medium 5.3 DT LMS

  Missing authorization check

  CVE-2026-11355 · affected 1.1 and older · fix not stated

• medium 5.3 Rox Appointment Booking

  Missing authorization check

  CVE-2026-87894 · affected 1.0.9 up to (not including) 1.2.3 · fixed in 1.2.3

• medium 5.3 Rox Appointment Booking

  Missing authorization check

  CVE-2026-87892 · affected older than 1.2.0 · fixed in 1.2.0

• medium 6.5 Rox Appointment Booking

  Missing authorization check

  CVE-2026-87891 · affected older than 1.2.0 · fixed in 1.2.0

• medium 4.3 Sprout Invoices

  Missing authorization check

  CVE-2026-87797 · affected older than 20.8.16 · fixed in 20.8.16

• high 8.0 YayPricing

  Cross-site scripting (XSS)

  CVE-2026-87888 · affected older than 3.5.7 · fixed in 3.5.7

• low 2.7 Masteriyo LMS

  Missing authorization check

  CVE-2026-82851 · affected 1.14.0 up to (not including) 3.4.1 · fixed in 3.4.1

• medium 6.8 Masteriyo LMS

  Stored cross-site scripting (XSS)

  CVE-2026-82847 · affected older than 3.4.1 · fixed in 3.4.1

• critical 9.9 Masteriyo LMS

  Remote code execution

  CVE-2026-82845 · affected older than 3.4.1 · fixed in 3.4.1

• medium 5.3 SureRank SEO

  Information disclosure

  CVE-2026-78152 · affected 1.6.2 up to (not including) 1.10.1 · fixed in 1.10.1

• high 7.2 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2026-77705 · affected older than 2.4.10 · fixed in 2.4.10

• medium 5.3 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2026-77689 · affected 9.0 up to (not including) 9.8.1 · fix not stated

Friday, September 11, 2026 · 54

• medium 5.3 bbPress

  Information disclosure

  CVE-2026-62137 · affected 2.6.14 and older · fixed in 2.6.15

• medium 5.3 Flexible Quantity & Price Calculator for WooCo…

  Missing authorization check

  CVE-2026-62136 · affected 2.3.21 and older · fixed in 2.3.22

• medium 4.3 Site Kit by Google

  Cross-site request forgery (CSRF)

  CVE-2026-62139 · affected 1.186.0 and older · fixed in 1.187.0

• medium 5.3 Quiz and Survey Master (QSM)

  Missing authorization check

  CVE-2026-62140 · affected 11.2.5 and older · fixed in 11.2.6

• medium 6.5 Visual Composer Website Builder

  Cross-site scripting (XSS)

  CVE-2026-62138 · affected 45.16.1 and older · fixed in 45.16.2

• high 7.6 Booking for Appointments and Events Calendar

  SQL injection

  CVE-2026-62112 · affected 2.4.9 and older · fixed in 2.4.10

• medium 4.3 Starter Templates

  Missing authorization check

  CVE-2026-62134 · affected 4.7.5 and older · fixed in 4.7.6

• medium 5.3 Booktics

  Missing authorization check

  CVE-2026-62135 · affected 1.0.24 and older · fixed in 1.0.25

• medium 5.3 Passster

  Missing authorization check

  CVE-2026-62114 · affected 4.3.13 and older · fixed in 4.3.14

• medium 5.3 Masteriyo LMS

  Missing authorization check

  CVE-2026-62132 · affected 3.4.0 and older · fixed in 3.4.1

• medium 5.4 RTMKit for Elementor

  Cross-site request forgery (CSRF)

  CVE-2026-62133 · affected 2.1.5 and older · fixed in 2.1.6

• medium 4.3 Slim SEO

  Missing authorization check

  CVE-2026-62113 · affected 4.10.0 and older · fixed in 4.10.1

• medium 6.5 Bold Page Builder

  Cross-site scripting (XSS)

  CVE-2026-62110 · affected 5.9.9 and older · fixed in 5.9.10

• critical 9.8 Everest Forms

  PHP object injection

  CVE-2026-62103 · affected 3.6.0 and older · fixed in 3.6.1

• high 8.8 Gato GraphQL

  Privilege escalation

  CVE-2026-62102 · affected 19.2.3 and older · fixed in 19.2.4

• high 8.8 Masteriyo LMS

  PHP object injection

  CVE-2026-62107 · affected 3.4.0 and older · fixed in 3.4.1

• medium 6.5 Simple Payment

  Cross-site scripting (XSS)

  CVE-2026-62111 · affected 2.5.4 and older · fixed in 2.5.6

• high 7.6 Sky Addons for Elementor

  SQL injection

  CVE-2026-62109 · affected 3.8.4 and older · fixed in 3.8.5

• high 8.8 SMS Alert

  Privilege escalation

  CVE-2026-62106 · affected 3.9.9 and older · fixed in 4.0.0

• medium 5.3 Advanced Partial Payment or Deposit for WooCom…

  Missing authorization check

  CVE-2026-27378 · affected 3.1.0 and older · fixed in 4.0.1

• medium 5.3 ElasticPress

  Information disclosure

  CVE-2026-62088 · affected 5.3.4 and older · fixed in 5.3.5

• high 7.1 Master Addons for Elementor

  Missing authorization check

  CVE-2026-62089 · affected 3.2.2 and older · fixed in 3.2.3

• medium 6.5 GamiPress

  SQL injection

  CVE-2026-15439 · affected 7.9.7 and older · fixed in 7.9.9 *

• medium 4.3 BuddyPress

  Missing authorization check

  CVE-2024-12145 · affected 14.3.3 and older · fixed in 14.3.4 *

• medium 4.8 MetForm

  Security issue

  CVE-2026-86813 · affected older than 4.1.9 · fixed in 4.1.9

• medium 6.5 Simple CAPTCHA with Cloudflare Turnstile

  Content injection

  CVE-2026-85116 · affected 1.2.2 up to (not including) 1.42.3 · fixed in 1.42.3

• high 7.2 Kirki

  Stored cross-site scripting (XSS)

  CVE-2026-17037 · affected 6.2.0 and older · fixed in 6.2.1 *

• medium 6.4 Media Library Assistant

  Stored cross-site scripting (XSS)

  CVE-2026-6642 · affected 3.35 and older · fixed in 3.36 *

• medium 6.4 Media Library Assistant

  Stored cross-site scripting (XSS)

  CVE-2026-6641 · affected 3.35 and older · fixed in 3.36 *

• medium 6.4 Media Library Assistant

  Stored cross-site scripting (XSS)

  CVE-2026-6640 · affected 3.35 and older · fixed in 3.36 *

• medium 5.5 BackWPup

  Missing authorization check

  CVE-2026-86815 · affected 5.2.2 up to (not including) 5.7.5 · fixed in 5.7.5

• high 8.8 Gutenverse News

  Cross-site scripting (XSS)

  CVE-2026-85677 · affected older than 3.3.3 · fixed in 3.3.3

• medium 5.3 SSL Zen

  Authentication bypass

  CVE-2026-86781 · affected older than 4.7.40 · fixed in 4.7.40

• medium 5.5 Visualizer

  Missing authorization check

  CVE-2026-86782 · affected 4.0.0 up to (not including) 4.0.6 · fixed in 4.0.6

• low 2.7 Visualizer

  Missing authorization check

  CVE-2026-86779 · affected older than 4.0.6 · fixed in 4.0.6

• medium 5.3 YITH WooCommerce Wishlist

  Missing authorization check

  CVE-2026-82305 · affected older than 4.18.1 · fixed in 4.18.1

• low 3.5 Translate WordPress with GTranslate

  Cross-site scripting (XSS)

  CVE-2025-15695 · affected older than 3.0.10 · fixed in 3.0.10

• critical 9.8 MIPL Checkout Fields Manager for WooCommerce

  Arbitrary file upload

  CVE-2026-8778 · affected 1.2.2 and older · fixed in 1.2.3 *

• medium 6.1 WP-Members Membership Plugin

  Reflected cross-site scripting (XSS)

  CVE-2026-84960 · affected 3.5.6 and older · fixed in 3.5.7 *

• high 7.2 Simple Ajax Chat

  Stored cross-site scripting (XSS)

  CVE-2026-81825 · affected 20260811 and older · fixed in 20260827 *

• high 7.2 Vigilant

  Stored cross-site scripting (XSS)

  CVE-2026-81754 · affected 2.10.2 and older · fixed in 2.10.3 *

• medium 6.4 Bold Timeline Lite

  Stored cross-site scripting (XSS)

  CVE-2026-7438 · affected 1.2.8 and older · fixed in 1.3.0 *

• medium 6.1 Themify

  Reflected cross-site scripting (XSS)

  CVE-2026-78172 · affected 1.5.5 and older · fixed in 1.5.6 *

• medium 6.1 Unlimited Elements for Elementor

  Reflected cross-site scripting (XSS)

  CVE-2026-77150 · affected 2.0.16 and older · fixed in 2.0.21 *

• medium 6.1 Relevanssi

  Reflected cross-site scripting (XSS)

  CVE-2026-19985 · affected 4.28.1 and older · fixed in 4.28.2 *

• high 8.1 UsersWP

  Arbitrary file deletion

  CVE-2026-19991 · affected 1.2.70 and older · fixed in 1.2.71 *

• medium 6.1 Floating Chat Widget

  Reflected cross-site scripting (XSS)

  CVE-2026-18964 · affected 3.5.9 and older · fixed in 3.6.0 *

• medium 6.1 HUSKY

  Reflected cross-site scripting (XSS)

  CVE-2026-18562 · affected 1.4.3 and older · fixed in 1.4.5 *

• high 7.2 WP Photo Album Plus

  Stored cross-site scripting (XSS)

  CVE-2026-18579 · affected 9.2.08.003 and older · fixed in 9.2.09.001 *

• medium 5.3 OTP Login & Register Woocommerce

  Authentication bypass

  CVE-2026-12215 · affected 2.7.2 and older · fixed in 2.7.3 *

• high 7.5 Sticky Chat Widget

  SQL injection

  CVE-2026-15462 · affected 1.4.2 and older · fixed in 1.4.3 *

• high 7.5 Unlimited Elements for Elementor

  SQL injection

  CVE-2026-18561 · affected 2.0.16 and older · fixed in 2.0.21 *

• medium 6.5 PDF Builder for WooCommerce. Create invoices,p…

  Missing authorization check

  CVE-2026-11496 · affected 2.0.8 and older · fix not stated

• medium 5.3 Booktics

  Missing authorization check

  CVE-2026-11446 · affected 1.0.23 and older · fixed in 1.0.24 *

Thursday, September 10, 2026 · 45

• high 7.5 WP Fast Total Search

  Missing authorization check

  CVE-2026-84821 · affected 1.82.284 and older · fixed in 1.83.286

• medium 6.5 Groundhogg

  Path traversal / file read

  CVE-2026-85310 · affected 4.7.1 and older · fixed in 4.7.2

• high 7.1 WPCS

  Cross-site scripting (XSS)

  CVE-2026-84816 · affected 1.3.2 and older · fixed in 1.3.3

• high 7.1 WPAdverts

  Cross-site scripting (XSS)

  CVE-2026-84819 · affected 2.3.3 and older · fixed in 2.3.4

• high 7.5 RepairBuddy

  Remote code execution

  CVE-2026-81803 · affected 4.1224 and older · fixed in 4.1225

• critical 9.3 Verified Reviews (Avis Vérifiés)

  SQL injection

  CVE-2026-81800 · affected 2.4.6 and older · fix not stated

• high 8.1 SiteSkite

  Privilege escalation

  CVE-2026-81805 · affected 2.1.5 and older · fixed in 2.1.6

• high 7.5 Return Refund and Exchange For WooCommerce

  Missing authorization check

  CVE-2026-81799 · affected 4.6.4 and older · fixed in 4.6.5

• high 8.1 WP-Stateless

  Missing authorization check

  CVE-2026-81801 · affected 4.4.1 and older · fixed in 4.4.2

• high 7.3 WP Travel

  Authentication bypass

  CVE-2026-81796 · affected 12.0.3 and older · fixed in 12.0.4

• high 7.5 ZHBackup

  Information disclosure

  CVE-2026-81804 · affected 2.4.2 and older · fixed in 2.4.3

• medium 6.5 EventON

  Cross-site scripting (XSS)

  CVE-2026-81791 · affected 2.5.7 and older · fixed in 2.5.8 *

• high 7.1 Page Visits Counter

  Cross-site scripting (XSS)

  CVE-2026-81795 · affected 1.2.3 and older · fixed in 2.0.3 *

• medium 6.5 Salon Booking System

  Missing authorization check

  CVE-2026-81793 · affected 10.31.9 and older · fixed in 10.31.10 *

• high 7.5 affects latest 1.0.4 Shirt Product Designer for WooCommerce

  Missing authorization check

  CVE-2026-81794 · affected 1.0.4 only · no fix listed yet

• medium 6.3 IMPress for IDX Broker

  Missing authorization check

  CVE-2026-81788 · affected 3.3.0 and older · fixed in 3.3.1 *

• medium 6.5 IMPress for IDX Broker

  Authentication bypass

  CVE-2026-81787 · affected 3.3.0 and older · fixed in 3.3.1 *

• high 7.5 Thanko Thank You Page Customizer for WooCommerce

  Missing authorization check

  CVE-2026-81786 · affected 1.2.2 and older · fix not stated

• medium 6.5 BuddyForms

  Missing authorization check

  CVE-2026-81785 · affected 2.9.0 and older · fixed in 2.10.0 *

• high 7.1 MailMunch

  Authentication bypass

  CVE-2026-81783 · affected 3.2.5 and older · fixed in 3.2.6 *

• high 8.1 Wise Chat

  PHP object injection

  CVE-2026-81784 · affected 3.4.2 and older · fixed in 3.4.3 *

• medium 6.5 WP Docs

  Cross-site scripting (XSS)

  CVE-2026-81782 · affected 2.3.1 and older · fixed in 2.3.2 *

• medium 6.5 affects latest 1.3.7 Youzify

  Path traversal / file read

  CVE-2026-81275 · affected 1.3.7 and older · no fix listed yet

• medium 6.5 Robokassa payment gateway for Woocommerce

  Missing authorization check

  CVE-2026-78536 · affected 1.8.9 and older · fixed in 1.9.0 *

• medium 5.6 Simple CAPTCHA with Cloudflare Turnstile

  Security issue

  CVE-2026-66674 · affected 1.42.1 and older · fixed in 1.42.3

• medium 6.5 Simple CAPTCHA with Cloudflare Turnstile

  Content injection

  CVE-2026-66632 · affected 1.42.1 and older · fixed in 1.42.3

• medium 6.4 Redux Framework

  Stored cross-site scripting (XSS)

  CVE-2026-5399 · affected 4.5.13.1 and older · fixed in 4.5.14 *

• medium 6.4 Aruba HiSpeed Cache

  Stored cross-site scripting (XSS)

  CVE-2026-15889 · affected 3.0.14 and older · fixed in 3.0.15 *

• high 7.5 miniOrange 2FA

  Authentication bypass

  CVE-2026-77771 · affected 6.2.8 up to (not including) 6.3.1, 18.0 up to (not including) 19.3 · fixed in 6.3.1

• high 7.2 Registration Form for WooCommerce

  Privilege escalation

  CVE-2026-81431 · affected 1.1.0 up to (not including) 1.1.3 · fixed in 1.1.3

• high 8.1 Site Reviews

  PHP object injection

  CVE-2026-82925 · affected 7.2.2 up to (not including) 8.3.0 · fixed in 8.3.0

• critical 10.0 miniOrange 2FA

  Missing authorization check

  CVE-2026-77770 · affected 5.3.24 up to (not including) 6.3.1, 18.0 up to (not including) 19.3 · fixed in 6.3.1

• high 7.5 Ultimate Gift Cards for WooCommerce

  Information disclosure

  CVE-2026-19439 · affected 3.0.3 up to (not including) 3.2.10 · fixed in 3.2.10

• high 7.5 Ultimate Gift Cards for WooCommerce

  Missing authorization check

  CVE-2026-19436 · affected older than 3.2.10 · fixed in 3.2.10

• medium 6.1 Form Maker by 10Web

  Reflected cross-site scripting (XSS)

  CVE-2026-85645 · affected 1.15.46 and older · fixed in 1.15.47 *

• high 7.2 Sidebar Manager Light

  Stored cross-site scripting (XSS)

  CVE-2026-76562 · affected 1.18 and older · fix not stated

• medium 6.4 Easy Google Fonts

  Stored cross-site scripting (XSS)

  CVE-2026-4657 · affected 2.0.4 and older · fix not stated

• medium 4.3 Vsourz Form Entries for Contact Form 7

  Missing authorization check

  CVE-2026-18594 · affected 2.1.3 and older · fix not stated

• medium 4.3 Builderall for WordPress

  Missing authorization check

  CVE-2026-15823 · affected 3.0.2 and older · fix not stated

• medium 6.4 Builderall for WordPress

  Stored cross-site scripting (XSS)

  CVE-2026-15820 · affected 3.0.2 and older · fix not stated

• medium 4.9 WP BackItUp Community Edition

  Path traversal / file read

  CVE-2026-18386 · affected 2.1.0 and older · fix not stated

• medium 6.4 Builderall for WordPress

  Stored cross-site scripting (XSS)

  CVE-2026-15796 · affected 3.0.2 and older · fix not stated

• high 8.0 Bulk Password Reset

  Privilege escalation

  CVE-2026-14873 · affected 1.3.3 and older · fix not stated

• high 7.5 Direct Download for WooCommerce

  Path traversal / file read

  CVE-2026-15019 · affected 1.19 and older · fix not stated

• critical 9.8 Drag and Drop File Upload for Elementor Forms

  Arbitrary file upload

  CVE-2026-18351 · affected 1.6.0 and older · fixed in 1.6.1 *

Wednesday, September 9, 2026 · 50

• high 7.2 WPLP Cookie Consent

  Stored cross-site scripting (XSS)

  CVE-2026-14989 · affected 4.4.1 and older · fixed in 4.4.2 *

• high 7.2 PublishPress Capabilities

  Privilege escalation

  CVE-2026-75927 · affected 2.50.0 and older · fixed in 2.50.1 *

• medium 6.5 WPMR Google Feed Manager for WooCommerce

  SQL injection

  CVE-2026-19778 · affected 2.23.7 and older · fixed in 2.23.8 *

• medium 6.4 Points Management System For Gamification, Ran…

  Stored cross-site scripting (XSS)

  CVE-2026-17149 · affected 3.2.4 and older · fixed in 3.2.5 *

• medium 4.3 Checkout Custom Fields Builder for WooCommerce

  Remote code execution

  CVE-2026-19802 · affected 1.1.5 and older · fixed in 1.1.6 *

• medium 5.4 WPLP Cookie Consent

  Missing authorization check

  CVE-2026-85133 · affected older than 4.4.2 · fixed in 4.4.2

• medium 4.3 WPLP Cookie Consent

  Missing authorization check

  CVE-2026-85132 · affected 4.0.2 up to (not including) 4.4.2 · fixed in 4.4.2

• medium 5.3 Kirki

  Information disclosure

  CVE-2026-84222 · affected 6.2.1 up to (not including) 6.3.0 · fixed in 6.3.0

• medium 5.3 Sunshine Photo Cart

  Missing authorization check

  CVE-2026-85037 · affected older than 3.7 · fixed in 3.7

• medium 5.4 Orbit Fox

  Cross-site scripting (XSS)

  CVE-2026-85418 · affected older than 3.0.9 · fixed in 3.0.9

• medium 4.3 ilGhera Reviso Exporter for WooCommerce

  Missing authorization check

  CVE-2026-8615 · affected 1.2.3 and older · fixed in 1.2.4 *

• medium 5.3 WPFunnels

  Missing authorization check

  CVE-2026-84908 · affected 3.12.13 and older · fixed in 3.13.0 *

• high 7.2 WPBot

  Stored cross-site scripting (XSS)

  CVE-2026-83593 · affected 8.7.3 and older · fixed in 8.7.4 *

• medium 4.3 WPLP Cookie Consent

  Missing authorization check

  CVE-2026-82185 · affected 3.6.5 up to (not including) 4.4.2 · fixed in 4.4.2

• medium 5.3 WPLP Cookie Consent

  Cross-site request forgery (CSRF)

  CVE-2026-82184 · affected 3.5.0 up to (not including) 4.4.2 · fixed in 4.4.2

• medium 4.7 Groundhogg

  Open redirect

  CVE-2026-81741 · affected older than 4.7.2 · fixed in 4.7.2

• medium 5.3 Masteriyo LMS

  Missing authorization check

  CVE-2026-82848 · affected 1.3.1 up to (not including) 3.4.0 · fixed in 3.4.0

• medium 4.1 Quentn WP

  SQL injection

  CVE-2026-84113 · affected older than 1.2.15 · fixed in 1.2.15

• high 8.6 Quentn WP

  SQL injection

  CVE-2026-84068 · affected 1.2.13 up to (not including) 1.2.15 · fixed in 1.2.15

• medium 6.8 Sina Extension for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-83541 · affected 3.7.1 up to (not including) 3.10.4 · fixed in 3.10.4

• medium 5.3 SupportCandy

  Information disclosure

  CVE-2026-81022 · affected 3.3.6 up to (not including) 3.5.3 · fixed in 3.5.3

• high 8.1 Next-Cart Store to WooCommerce Migration

  Arbitrary file deletion

  CVE-2026-76009 · affected 3.9.8 and older · fixed in 3.9.9 *

• medium 5.9 Payment Plugins for PayPal WooCommerce

  Missing authorization check

  CVE-2026-80341 · affected 1.1.0 up to (not including) 2.0.26 · fixed in 2.0.26

• medium 5.3 Payment Plugins for PayPal WooCommerce

  Information disclosure

  CVE-2026-80340 · affected 1.0.0 up to (not including) 2.0.26 · fixed in 2.0.26

• medium 5.3 SupportCandy

  Information disclosure

  CVE-2026-81021 · affected 3.2.9 up to (not including) 3.5.3 · fixed in 3.5.3

• medium 6.5 Ultimate Gift Cards for WooCommerce

  Missing authorization check

  CVE-2026-75861 · affected older than 3.2.10 · fixed in 3.2.10

• medium 5.3 Payment Plugins for Stripe WooCommerce

  Information disclosure

  CVE-2026-80339 · affected 4.0.0 up to (not including) 4.0.12 · fixed in 4.0.12

• medium 4.3 WP Recipe Maker

  Missing authorization check

  CVE-2026-75905 · affected 10.8.0 and older · fixed in 10.8.1 *

• medium 4.3 Awesome Support

  Missing authorization check

  CVE-2026-19946 · affected 6.3.9 and older · fixed in 6.4.0 *

• medium 5.3 WP Travel

  Missing authorization check

  CVE-2026-18042 · affected older than 12.0.2 · fixed in 12.0.2

• low 3.7 WP Travel

  Missing authorization check

  CVE-2026-13146 · affected older than 12.0.2 · fixed in 12.0.2

• low 3.7 WP Travel

  Missing authorization check

  CVE-2026-13144 · affected older than 12.0.2 · fixed in 12.0.2

• medium 6.4 WP Crowdfunding

  Stored cross-site scripting (XSS)

  CVE-2026-19945 · affected 2.2.1 and older · fixed in 2.2.2 *

• medium 5.4 Eventin

  Missing authorization check

  CVE-2026-11821 · affected 4.1.17 and older · fixed in 4.1.18 *

• high 7.2 Repeater Fields for Gravity Forms

  Stored cross-site scripting (XSS)

  CVE-2026-84293 · affected 3.0.4 and older · fixed in 3.1.0 *

• medium 6.1 Product Filter for WooCommerce by WBW

  Reflected cross-site scripting (XSS)

  CVE-2026-7804 · affected 3.4.2 and older · fixed in 3.4.3 *

• medium 6.4 My Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-77187 · affected 3.8.3 and older · fixed in 3.8.11 *

• medium 6.4 My Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-77186 · affected 3.8.3 and older · fixed in 3.8.11 *

• medium 6.4 Podlove Podcast Publisher

  Stored cross-site scripting (XSS)

  CVE-2026-75966 · affected 4.5.5 and older · fixed in 4.5.6 *

• medium 4.9 Mail Mint

  SQL injection

  CVE-2026-19800 · affected 1.31.0 and older · fixed in 1.31.1 *

• medium 6.1 User Access Manager

  Reflected cross-site scripting (XSS)

  CVE-2026-19797 · affected 2.3.18 and older · fixed in 2.3.19 *

• medium 4.9 WP Crowdfunding

  SQL injection

  CVE-2026-19944 · affected 2.2.1 and older · fixed in 2.2.2 *

• medium 6.6 Ninja Forms

  PHP object injection

  CVE-2026-11363 · affected 3.14.6 and older · fixed in 3.14.7 *

• high 7.2 WP EasyCart

  Privilege escalation

  CVE-2026-17553 · affected 5.9.3 and older · fixed in 5.9.4 *

• high 8.8 FireBox

  Remote code execution

  CVE-2026-76801 · affected 3.1.10 and older · fixed in 3.1.11 *

• high 7.5 Eventin

  File inclusion

  CVE-2026-15667 · affected 4.1.22 and older · fixed in 4.1.23 *

• high 7.5 Eventin

  File inclusion

  CVE-2026-15406 · affected 4.1.22 and older · fixed in 4.1.23 *

• high 7.2 Contact Form to DB by BestWebSoft

  Stored cross-site scripting (XSS)

  CVE-2026-13359 · affected 1.7.5 and older · fixed in 1.7.6 *

• medium 6.4 Graphina

  Stored cross-site scripting (XSS)

  CVE-2026-13709 · affected 3.1.11 and older · fixed in 3.1.12 *

• medium 5.3 Eventin

  Missing authorization check

  CVE-2026-12956 · affected 4.1.22 and older · fixed in 4.1.23 *

Tuesday, September 8, 2026 · 17

• medium 6.4 Zephyr Project Manager

  Stored cross-site scripting (XSS)

  CVE-2026-76931 · affected 3.3.205 and older · fix not stated

• medium 5.4 Online Scheduling and Appointment Booking System

  Missing authorization check

  CVE-2026-2520 · affected 27.2 and older · fixed in 27.3 *

• high 7.5 Event Tickets and Registration

  Missing authorization check

  CVE-2026-3174 · affected 5.27.4 and older · fixed in 5.27.4.1 *

• medium 6.5 Beaver Builder Page Builder

  Remote code execution

  CVE-2026-18021 · affected 2.10.3.1 and older · fixed in 2.10.3.2 *

• medium 6.5 WPML Multilingual CMS

  SQL injection

  CVE-2026-17509 · affected 4.9.5 and older · fix not stated

• high 8.8 Live Composer

  PHP object injection

  CVE-2026-16502 · affected 2.1.18 and older · fixed in 2.1.19 *

• medium 6.4 LearnPress

  Stored cross-site scripting (XSS)

  CVE-2026-12230 · affected 4.3.9.1 and older · fixed in 4.4.0 *

• high 7.1 Easy Appointments

  Cross-site scripting (XSS)

  CVE-2026-81798 · affected 4.0.2.1 and older · fixed in 4.0.2.2 *

• high 7.2 Hide My WP Ghost

  Server-side request forgery (SSRF)

  CVE-2026-81806 · affected 7.0.09 and older · fixed in 7.0.10

• high 7.1 JetFormBuilder

  Cross-site scripting (XSS)

  CVE-2026-84817 · affected 3.6.5.1 and older · fixed in 3.6.5.2

• medium 6.5 Event Booking Manager for WooCommerce

  Missing authorization check

  CVE-2026-81802 · affected 5.6.0 and older · fixed in 5.6.4

• high 7.1 Open User Map

  Cross-site scripting (XSS)

  CVE-2026-84818 · affected 1.4.50 and older · fixed in 1.4.51

• high 7.1 Unlimited Elements for Elementor

  Cross-site scripting (XSS)

  CVE-2026-84820 · affected 2.0.17 and older · fixed in 2.0.18

• high 7.5 Csomagpontok és Címkék WooCommerce-hez

  Missing authorization check

  CVE-2026-81790 · affected older than 4.2.8 · fixed in 4.2.8

• high 7.1 Unbounce Landing Pages

  Missing authorization check

  CVE-2026-81781 · affected 1.1.4 and older · fixed in 1.1.5 *

• medium 6.5 CatalogX Product Catalog, Product Enquiry & Qu…

  Privilege escalation

  CVE-2026-81792 · affected 6.1.5 and older · fixed in 6.1.6

• high 7.5 WooCommerce

  Denial of service

  CVE-2026-48888 · affected older than 11.1.0 · fixed in 11.1.0

Monday, September 7, 2026 · 6

• medium 6.5 Email Subscribers & Newsletters by Icegram Exp…

  Remote code execution

  CVE-2026-12757 · affected 5.9.27 and older · fixed in 5.9.28 *

• medium 5.3 Masteriyo LMS

  Missing authorization check

  CVE-2026-8279 · affected 2.2.0 and older · fixed in 2.2.1 *

• high 7.2 User Profile Builder

  Stored cross-site scripting (XSS)

  CVE-2026-6431 · affected 3.15.7 and older · fixed in 3.15.8 *

• medium 5.3 Otter Blocks

  Missing authorization check

  CVE-2026-4945 · affected 3.1.7 and older · fixed in 3.1.8 *

• medium 5.4 Flamingo

  Missing authorization check

  CVE-2026-12853 · affected 2.6.2 and older · fixed in 2.6.3 *

• medium 6.4 Powerkit

  Stored cross-site scripting (XSS)

  CVE-2026-2390 · affected 3.0.4 and older · fixed in 3.0.5 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan