WordPress plugin vulnerabilities: week 38, 2026

252 vulnerabilities published Sep 14 – Sep 20, 2026 in 171 plugins we track, by day.

8 critical 59 high 166 medium 19 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, September 20, 2026 · 18

• high 7.2 Import and export users and customers

  Privilege escalation

  CVE-2026-92541 · affected older than 2.5.2 · fixed in 2.5.2

• high 7.2 Import and export users and customers

  Privilege escalation

  CVE-2026-92540 · affected 2.4.16 up to (not including) 2.5.2 · fixed in 2.5.2

• low 2.7 Meow Gallery

  Information disclosure

  CVE-2026-92423 · affected older than 5.5.5 · fixed in 5.5.5

• medium 6.5 Meow Gallery

  Security issue

  CVE-2026-92422 · affected older than 5.5.5 · fixed in 5.5.5

• low 3.7 TikTok

  Missing authorization check

  CVE-2026-92965 · affected 1.2.0 up to (not including) 1.4.2 · fixed in 1.4.2

• medium 6.6 Forminator Forms

  Privilege escalation

  CVE-2026-87068 · affected 1.57.0 up to (not including) 1.57.2.1 · fixed in 1.57.2.1

• high 8.5 Forminator Forms

  Remote code execution

  CVE-2026-87067 · affected 1.57.0.7 up to (not including) 1.57.2.1 · fixed in 1.57.2.1

• medium 6.8 Kirki

  Cross-site scripting (XSS)

  CVE-2026-84223 · affected 6.0.0 up to (not including) 6.3.1 · fixed in 6.3.1

• high 8.1 SAML Single Sign On

  Privilege escalation

  CVE-2026-82842 · affected 4.8.43 up to (not including) 6.0.0 · fixed in 6.0.0

• medium 4.3 Sign-up Sheets

  Cross-site request forgery (CSRF)

  CVE-2026-92410 · affected older than 2.4.0 · fixed in 2.4.0

• high 7.5 Unlimited Elements for Elementor

  PHP object injection

  CVE-2026-85017 · affected older than 2.0.20 · fixed in 2.0.20

• medium 4.1 Import and export users and customers

  Server-side request forgery (SSRF)

  CVE-2026-16542 · affected older than 2.4.5 · fixed in 2.4.5

• low 3.1 Photo Gallery, Sliders, Proofing and Themes

  Missing authorization check

  CVE-2026-81654 · affected older than 4.5.0 · fixed in 4.5.0

• medium 4.2 Photo Gallery, Sliders, Proofing and Themes

  Missing authorization check

  CVE-2026-81653 · affected older than 4.5.0 · fixed in 4.5.0

• low 2.7 Photo Gallery, Sliders, Proofing and Themes

  Missing authorization check

  CVE-2026-81652 · affected 3.59.5 up to (not including) 4.5.0 · fixed in 4.5.0

• low 3.1 Photo Gallery, Sliders, Proofing and Themes

  Missing authorization check

  CVE-2026-81651 · affected older than 4.5.0 · fixed in 4.5.0

• high 7.2 Photo Gallery, Sliders, Proofing and Themes

  Remote code execution

  CVE-2026-81650 · affected older than 4.5.0 · fixed in 4.5.0

• medium 6.8 Master Slider

  Stored cross-site scripting (XSS)

  CVE-2026-14844 · affected 3.11.2 and older · fixed in 3.11.3 *

Saturday, September 19, 2026 · 63

• medium 4.3 Datalogics Ecommerce Delivery

  Missing authorization check

  CVE-2026-9613 · affected 2.6.65 and older · fixed in 2.6.66 *

• medium 4.3 Empik for Woocommerce

  Missing authorization check

  CVE-2026-9766 · affected 1.5.1 and older · fixed in 1.5.2 *

• medium 4.3 Partial Shipment for WooCommerce

  Missing authorization check

  CVE-2026-9858 · affected 3.4 and older · fixed in 3.5 *

• medium 6.4 Gum Addon for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-8354 · affected 1.3.15 and older · fixed in 1.3.16 *

• medium 4.7 LiteSpeed Cache

  Reflected cross-site scripting (XSS)

  CVE-2026-76579 · affected 7.9 and older · fixed in 7.9.1 *

• medium 6.4 Redux Framework

  Stored cross-site scripting (XSS)

  CVE-2026-5410 · affected 4.5.13 and older · fixed in 4.5.14 *

• medium 5.3 WordLift

  Information disclosure

  CVE-2026-9289 · affected 3.54.10 and older · fixed in 3.54.11 *

• medium 6.4 YS LeadGen

  Stored cross-site scripting (XSS)

  CVE-2026-1256 · affected 2.1.4 and older · fixed in 2.1.5 *

• high 7.5 YS LeadGen

  Information disclosure

  CVE-2026-1255 · affected 2.1.4 and older · fixed in 2.1.5 *

• medium 5.3 TikTok

  Missing authorization check

  CVE-2026-18346 · affected 1.4.1 and older · fixed in 1.4.2 *

• medium 6.5 Custom Field Template

  SQL injection

  CVE-2026-9855 · affected 2.7.8 and older · fixed in 2.8 *

• medium 6.5 Easy Appointments

  Information disclosure

  CVE-2026-9232 · affected 3.12.27 and older · fixed in 3.12.28 *

• medium 4.3 Flex Import

  Missing authorization check

  CVE-2026-9615 · affected 3.0 and older · fixed in 3.1 *

• medium 5.3 Payment Gateway of Stripe for WooCommerce

  Security issue

  CVE-2026-9832 · affected 5.0.8 and older · fixed in 5.0.9 *

• medium 5.3 Bread

  Information disclosure

  CVE-2026-4792 · affected 2.9.12 and older · fixed in 2.9.13 *

• medium 4.9 GoPay for WooCommerce

  SQL injection

  CVE-2026-75959 · affected 1.0.36 and older · fixed in 1.0.37 *

• medium 4.7 Hide My WP Ghost

  Open redirect

  CVE-2026-7527 · affected 7.0.02 and older · fixed in 7.0.06 *

• medium 6.1 MC4WP

  Reflected cross-site scripting (XSS)

  CVE-2026-87917 · affected 4.14.0 and older · fixed in 4.14.1 *

• medium 6.4 Redux Framework

  Stored cross-site scripting (XSS)

  CVE-2026-5400 · affected 4.5.13 and older · fixed in 4.5.14 *

• medium 4.9 WP Optimizer

  SQL injection

  CVE-2026-6295 · affected 2.5.0 and older · fixed in 2.6.5 *

• high 8.1 ProfilePress

  Remote code execution

  CVE-2026-85658 · affected 4.17.2 and older · fixed in 4.17.3 *

• medium 4.3 BlockSpare

  Missing authorization check

  CVE-2026-1242 · affected 4.2.6 and older · fixed in 5.0.1 *

• medium 5.3 Ibtana

  Missing authorization check

  CVE-2026-1984 · affected 0.4.7.7 and older · fixed in 0.4.7.8 *

• medium 4.3 Search Atlas SEO

  Missing authorization check

  CVE-2026-15947 · affected 2.6.23 and older · fixed in 2.6.24 *

• medium 6.4 WP Composer

  Stored cross-site scripting (XSS)

  CVE-2026-2422 · affected 1.0.5 and older · fix not stated

• high 8.8 The Welcomizer

  Remote code execution

  CVE-2026-4327 · affected 2.8.1 and older · fixed in 999.0 *

• medium 6.5 Wow Elements Addons for Elementor

  Server-side request forgery (SSRF)

  CVE-2026-1641 · affected 1.11.2 and older · fixed in 1.11.3 *

• medium 6.4 AppMySite

  Stored cross-site scripting (XSS)

  CVE-2026-13770 · affected 3.15.3 and older · fixed in 3.15.4 *

• medium 6.5 Create

  SQL injection

  CVE-2026-13200 · affected 2.5.3 and older · fixed in 2.5.4 *

• medium 6.5 Create

  SQL injection

  CVE-2026-13191 · affected 2.5.3 and older · fixed in 2.5.4 *

• medium 4.3 Search Atlas SEO

  Missing authorization check

  CVE-2026-15946 · affected 2.6.23 and older · fixed in 2.6.24 *

• high 7.2 Quill Forms

  Stored cross-site scripting (XSS)

  CVE-2026-15664 · affected 5.7.1 and older · fixed in 5.7.2 *

• medium 6.4 Real3D Flipbook

  Stored cross-site scripting (XSS)

  CVE-2026-15098 · affected 5.1.1 and older · fixed in 5.1.2 *

• medium 6.1 SSL Zen

  Reflected cross-site scripting (XSS)

  CVE-2026-15463 · affected 4.7.42 and older · fixed in 4.7.43 *

• medium 4.4 OTP Login & Register Woocommerce

  Stored cross-site scripting (XSS)

  CVE-2026-12402 · affected 2.7.3 and older · fixed in 2.7.4 *

• medium 4.3 PDF Builder for WooCommerce. Create invoices,p…

  Missing authorization check

  CVE-2026-11899 · affected 2.0.11 and older · fix not stated

• medium 6.1 WP Customer Reviews

  Reflected cross-site scripting (XSS)

  CVE-2026-11608 · affected 3.7.8 and older · fixed in 3.8.0 *

• medium 5.5 Hydra Booking

  Missing authorization check

  CVE-2026-92425 · affected older than 1.2.4 · fixed in 1.2.4

• medium 5.3 Mailchimp for WooCommerce

  Missing authorization check

  CVE-2026-92435 · affected older than 6.1.1 · fixed in 6.1.1

• medium 5.3 Rede Itaú for WooCommerce

  Missing authorization check

  CVE-2026-92430 · affected 3.6.1 up to (not including) 5.4.7 · fixed in 5.4.7

• medium 4.8 Online Scheduling and Appointment Booking System

  Missing authorization check

  CVE-2026-91847 · affected 28.1 up to (not including) 28.2 · fixed in 28.2

• low 3.8 Hydra Booking

  Missing authorization check

  CVE-2026-92420 · affected older than 1.2.2 · fixed in 1.2.2

• high 8.6 VikRentItems Flexible Rental Management System

  SQL injection

  CVE-2026-88926 · affected older than 1.2.4 · fixed in 1.2.4

• high 7.1 Estatik Real Estate Plugin

  Reflected cross-site scripting (XSS)

  CVE-2026-76790 · affected 4.0.1 up to (not including) 4.3.5 · fixed in 4.3.5

• medium 5.5 JetFormBuilder

  Security issue

  CVE-2026-19860 · affected 3.5.6.2 up to (not including) 3.6.5.3 · fixed in 3.6.5.3

• medium 6.5 Ultra Addons for Contact Form 7

  Stored cross-site scripting (XSS)

  CVE-2026-84750 · affected 3.2.4 up to (not including) 3.5.51 · fixed in 3.5.51

• high 8.8 Ultimate Member

  Cross-site scripting (XSS)

  CVE-2026-85680 · affected older than 2.13.1 · fixed in 2.13.1

• high 8.0 Unbounce Landing Pages

  Missing authorization check

  CVE-2026-85574 · affected 1.1.1 up to (not including) 1.1.5 · fixed in 1.1.5

• high 7.2 WP Import Export Lite

  Privilege escalation

  CVE-2026-76554 · affected older than 3.9.35 · fixed in 3.9.35

• medium 6.1 Pochipp

  Reflected cross-site scripting (XSS)

  CVE-2026-92967 · affected 1.20.2 and older · fixed in 1.20.3 *

• critical 9.1 Forminator Forms

  Remote code execution

  CVE-2026-92229 · affected 1.57.2 and older · fixed in 1.57.2.1 *

• high 8.8 Save as PDF Plugin by PDFCrowd

  Remote code execution

  CVE-2026-92807 · affected 4.6.1 and older · fixed in 4.6.2 *

• medium 6.5 Better Messages

  Missing authorization check

  CVE-2026-89334 · affected 2.15.33 and older · fixed in 3.0.0 *

• medium 5.3 Better Messages

  Information disclosure

  CVE-2026-89093 · affected 2.15.33 and older · fixed in 3.0.0 *

• medium 6.5 Tutor LMS

  Missing authorization check

  CVE-2026-89333 · affected 4.0.8 and older · fixed in 4.0.9 *

• medium 6.1 Tutor LMS

  Reflected cross-site scripting (XSS)

  CVE-2026-89081 · affected 4.0.8 and older · fixed in 4.0.9 *

• medium 4.3 Tutor LMS

  Missing authorization check

  CVE-2026-88944 · affected 4.0.8 and older · fixed in 4.0.9 *

• critical 9.1 WP Recipe Maker

  Remote code execution

  CVE-2026-89274 · affected 10.8.1 and older · fixed in 10.8.2 *

• high 7.5 WP Photo Album Plus

  Remote code execution

  CVE-2026-87909 · affected 9.2.09.002 and older · fixed in 9.2.10.001 *

• medium 4.3 SEO Booster

  Missing authorization check

  CVE-2026-15660 · affected 7.4.7 and older · fixed in 7.4.8 *

• high 7.2 Asset CleanUp

  Stored cross-site scripting (XSS)

  CVE-2026-13354 · affected 1.4.0.5 and older · fixed in 1.4.0.6 *

• medium 4.4 WP2Social Auto Publish

  Stored cross-site scripting (XSS)

  CVE-2026-12042 · affected 2.4.12 and older · fixed in 2.4.13 *

• medium 6.4 WPComplete

  Stored cross-site scripting (XSS)

  CVE-2026-77820 · affected 2.9.9.0 and older · fix not stated

Friday, September 18, 2026 · 67

• medium 5.4 WP Recipe Maker

  Stored cross-site scripting (XSS)

  CVE-2026-90884 · affected 10.8.1 and older · fixed in 10.8.2 *

• high 7.2 Popup Maker

  Stored cross-site scripting (XSS)

  CVE-2026-87915 · affected 1.24.0 and older · fixed in 1.25.0 *

• high 7.2 Jeg Kit for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-18405 · affected 3.2.16 and older · fixed in 3.2.17 *

• medium 6.4 Popup Maker

  Stored cross-site scripting (XSS)

  CVE-2026-15797 · affected 1.24.0 and older · fixed in 1.25.0 *

• high 7.2 Complianz GDPR/CCPA Cookie Consent Banner

  Stored cross-site scripting (XSS)

  CVE-2026-83561 · affected 7.5.4 and older · fixed in 7.5.5 *

• high 8.1 Master Addons for Elementor

  Missing authorization check

  CVE-2026-85410 · affected 3.2.2 and older · fixed in 3.2.3 *

• medium 4.4 CSS & JavaScript Toolbox

  Stored cross-site scripting (XSS)

  CVE-2025-13533 · affected 12.0.6 and older · fixed in 12.0.7 *

• medium 6.1 Qi Addons For Elementor

  Reflected cross-site scripting (XSS)

  CVE-2026-92249 · affected 1.11 and older · fixed in 1.11.1 *

• medium 6.4 Strong Testimonials

  Stored cross-site scripting (XSS)

  CVE-2026-92622 · affected 3.3.8 and older · fixed in 3.3.9 *

• medium 6.1 ShopLentor

  Reflected cross-site scripting (XSS)

  CVE-2026-92554 · affected 3.5.1 and older · fixed in 3.5.2 *

• medium 6.1 Newsletter

  Reflected cross-site scripting (XSS)

  CVE-2026-90981 · affected 9.3.8 and older · fixed in 9.3.9 *

• medium 4.9 NEX-Forms

  SQL injection

  CVE-2026-75961 · affected 9.3.0 and older · fixed in 9.3.1 *

• medium 6.5 Photo Gallery by 10Web

  SQL injection

  CVE-2026-85652 · affected 1.8.44 and older · fixed in 1.8.45 *

• medium 6.4 VK All in One Expansion Unit

  Stored cross-site scripting (XSS)

  CVE-2026-17586 · affected 9.118.0 and older · fixed in 9.119.0 *

• high 7.5 WCFM Marketplace

  SQL injection

  CVE-2026-18442 · affected 3.8.2 and older · fixed in 3.8.3 *

• medium 4.9 Store Exporter

  Path traversal / file read

  CVE-2026-16777 · affected 2.8.0 and older · fixed in 2.8.1 *

• medium 6.5 WP Inventory Manager

  SQL injection

  CVE-2026-17607 · affected 2.5.1 and older · fixed in 2.5.2 *

• medium 5.4 FileBird

  Stored cross-site scripting (XSS)

  CVE-2026-15004 · affected 6.5.6 and older · fixed in 6.5.7 *

• medium 6.4 Kubio AI Page Builder

  Stored cross-site scripting (XSS)

  CVE-2026-14472 · affected 2.8.4 and older · fixed in 2.8.5 *

• medium 4.3 Appointment Booking Plugin

  Missing authorization check

  CVE-2026-13471 · affected 5.6.3 and older · fixed in 5.6.4 *

• high 8.8 Mapster WP Maps

  Privilege escalation

  CVE-2026-12954 · affected 1.23.0 and older · fixed in 1.24.0 *

• high 7.5 Printcart Store

  Path traversal / file read

  CVE-2026-14323 · affected 2.8.5 and older · fixed in 2.8.6 *

• medium 4.3 WP Easy Pay

  Missing authorization check

  CVE-2026-12739 · affected 4.5.0 and older · fixed in 4.5.1 *

• medium 6.5 Download Manager

  Missing authorization check

  CVE-2026-92714 · affected 3.3.68 and older · fixed in 3.3.69 *

• high 7.2 Booking Calendar

  Privilege escalation

  CVE-2026-92619 · affected 11.8.2 and older · fixed in 11.8.3 *

• medium 6.1 Booking Calendar

  Reflected cross-site scripting (XSS)

  CVE-2026-92561 · affected 11.8.2 and older · fixed in 11.8.3 *

• medium 5.3 Clean Login

  Security issue

  CVE-2026-90977 · affected older than 1.19 · fixed in 1.19

• medium 5.3 Clean Login

  Missing authorization check

  CVE-2026-90976 · affected older than 1.19 · fixed in 1.19

• medium 6.1 EmbedPress

  Reflected cross-site scripting (XSS)

  CVE-2026-89330 · affected 4.6.5 and older · fixed in 4.6.6 *

• high 8.1 Filter Gallery

  Missing authorization check

  CVE-2026-89413 · affected 1.1.4 and older · fixed in 1.1.5 *

• medium 5.3 GPTranslate

  Information disclosure

  CVE-2026-89278 · affected 2.34.6 and older · fixed in 2.34.7 *

• medium 6.6 All Bootstrap Blocks

  File inclusion

  CVE-2026-88994 · affected 1.3.20 to 1.3.31 · fix not stated

• medium 6.5 Breeze Cache

  Security issue

  CVE-2026-79713 · affected 1.2.5 up to (not including) 2.5.15 · fixed in 2.5.15

• medium 6.4 Custom Twitter Feeds

  Stored cross-site scripting (XSS)

  CVE-2026-84909 · affected 2.8.0 and older · fixed in 2.9.0 *

• medium 4.3 Filter Gallery

  Missing authorization check

  CVE-2026-89138 · affected 1.1.4 and older · fixed in 1.1.5 *

• medium 5.3 Hide My WP Ghost

  Security issue

  CVE-2026-86800 · affected older than 7.0.11 · fixed in 7.0.11

• medium 5.3 Hide My WP Ghost

  Security issue

  CVE-2026-86796 · affected 7.0.10 up to (not including) 7.0.11 · fixed in 7.0.11

• medium 4.3 Magazine Blocks

  Missing authorization check

  CVE-2026-75017 · affected 1.8.6 and older · fixed in 1.8.7 *

• medium 6.4 Auto Upload Images

  Server-side request forgery (SSRF)

  CVE-2026-12106 · affected 3.3.2 and older · fixed in 3.4.0 *

• medium 4.3 Foxtool All-in-One

  Stored cross-site scripting (XSS)

  CVE-2026-18317 · affected 2.5.3 and older · fixed in 2.5.4 *

• medium 6.5 InfiniteWP Client

  SQL injection

  CVE-2026-17576 · affected 1.13.9 and older · fixed in 1.13.10 *

• medium 6.4 Magazine Blocks

  Stored cross-site scripting (XSS)

  CVE-2026-75016 · affected 1.8.6 and older · fixed in 1.8.7 *

• medium 6.8 All Bootstrap Blocks

  Cross-site scripting (XSS)

  CVE-2026-88993 · affected 1.3.31 and older · fix not stated

• low 2.7 Bookit

  Information disclosure

  CVE-2026-89008 · affected older than 2.6.0.5 · fixed in 2.6.0.5

• low 2.7 Bookit

  Missing authorization check

  CVE-2026-89007 · affected older than 2.6.0.5 · fixed in 2.6.0.5

• high 7.1 Filter Gallery

  Missing authorization check

  CVE-2026-90978 · affected 1.1.2 up to (not including) 1.1.5 · fixed in 1.1.5

• medium 5.8 Generate PDF using Contact Form 7

  Server-side request forgery (SSRF)

  CVE-2026-90984 · affected older than 4.2.2 · fixed in 4.2.2

• high 8.8 iGMS Direct Booking

  Cross-site scripting (XSS)

  CVE-2026-88825 · affected older than 2.0 · fixed in 2.0

• low 2.7 MasterStudy LMS WordPress Plugin

  Missing authorization check

  CVE-2026-88844 · affected 3.6.2 up to (not including) 3.7.50 · fixed in 3.7.50

• medium 5.3 Really Simple Security

  Denial of service

  CVE-2026-88798 · affected 8.1.6 up to (not including) 9.8.3 · fixed in 9.8.3

• high 7.1 WordPress

  Cross-site scripting (XSS)

  CVE-2026-93485 · affected 7.1 only, 7.0 to 7.0.4, 6.9 to 6.9.7, 6.8 to 6.8.8, 6.7 to 6.7.7, 6.6 to 6.6.7, 6.5 to 6.5.10, 6.4 to 6.4.10, 6.3 to 6.3.10, 6.2 to 6.2.11, 6.1 to 6.1.12, 6.0 to 6.0.14, 5.9 to 5.9.16, 5.8 to 5.8.15, 5.7 to 5.7.17, 5.6 to 5.6.19, 5.5 to 5.5.20, 5.4 to 5.4.21, 5.3 to 5.3.23, 5.2 to 5.2.26, 5.1 to 5.1.24, 5.0 to 5.0.27, 4.9 to 4.9.31, 4.8 to 4.8.30, 4.7 to 4.7.35 · fixed in 7.0.5

• medium 5.3 Easy Appointments

  Missing authorization check

  CVE-2026-87966 · affected 4.0 up to (not including) 4.0.2.2 · fixed in 4.0.2.2

• medium 4.8 Easy Appointments

  Missing authorization check

  CVE-2026-87965 · affected older than 4.0.2.2 · fixed in 4.0.2.2

• high 8.8 VikBooking Hotel Booking Engine & PMS

  Cross-site scripting (XSS)

  CVE-2026-85127 · affected 1.8.8 up to (not including) 1.8.15 · fixed in 1.8.15

• high 7.2 All-in-One WP Migration and Backup

  Privilege escalation

  CVE-2026-81810 · affected older than 7.111 · fixed in 7.111

• medium 5.3 Easy Form Builder by WhiteStudio

  Missing authorization check

  CVE-2026-85123 · affected 4.0.0 up to (not including) 4.2.0 · fixed in 4.2.0

• high 8.8 Easy Form Builder by WhiteStudio

  Stored cross-site scripting (XSS)

  CVE-2026-85122 · affected 4.0.0 up to (not including) 4.2.0 · fixed in 4.2.0

• low 3.8 King Addons for Elementor

  Missing authorization check

  CVE-2026-84904 · affected 51.1.56 up to (not including) 51.1.81 · fixed in 51.1.81

• low 2.7 King Addons for Elementor

  Information disclosure

  CVE-2026-84903 · affected older than 51.1.81 · fixed in 51.1.81

• medium 6.8 King Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-84902 · affected older than 51.1.81 · fixed in 51.1.81

• low 3.8 MasterStudy LMS WordPress Plugin

  Missing authorization check

  CVE-2026-81340 · affected older than 3.7.50 · fixed in 3.7.50

• medium 6.5 RestroPress

  Missing authorization check

  CVE-2026-85009 · affected 3.4.6 and older · fixed in 3.4.7 *

• high 8.8 ShortPixel Image Optimizer

  PHP object injection

  CVE-2026-17086 · affected 6.5.5 and older · fixed in 6.5.6 *

• medium 6.4 RT Mega Menu

  Stored cross-site scripting (XSS)

  CVE-2026-15650 · affected 1.5.2 and older · fix not stated

• medium 6.4 RT Mega Menu

  Stored cross-site scripting (XSS)

  CVE-2026-14855 · affected 1.5.1 and older · fix not stated

• medium 6.4 Brizy

  Stored cross-site scripting (XSS)

  CVE-2026-2585 · affected 2.8.14 and older · fixed in 2.8.15 *

• medium 4.3 Appointment Booking Plugin

  Missing authorization check

  CVE-2026-18441 · affected 5.6.9 and older · fixed in 5.6.10 *

Thursday, September 17, 2026 · 53

• medium 5.3 Motors

  Missing authorization check

  CVE-2026-16750 · affected 1.4.120 and older · fixed in 1.4.121 *

• medium 5.3 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2026-16582 · affected 2.4.5 and older · fixed in 2.4.6 *

• medium 5.4 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2026-14311 · affected 2.4.4 and older · fixed in 2.4.5 *

• high 7.1 WP Inventory Manager

  Cross-site scripting (XSS)

  CVE-2026-90887 · affected 2.5.4 and older · fixed in 2.5.5 *

• medium 6.5 Geo Mashup

  Cross-site scripting (XSS)

  CVE-2026-78294 · affected 1.13.21 and older · fixed in 1.13.22

• medium 5.3 BerqWP

  Missing authorization check

  CVE-2026-78528 · affected 4.1.15 and older · fixed in 4.1.16

• high 8.8 Xagio SEO & AEO

  Cross-site request forgery (CSRF)

  CVE-2026-78295 · affected 7.1.0.43 and older · fixed in 7.1.0.44

• medium 5.3 Booking Calendar

  Missing authorization check

  CVE-2026-74002 · affected 11.7 and older · fixed in 11.8

• medium 5.4 Issues and Series for Newspapers, Magazines, P…

  Cross-site request forgery (CSRF)

  CVE-2026-74005 · affected 3.1.3 and older · fixed in 3.1.4

• medium 5.3 User Registration & Membership

  Missing authorization check

  CVE-2026-74017 · affected 5.2.7 and older · fixed in 5.2.8

• medium 5.4 Cooked

  Missing authorization check

  CVE-2026-73999 · affected 1.16.0 and older · fixed in 1.16.1

• medium 5.3 Simple Membership

  Missing authorization check

  CVE-2026-74000 · affected 4.8.2 and older · fixed in 4.8.3

• medium 5.3 Easy Invoice

  Missing authorization check

  CVE-2026-66676 · affected 2.3.8 and older · fixed in 2.4.0

• high 7.6 MoreConvert Wishlist for WooCommerce

  SQL injection

  CVE-2026-66631 · affected 1.9.21 and older · fixed in 2.0.0

• high 7.6 Issues and Series for Newspapers, Magazines, P…

  SQL injection

  CVE-2026-66630 · affected 3.1.3 and older · fixed in 3.1.4

• high 7.6 SKT Addons for Elementor

  SQL injection

  CVE-2026-66626 · affected 4.0 and older · fixed in 4.1

• high 7.6 WC Vendors

  SQL injection

  CVE-2026-66625 · affected 2.7.2.1 and older · fixed in 2.7.2.2

• high 7.6 WP-Lister Lite for eBay

  SQL injection

  CVE-2026-66628 · affected 3.8.11 and older · fixed in 3.8.12

• high 7.6 WPMasterToolKit (WPMTK)

  SQL injection

  CVE-2026-66624 · affected 2.22.0 and older · fixed in 2.23.1

• high 7.6 Newsletters

  SQL injection

  CVE-2026-66619 · affected 4.18 and older · fixed in 4.18.1

• medium 6.5 Issues and Series for Newspapers, Magazines, P…

  Cross-site scripting (XSS)

  CVE-2026-66617 · affected 3.1.3 and older · fixed in 3.1.4

• medium 6.4 Unlimited Elements for Elementor

  Server-side request forgery (SSRF)

  CVE-2026-66608 · affected 2.0.19 and older · fixed in 2.0.20

• high 7.6 WP Maps

  SQL injection

  CVE-2026-66618 · affected 4.9.9 and older · fixed in 5.0.0

• high 8.5 Product Feed Manager for WooCommerce

  SQL injection

  CVE-2026-66580 · affected 7.12.0 and older · fixed in 7.12.1

• medium 5.3 King Addons for Elementor

  Missing authorization check

  CVE-2026-66575 · affected 51.1.81 and older · fixed in 51.1.82

• medium 6.5 Property Hive

  Cross-site scripting (XSS)

  CVE-2026-66578 · affected 2.2.6 and older · fixed in 2.3.0

• medium 6.5 Element Pack Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2026-66574 · affected 8.8.3 and older · fixed in 8.8.4

• critical 9.8 Headless SSO Plugin for WP

  Security issue

  CVE-2026-62108 · affected 1.7.0 and older · fixed in 1.7.1

• critical 10.0 Migratico Lite

  Remote code execution

  CVE-2026-62104 · affected 2.6.8 and older · fixed in 2.7.1

• high 7.1 Asset CleanUp

  Cross-site request forgery (CSRF)

  CVE-2026-66571 · affected 1.4.0.5 and older · fixed in 1.4.0.6

• critical 9.8 EduAdmin Booking

  Authentication bypass

  CVE-2026-62101 · affected 5.4.2 and older · fixed in 6.0.0

• medium 5.3 FluentAuth

  Security issue

  CVE-2026-78296 · affected 2.1.2 and older · fixed in 3.0.0

• medium 4.3 Checkout Field Manager (Checkout Manager) for…

  Missing authorization check

  CVE-2026-87831 · affected 7.4.9 up to (not including) 7.9.7 · fixed in 7.9.7

• medium 4.3 Checkout Field Manager (Checkout Manager) for…

  Missing authorization check

  CVE-2026-87829 · affected 7.8.6 up to (not including) 7.9.7 · fixed in 7.9.7

• low 3.7 Robokassa payment gateway for Woocommerce

  Security issue

  CVE-2026-91017 · affected older than 1.8.9 · fixed in 1.8.9

• medium 4.9 Event Booking Manager for WooCommerce

  Missing authorization check

  CVE-2026-91019 · affected 5.3.6 up to (not including) 5.6.0 · fixed in 5.6.0

• medium 5.3 Master Addons for Elementor

  Missing authorization check

  CVE-2026-91015 · affected 3.0.0 up to (not including) 3.1.9 · fixed in 3.1.9

• medium 6.8 EWWW Image Optimizer

  Cross-site scripting (XSS)

  CVE-2026-91011 · affected older than 8.7.7 · fixed in 8.7.7

• medium 4.3 Invisible Anti-Spam & CAPTCHA

  Missing authorization check

  CVE-2026-91010 · affected 2.0.5 up to (not including) 5.1.1 · fixed in 5.1.1

• low 3.7 Event Booking Manager for WooCommerce

  Missing authorization check

  CVE-2026-91008 · affected 5.3.6 up to (not including) 5.3.8 · fixed in 5.3.8

• medium 5.3 Paid Membership Subscriptions

  Missing authorization check

  CVE-2026-90922 · affected older than 3.0.9 · fixed in 3.0.9

• medium 6.5 Autopay

  Missing authorization check

  CVE-2026-90923 · affected older than 5.0.1 · fixed in 5.0.1

• medium 4.3 Active Woot Products Tables for WooCommerce. 1…

  Cross-site request forgery (CSRF)

  CVE-2026-91009 · affected 2.1.2 up to (not including) 2.1.3 · fixed in 2.1.3

• high 7.1 Realtyna Organic IDX plugin + WPL Real Estate

  Reflected cross-site scripting (XSS)

  CVE-2026-91014 · affected older than 5.4.2 · fixed in 5.4.2

• low 2.7 Comments Import & Export

  Information disclosure

  CVE-2026-87836 · affected 2.1.11 up to (not including) 2.5.4 · fixed in 2.5.4

• medium 6.8 HT Mega Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2026-86788 · affected 3.2.0 up to (not including) 3.2.6 · fixed in 3.2.6

• low 3.7 LearnPress

  Information disclosure

  CVE-2026-86446 · affected 4.4.3 up to (not including) 4.4.7 · fixed in 4.4.7

• medium 4.8 Newsletter

  Security issue

  CVE-2026-86824 · affected older than 9.3.8 · fixed in 9.3.8

• high 8.8 WPLP Cookie Consent

  Cross-site scripting (XSS)

  CVE-2026-85130 · affected older than 4.4.4 · fixed in 4.4.4

• critical 9.8 Multi Uploader for Gravity Forms

  Arbitrary file upload

  CVE-2026-87796 · affected 1.1.9 and older · fixed in 1.1.10 *

• high 8.1 Paid Downloads

  Arbitrary file upload

  CVE-2026-87935 · affected 3.15 and older · fix not stated

• medium 6.4 Photo Gallery by 10Web

  Stored cross-site scripting (XSS)

  CVE-2026-86311 · affected 1.8.44 and older · fixed in 1.8.45 *

• medium 5.3 All-in-One WP Migration and Backup

  Security issue

  CVE-2026-89064 · affected 7.110 and older · fixed in 7.111 *

Wednesday, September 16, 2026 · 40

• high 7.6 affects latest 1.4.2 WP Mega Menu

  SQL injection

  CVE-2026-92465 · affected 1.4.2 and older · no fix listed yet

• medium 5.3 Appointment Hour Booking

  Security issue

  CVE-2026-86475 · affected older than 1.5.95 · fixed in 1.5.95

• medium 4.8 Formidable Forms

  Content injection

  CVE-2026-19857 · affected 6.34 up to (not including) 6.35 · fixed in 6.35

• medium 5.4 Royal Addons for Elementor

  Security issue

  CVE-2026-13407 · affected older than 1.7.1067 · fixed in 1.7.1067

• medium 5.3 Newsletter

  Open redirect

  CVE-2026-86823 · affected older than 9.3.7 · fixed in 9.3.7

• medium 5.3 Rox Appointment Booking

  Information disclosure

  CVE-2026-87907 · affected older than 1.2.8 · fixed in 1.2.8

• medium 5.3 Rox Appointment Booking

  Information disclosure

  CVE-2026-87896 · affected older than 1.2.8 · fixed in 1.2.8

• medium 5.7 Seraphinite Accelerator

  Denial of service

  CVE-2026-87828 · affected older than 2.29.24 · fixed in 2.29.24

• medium 4.3 Subscriptions for WooCommerce

  Missing authorization check

  CVE-2026-87860 · affected older than 2.0.3 · fixed in 2.0.3

• medium 5.3 Subscriptions for WooCommerce

  Information disclosure

  CVE-2026-87854 · affected older than 2.0.3 · fixed in 2.0.3

• medium 4.3 Formidable Forms

  Security issue

  CVE-2026-85641 · affected 6.34 up to (not including) 6.35 · fixed in 6.35

• medium 5.3 LearnPress

  Missing authorization check

  CVE-2026-86449 · affected 4.2.7.1 up to (not including) 4.4.7 · fixed in 4.4.7

• low 3.7 LearnPress

  Information disclosure

  CVE-2026-86448 · affected 4.3.2.8 up to (not including) 4.4.7 · fixed in 4.4.7

• medium 5.3 LearnPress

  Missing authorization check

  CVE-2026-86447 · affected 4.4.6 up to (not including) 4.4.7 · fixed in 4.4.7

• medium 5.3 LearnPress

  Missing authorization check

  CVE-2026-86445 · affected 4.2.9 up to (not including) 4.4.7 · fixed in 4.4.7

• high 7.1 LearnPress

  Cross-site scripting (XSS)

  CVE-2026-86444 · affected 4.2.6.4 up to (not including) 4.4.7 · fixed in 4.4.7

• medium 6.8 Visualizer

  Cross-site scripting (XSS)

  CVE-2026-86784 · affected older than 4.0.8 · fixed in 4.0.8

• medium 6.5 WPLP Cookie Consent

  Cross-site request forgery (CSRF)

  CVE-2026-85131 · affected older than 4.4.4 · fixed in 4.4.4

• low 2.7 Schema & Structured Data for WP & AMP

  Missing authorization check

  CVE-2026-82126 · affected 1.63 up to (not including) 1.66 · fixed in 1.66

• medium 5.3 Schema & Structured Data for WP & AMP

  Missing authorization check

  CVE-2026-82125 · affected 1.46 up to (not including) 1.66 · fixed in 1.66

• medium 5.3 Schema & Structured Data for WP & AMP

  Information disclosure

  CVE-2026-82124 · affected older than 1.66 · fixed in 1.66

• medium 4.1 WP Import Export Lite

  Server-side request forgery (SSRF)

  CVE-2026-76559 · affected older than 3.9.33 · fixed in 3.9.33

• medium 6.8 WP Import Export Lite

  Stored cross-site scripting (XSS)

  CVE-2026-76558 · affected older than 3.9.33 · fixed in 3.9.33

• medium 6.8 WP Import Export Lite

  SQL injection

  CVE-2026-76557 · affected older than 3.9.33 · fixed in 3.9.33

• medium 6.8 WP Import Export Lite

  SQL injection

  CVE-2026-76556 · affected older than 3.9.33 · fixed in 3.9.33

• medium 6.8 WP Import Export Lite

  Path traversal / file read

  CVE-2026-76555 · affected older than 3.9.33 · fixed in 3.9.33

• medium 6.5 WP Import Export Lite

  Security issue

  CVE-2026-76553 · affected older than 3.9.33 · fixed in 3.9.33

• high 8.8 WP Import Export Lite

  Remote code execution

  CVE-2026-76552 · affected older than 3.9.33 · fixed in 3.9.33

• high 7.2 WP Import Export Lite

  Remote code execution

  CVE-2026-76551 · affected older than 3.9.33 · fixed in 3.9.33

• high 7.2 WP Import Export Lite

  Remote code execution

  CVE-2026-76550 · affected older than 3.9.34 · fixed in 3.9.34

• high 7.5 Online Scheduling and Appointment Booking System

  Missing authorization check

  CVE-2026-89063 · affected 28.1 and older · fixed in 28.2 *

• medium 6.4 Bold Page Builder

  Stored cross-site scripting (XSS)

  CVE-2026-5920 · affected 5.9.6 and older · fixed in 5.9.7 *

• medium 6.1 Better Messages

  Reflected cross-site scripting (XSS)

  CVE-2026-18555 · affected 2.15.22 and older · fixed in 2.15.33 *

• high 8.8 Contest Gallery

  Remote code execution

  CVE-2026-78088 · affected 32.0.1 and older · fixed in 33.0.2 *

• high 7.2 WP-Lister Lite for eBay

  Stored cross-site scripting (XSS)

  CVE-2026-18595 · affected 3.8.9 and older · fix not stated

• medium 6.5 WP Directory Kit

  SQL injection

  CVE-2026-16588 · affected 1.5.4 and older · fixed in 1.5.5 *

• critical 9.8 TrueBooker

  Missing authorization check

  CVE-2026-14349 · affected 1.2.3 and older · fixed in 1.2.4 *

• critical 9.8 JetFormBuilder

  Privilege escalation

  CVE-2026-12793 · affected 3.6.2 and older · fixed in 3.6.2.1 *

• medium 6.4 Advanced Popups

  Stored cross-site scripting (XSS)

  CVE-2026-11996 · affected 1.2.3 and older · fixed in 1.2.4 *

• medium 5.3 Ad Inserter

  Missing authorization check

  CVE-2026-11984 · affected 2.8.16 and older · fixed in 2.8.17 *

Tuesday, September 15, 2026 · 10

• high 7.2 MotoPress Hotel Booking

  Stored cross-site scripting (XSS)

  CVE-2026-90650 · affected 6.2.4 and older · fixed in 6.3.0 *

• medium 6.5 AI Engine

  Missing authorization check

  CVE-2026-89141 · affected 3.7.7 and older · fixed in 3.7.8 *

• high 7.5 Eventin

  Remote code execution

  CVE-2026-75983 · affected 4.1.23 and older · fixed in 4.1.24 *

• medium 6.4 Job Postings

  Stored cross-site scripting (XSS)

  CVE-2026-18063 · affected 2.8.1 and older · fixed in 2.8.2 *

• medium 6.4 Eventin

  Stored cross-site scripting (XSS)

  CVE-2026-15402 · affected 4.1.23 and older · fixed in 4.1.24 *

• medium 5.3 WP Directory Kit

  Information disclosure

  CVE-2026-18232 · affected 1.5.7 and older · fixed in 1.5.9 *

• medium 6.8 WP Directory Kit

  SQL injection

  CVE-2026-16593 · affected 1.5.7 and older · fixed in 1.5.9 *

• low 2.7 WP Directory Kit

  Missing authorization check

  CVE-2026-16592 · affected 1.5.7 and older · fixed in 1.5.9 *

• medium 5.3 3D FlipBook

  Information disclosure

  CVE-2026-15758 · affected 1.16.20 and older · fix not stated

• medium 5.4 Co-Authors, Multiple Authors and Guest Authors…

  Stored cross-site scripting (XSS)

  CVE-2026-85657 · affected 4.15.0 and older · fixed in 4.16.0 *

Monday, September 14, 2026 · 1

• medium 4.3 Really Simple Security

  Missing authorization check

  CVE-2026-82519 · affected older than 9.8.2 · fixed in 9.8.2

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan