WordPress plugin vulnerabilities: week 39, 2026
201 vulnerabilities published Sep 21 – Sep 27, 2026 in 143 plugins we track, by day.
9 critical 60 high 122 medium 10 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, September 27, 2026 · 15
-
medium 6.8 Optima Express IDX
-
medium 6.8 PowerPress Podcasting plugin by Blubrry
-
medium 5.9 NextScripts
-
medium 5.3 Mailchimp for WooCommerce
-
medium 5.3 Optima Express IDX
-
medium 6.8 WP YouTube Lyte
-
medium 6.8 WPeMatico RSS Feed Fetcher
-
medium 4.1 WPeMatico RSS Feed Fetcher
-
medium 4.9 WPeMatico RSS Feed Fetcher
-
medium 4.1 WPeMatico RSS Feed Fetcher
-
medium 6.8 EmbedPress
-
medium 5.3 UpdraftPlus
-
high 7.5 Ad Inserter
Saturday, September 26, 2026 · 5
-
critical 9.8 Ultra Addons for Contact Form 7
-
critical 9.8 miniOrange OTP Login, Verification and SMS Not…
-
high 8.8 Groups
-
medium 6.8 WP Delicious
-
high 7.2 WP Directory Kit
Friday, September 25, 2026 · 40
-
medium 5.3 wpForo Forum
Security issue
-
high 7.2 Restaurant Menu and Food Ordering
-
high 7.2 User Profile Builder
-
high 7.2 Repeater Fields for Elementor Forms
-
high 7.2 Themify Builder
-
high 7.2 Zero Spam for WordPress
-
high 8.1 Modula Image Gallery
-
high 7.3 Optima Express IDX
-
medium 6.4 User Profile Builder
-
high 7.2 Premium Packages
-
medium 6.4 wpForo Forum
-
high 8.8 Knit Pay
-
high 7.5 Modula Image Gallery
-
high 8.8 s2Member
-
medium 4.9 SSL Zen
-
medium 6.1 SSL Zen
-
medium 6.1 WPForms
-
high 7.5 WP Maps
-
medium 6.4 WP Maps
-
medium 5.5 Asset CleanUp
-
medium 6.4 GeoDirectory
-
high 7.2 BA Book Everything
-
critical 9.1 Online Scheduling and Appointment Booking System
-
medium 6.4 Better Messages
-
medium 6.5 Better Messages
-
medium 6.4 GeoDirectory
-
medium 4.3 Blog2Social
-
critical 9.1 Customer Reviews for WooCommerce
-
medium 6.4 Gutenverse
-
high 7.2 HT Contact Form
-
medium 6.1 JetFormBuilder
-
high 7.2 AMP for WP
-
high 8.8 Elementor Website Builder
-
medium 4.0 Link Library
-
medium 4.1 Link Library
-
medium 6.1 Link Library
-
critical 9.8 Wawp Country Code & Chat Widget for WooCommerce
-
medium 4.3 OpenStation
-
medium 6.4 CSS & JavaScript Toolbox
Thursday, September 24, 2026 · 21
-
medium 4.3 MailerLite
-
medium 4.3 Spectra Legacy
-
medium 5.4 Kirki
-
medium 6.4 WP Multilang
-
critical 9.8 Visual Composer Website Builder
-
high 8.8 YOP Poll
Security issue
-
medium 4.3 Events Manager
-
low 2.7 Events Manager
-
medium 4.3 MasterStudy LMS WordPress Plugin
-
medium 5.3 MasterStudy LMS WordPress Plugin
-
medium 4.3 MasterStudy LMS WordPress Plugin
-
high 7.2 MasterStudy LMS WordPress Plugin
-
medium 6.8 WPeMatico RSS Feed Fetcher
-
low 2.7 WPeMatico RSS Feed Fetcher
-
medium 6.8 WPeMatico RSS Feed Fetcher
-
medium 6.8 CMB2
-
medium 4.3 Masteriyo LMS
-
medium 4.3 Masteriyo LMS
-
medium 6.5 10Web Booster
-
high 7.5 wpForo Forum
-
critical 9.8 Paytium
Wednesday, September 23, 2026 · 93
-
high 8.1 EthPress
-
high 7.6 W4 Post List
-
high 7.2 Reycob Product Import Export
-
high 7.5 Tangible
-
medium 5.3 TrustedLogin Connector
-
critical 9.3 Product Filter for WooCommerce by WBW
-
medium 6.5 YITH Request a Quote for WooCommerce
-
high 7.1 Calculated Fields Form
-
high 7.1 Core Web Vitals & PageSpeed Booster
-
medium 6.5 PixelYourSite
-
high 7.1 Tainacan
-
medium 5.3 Team
-
medium 6.5 Ultra Addons for Contact Form 7
-
high 7.6 Ultimeter
-
medium 6.5 Conekta Payment Gateway
-
high 7.6 Easy Digital Downloads
-
medium 5.3 Netgsm
Security issue
-
high 7.1 Ninja Forms
-
medium 6.5 User Frontend
-
medium 5.3 User Frontend
Security issue
-
medium 6.5 User Frontend
Security issue
-
medium 5.4 Fluent Support
-
medium 6.5 Podcast Importer SecondLine
-
medium 6.5 The Post Grid
-
medium 6.5 The Post Grid
-
medium 6.5 AppMySite
-
high 8.1 PublishPress Capabilities
-
medium 4.8 Captcha Code
Security issue
-
medium 6.5 Ditty
-
medium 6.5 ElementsKit Elementor Addons
-
medium 6.5 Ultimate FAQ Accordion Plugin
-
high 7.6 Email Log
-
high 7.1 Mang Board
-
medium 6.5 Premium Addons for Elementor
-
high 7.1 Razorpay Payment Button Plugin
-
medium 5.3 MarketKing
-
medium 6.5 Premium Blocks
-
high 8.5 WP EasyCart
-
medium 5.3 WP User Manager
-
medium 5.3 AI Engine
-
high 8.5 Mollie Forms
-
medium 6.5 PayPlus Payment Gateway
-
high 7.1 WP Photo Album Plus
-
medium 6.5 wpForo Forum
-
high 7.1 WPS Limit Login
-
high 7.1 Event Tickets and Registration
-
high 8.5 Live Copy Paste for Elementor
-
medium 4.3 SiteSkite
-
medium 6.5 WSP MCP
-
medium 5.3 Paid Membership Subscriptions
Security issue
-
medium 5.3 Forminator Forms
Security issue
-
medium 5.3 Forminator Forms
Security issue
-
medium 5.3 Paymob for WooCommerce
Security issue
-
medium 5.6 Ninja Tables
-
medium 6.5 WP Recipe Maker
-
medium 6.5 Vsourz Form Entries for Contact Form 7
-
medium 6.4 Getwid
-
medium 4.3 Points and Rewards for WooCommerce
-
medium 5.3 Premium Packages
Security issue
-
medium 4.3 Booking Manager
-
medium 6.8 Booking Manager
-
low 3.7 Paid Membership Subscriptions
-
high 8.1 WC Fields Factory
-
low 3.3 WC Fields Factory
-
low 3.7 Forminator Forms
-
low 3.1 Forminator Forms
-
medium 4.7 Paymob for WooCommerce
-
medium 5.3 Paymob for WooCommerce
-
medium 6.8 Real3D Flipbook
-
high 8.2 WP Recipe Maker
-
medium 5.4 Directorist
-
medium 6.5 Directorist
-
medium 6.8 HappyAddons for Elementor
-
low 3.8 The Events Calendar
-
low 2.7 The Events Calendar
-
medium 5.3 The Events Calendar
-
medium 4.3 WP Recipe Maker
-
medium 4.3 WP Recipe Maker
-
medium 5.0 Directorist
-
medium 4.3 Directorist
-
medium 5.3 Directorist
-
medium 4.3 MasterStudy LMS WordPress Plugin
-
medium 4.6 MasterStudy LMS WordPress Plugin
-
critical 9.0 WP OAuth Server ( Login with WordPress )
-
medium 6.5 Payment Plugins for PayPal WooCommerce
-
medium 5.3 Better Payment
-
medium 4.3 Directorist
-
medium 6.5 Newsletters
-
medium 6.8 Real3D Flipbook
Tuesday, September 22, 2026 · 25
-
high 7.6 HashBar
-
high 7.5 WP Travel Engine
-
medium 4.9 Product Feed Manager for WooCommerce
-
medium 4.3 WP-CRM System
-
high 7.2 WPC Product Bundles for WooCommerce
-
high 7.2 WP Yelp Review Slider
-
high 8.1 HUSKY
-
high 8.1 WP Ultimate Review
-
medium 4.3 wpForo Forum
-
medium 4.3 ThumbPress
-
medium 4.4 affects latest 1.1.8 Hostel
-
medium 4.3 RW Elephant Rental Inventory
-
medium 4.3 Tutor LMS
-
high 7.1 WP Table Builder
-
medium 6.4 Live Composer
-
medium 4.3 WP User Manager
-
medium 4.3 Custom Field Template
-
high 8.8 Ninja Forms
-
high 7.5 Ninja Forms
-
high 7.2 Ninja Forms
-
high 7.2 TranslatePress
-
medium 6.1 Booking Calendar
-
medium 6.4 Contextual Related Posts
-
high 7.2 CMP
Monday, September 21, 2026 · 2
-
medium 5.3 Payment Gateway for PayPal on WooCommerce
Security issue
-
medium 5.3 RestroPress
Security issue
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.