WordPress plugin vulnerabilities: week 40, 2026
387 vulnerabilities published Sep 28 – Oct 4, 2026 in 285 plugins we track, by day.
17 critical 171 high 190 medium 9 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, October 4, 2026 · 11
-
medium 4.3 Mindio Magic MCP
-
high 7.5 Cost Calculator Builder
-
high 7.1 WP Statistics
-
high 7.1 Kadence Blocks
-
critical 9.3 Unlimited Elements for Elementor
-
high 7.1 Unlimited Elements for Elementor
-
high 7.1 TranslatePress
-
medium 4.9 Five Star Business Profile and Schema
-
medium 5.3 User Private Files
-
low 3.5 Simple Shopping Cart
-
medium 5.3 Razorpay for WooCommerce
Saturday, October 3, 2026 · 73
-
high 8.8 Ultimate Member
-
high 7.1 Unlimited Elements for Elementor
-
high 8.2 Kirki
Security issue
-
medium 6.4 Twenty20 Image Before-After
-
critical 9.1 Beaver Builder Page Builder
-
medium 4.3 Burst Statistics
-
high 8.1 Nelio Content
-
high 7.2 WPC Product Options for WooCommerce
-
medium 6.1 Photo Gallery by 10Web
-
critical 9.1 VikAppointments Services Booking Calendar
-
high 7.5 WPCafe
-
high 7.2 Mail logging & Catcher
-
medium 6.1 WPFront Notification Bar
-
medium 6.4 Responsive Starter Templates
-
high 8.8 Smart Manager
-
medium 5.3 WPCafe
-
medium 5.4 WP Ultimate Review
-
medium 6.1 WPC Estimated Delivery Date for WooCommerce
-
medium 6.5 WP Ultimate Review
-
medium 5.4 WPMobile.App
-
high 7.2 Visitor Traffic Real Time Statistics
-
medium 6.4 Wp Social Login and Register Social Counter
-
low 3.7 Pie Register
-
high 7.5 Simple Membership
-
high 7.2 Strong Testimonials
-
medium 6.8 Loco Translate
-
medium 6.8 Loco Translate
-
high 7.2 Transliterator
-
high 7.2 SEOPress
-
high 7.2 GD Rating System
-
medium 5.3 Mailchimp for WooCommerce
-
medium 6.3 Unlimited Elements for Elementor
-
medium 4.3 Alt Text AI
-
high 8.8 Kubio AI Page Builder
-
medium 6.8 Kubio AI Page Builder
-
low 3.7 MetForm
-
high 7.2 Welcart e-Commerce
-
medium 5.3 MetForm
-
medium 6.8 Unlimited Elements for Elementor
-
medium 6.6 Unlimited Elements for Elementor
-
low 3.7 WP Ultimate CSV Importer
-
low 3.5 WP Ultimate CSV Importer
-
medium 6.1 Calculated Fields Form
-
high 7.5 GeoDirectory
-
medium 6.1 WPC Smart Quick View for WooCommerce
-
high 7.2 Magic Tooltips For Contact Form 7
-
high 7.5 WP 2FA
-
high 8.1 Revopic
-
medium 4.9 SEOPress
-
medium 6.4 WP Ultimate Review
-
high 7.5 WP Ultimate Review
-
high 7.5 WP Ultimate Review
-
high 7.5 WP Ultimate Review
-
medium 6.5 All in One SEO
-
medium 5.3 WPZOOM Connect
-
medium 6.4 Rich Showcase for Google Reviews
-
medium 6.4 Ultra Addons Lite for Elementor
-
medium 6.1 EWWW Image Optimizer
-
high 8.8 Groundhogg
-
high 7.2 Real Cookie Banner
-
medium 6.4 EmbedPress
-
medium 6.1 LearnPress
-
medium 6.1 ProfilePress
-
high 8.8 ProfilePress
-
medium 6.5 Beaver Builder Page Builder
-
medium 6.5 SupportCandy
-
medium 6.4 SupportCandy
-
high 7.2 Ultimate Member
-
high 7.5 Ultimate Member
-
medium 6.1 Ivory Search
-
medium 5.4 Jeg Kit for Elementor
Friday, October 2, 2026 · 52
-
medium 6.5 All in One SEO
-
medium 4.3 LearnPress
-
medium 4.7 Aculect AI Companion
-
medium 6.5 affects latest 2.11.0 Airano MCP Bridge
-
low 3.7 Booking Calendar
Security issue
-
medium 5.3 affects latest 1.4.3 Smart One Click Setup
-
medium 6.5 affects latest 1.0.7 WebSamurai
-
medium 6.1 WP Statistics
-
medium 4.3 Advanced Ads
-
medium 5.3 Download Manager
-
critical 9.8 WPMobile.App
-
medium 6.1 All in One SEO
-
high 7.2 W3 Total Cache
-
medium 5.3 LearnPress
-
high 7.2 Customer Reviews for WooCommerce
-
medium 6.4 Download Manager
-
medium 6.5 Event Tickets and Registration
-
high 7.2 JetFormBuilder
-
critical 9.8 JSON API Auth
-
high 7.2 Relevanssi
-
high 7.2 CMB2
-
high 7.2 GSpeech TTS
-
medium 6.4 Listdom
-
high 7.2 Mang Board
-
high 7.2 MW WP Form
-
high 7.2 Newsletter
-
high 7.2 Smash Balloon Social Post Feed
-
high 7.2 DoFollow Case by Case
-
medium 6.1 Greenshift
-
medium 5.3 Appointment Booking Plugin
-
high 7.2 No External Links
-
medium 6.5 MultiVendorX
-
high 7.2 CMB2
-
high 7.2 Download Monitor
-
low 3.1 Otter Blocks
-
high 7.2 Kubio AI Page Builder
-
medium 4.3 MStore API
-
medium 6.5 The Events Calendar
-
medium 5.4 Unlimited Elements for Elementor
-
medium 5.3 Easy PayPal & Stripe Buy Now Button
Security issue
-
medium 4.3 WP Mail Logging
-
high 7.2 BA Book Everything
-
medium 6.1 Giveaways and Contests by RafflePress
-
medium 5.3 Giveaways and Contests by RafflePress
-
high 7.5 SiteOrigin Widgets Bundle
-
high 7.5 OMGF
-
high 7.2 Ninja Forms
-
medium 5.3 Request a Quote
-
medium 5.4 Autoptimize
-
medium 6.8 Unlimited Elements for Elementor
-
medium 6.8 Tabs Responsive
Thursday, October 1, 2026 · 77
-
high 8.8 Icegram Engage
-
high 7.1 Premmerce Wishlist for WooCommerce
-
medium 6.5 SchemaEngine AI
-
high 7.6 Social Boost
-
medium 6.3 Project Manager
-
medium 6.5 WPFunnels
-
medium 6.5 Aruba Migration Tool
-
medium 6.5 Bus Ticket Booking with Seat Reservation
-
high 7.1 MaxGalleria
-
high 7.1 Premmerce Wishlist for WooCommerce
-
high 8.6 AcyMailing
-
high 7.2 Hide Shipping Method For WooCommerce
-
critical 9.3 Iptanus File Upload
-
high 7.5 Stripe Payment Forms by WP Full Pay
-
critical 9.8 Authorizer
-
medium 5.3 hCaptcha for WP
Security issue
-
high 8.8 ByteCoreStack
-
high 7.1 Parallax Section Block
-
high 7.5 Revopic
-
high 7.5 REST API Log
-
high 7.6 Captivate Sync
-
medium 5.3 ProfileGrid
-
medium 5.4 Travelly
-
high 7.6 Ultimate Member
-
medium 5.3 CF7 Apps
-
medium 5.3 Pie Register
-
medium 6.5 ElementsKit Elementor Addons
-
medium 6.5 Fluent Forms
-
high 8.0 Memberful
-
medium 6.5 MetForm
-
medium 5.3 Site Reviews
-
medium 5.3 Unlimited Elements for Elementor
-
high 8.5 Unlimited Elements for Elementor
-
medium 5.3 AFFI
-
medium 6.5 ElementsKit Elementor Addons
-
medium 6.5 Essential Addons for Elementor
-
medium 4.3 Majestic Support
-
medium 5.3 Majestic Support
-
high 8.5 BuildKit
-
medium 5.3 WP Ultimate CSV Importer
-
medium 5.3 Fluent Forms
Security issue
-
high 7.2 LA-Studio Element Kit for Elementor
-
medium 6.4 Gutenberg Essential Blocks
-
high 7.2 Forminator Forms
-
high 7.2 Appointment Hour Booking
-
medium 6.4 Awesome Support
-
high 7.2 Form Maker by 10Web
-
medium 6.1 Ad Inserter
-
medium 6.4 Duplicate Post
-
high 7.2 Forminator Forms
-
medium 6.4 Redux Framework
-
high 7.2 Autoptimize
-
medium 6.4 bbp style pack
-
medium 4.7 Calculated Fields Form
-
medium 6.1 Calculated Fields Form
-
high 7.5 LearnPress
-
critical 9.8 Ultimate Multisite
-
medium 6.1 Ad Inserter
-
high 8.8 ByteCoreStack
-
low 3.1 If-So Dynamic Content
-
medium 4.3 Redux Framework
-
medium 6.4 Download Manager
-
medium 4.7 If-So Dynamic Content
-
high 7.2 Extendify
-
high 8.8 Featured Image from URL (FIFU)
-
critical 9.1 Appointment Booking Plugin
-
medium 5.3 WP Popular Posts
-
medium 5.4 Advanced Woo Labels
-
high 7.2 AI Engine
-
high 7.5 Simply Schedule Appointments
-
medium 6.5 Simply Schedule Appointments
-
medium 5.3 Newsletter
Security issue
Wednesday, September 30, 2026 · 172
-
high 7.2 Page Builder by SiteOrigin
-
high 7.1 CURCY
-
high 7.1 Branda
-
high 7.1 JetFormBuilder
-
medium 6.5 Optimole
-
high 8.8 Photo Gallery by 10Web
-
medium 6.5 Ultimate Maps by Supsystic
-
high 7.1 Post and Page Builder by BoldGrid
-
critical 9.8 Nested Pages
-
medium 5.3 Pay with Vipps and MobilePay for WooCommerce
-
high 7.6 Business Directory Plugin
-
medium 6.5 User Submitted Posts
-
medium 5.3 MPG
-
medium 6.5 Cool FormKit Lite
-
medium 6.5 King Addons for Elementor
-
high 8.5 Media Library Assistant
-
medium 6.5 WP OAuth Server (OAuth Authentication)
-
high 7.1 Quiz and Survey Master (QSM)
-
medium 5.4 Razorpay Payment Links for WooCommerce
-
medium 6.5 YITH WooCommerce Tab Manager
-
high 8.5 Event Tickets and Registration
-
critical 9.8 OAuth Single Sign On
Security issue
-
medium 6.5 Polylang
-
medium 5.3 SchemaEngine AI
-
medium 6.5 Strong Testimonials
-
medium 5.4 The Events Calendar
-
high 7.1 WPFunnels
-
medium 6.5 CMB2
-
high 7.1 Geo Mashup
-
medium 4.3 Prevent Files / Folders Access
-
medium 6.5 Virtue/Ascend/Pinnacle Toolkit
-
medium 6.5 Visual Composer Website Builder
-
medium 5.3 Notivo Notification for WooCommerce
-
medium 5.4 AllAble Connector
-
medium 6.5 Blocksy Companion
-
critical 9.8 Booking Activities
-
high 7.5 Creator LMS
-
medium 5.3 Paid Membership Subscriptions
Security issue
-
medium 4.9 ShortPixel Image Optimizer
-
high 7.2 SureCart
-
medium 6.8 WEBO MCP
-
high 7.5 BackupEase
-
medium 6.5 MCP Content Manager Lite
-
high 7.5 StifLi Backup Tools
-
high 7.1 Ad Inserter
-
medium 6.5 EWWW Image Optimizer
-
medium 5.3 GiveWP
-
medium 5.3 Sprout Invoices
-
medium 4.3 Easy Appointment Booking & Scheduling Plugin
-
high 7.5 WebToffee WP Backup and Migration
-
high 8.8 CartFlows
-
high 7.2 Content Egg
-
medium 6.5 GiveWP
-
high 7.1 Happyforms
-
medium 6.5 King Addons for Elementor
-
high 7.2 Ultra Addons for Contact Form 7
-
high 8.8 Blacklist Manager
-
high 7.1 Parsi Date
-
high 7.6 Admin Notices Manager
-
medium 4.2 All-In-One Security (AIOS)
Security issue
-
high 7.1 GiveWP
-
medium 6.8 Template Kit
-
medium 6.5 The Plus Addons for Elementor
-
high 8.8 Themify Builder
-
high 7.1 Awesome Support
-
high 7.5 Customer Reviews for WooCommerce
-
medium 6.3 FluentBoards
-
high 8.2 MakeCommerce for WooCommerce
-
high 7.1 oik
-
critical 9.3 Books Gallery
-
high 7.1 Classified Listing
-
critical 9.8 Estatik Real Estate Plugin
-
high 7.2 Vitepos
-
high 7.1 YITH WooCommerce Ajax Search
-
high 7.2 eCommerce Product Catalog
-
high 7.6 ERP
-
high 7.2 ERP
-
high 7.6 Estatik Real Estate Plugin
-
medium 6.5 User Profile Builder
-
critical 10.0 SiteSkite
-
high 8.8 WPBot
-
high 8.8 DesignSetGo
-
high 7.1 FormGent
-
high 8.8 Go Live Update Urls
-
high 7.2 Kadence WooCommerce Email Designer
-
medium 4.3 Safe SVG
-
medium 5.3 Simply Schedule Appointments
-
medium 6.5 Pixel Manager for WooCommerce
-
medium 5.9 WP Store Locator
-
critical 9.0 AcyMailing
-
medium 5.4 Business Directory Plugin
-
high 8.5 GamiPress
-
high 8.5 Pricing Table WordPress Plugin
-
high 7.5 GravityExport Lite for Gravity Forms
-
high 7.6 Quiz Cat
-
high 7.2 Responsive Slider Gallery
-
high 8.8 10Web Booster
-
medium 6.5 Safe SVG
-
high 7.1 Site Reviews
-
high 8.8 GEO Plugin by Squirrly SEO
-
high 7.1 Persistent Login
-
high 7.2 Cost of Goods
-
high 7.2 Music Player for WooCommerce
-
high 7.1 Notification for Telegram
-
medium 6.5 Simply Schedule Appointments
-
high 8.2 WP Data Access
-
high 7.1 WP Statistics
-
high 7.1 JW Player for WordPress
-
medium 5.4 Creator LMS
Security issue
-
medium 5.4 Flexible PDF Coupons
-
medium 6.5 HappyAddons for Elementor
-
medium 6.5 Premium Addons for Elementor
-
medium 6.5 Qi Addons For Elementor
-
high 7.6 WP Activity Log
-
high 7.1 WPFunnels
-
medium 5.4 Photo Gallery by Supsystic
-
high 7.1 Easy Google Maps by Supsystic
-
high 7.1 Ninja Forms
-
high 7.1 Customer Engagement System
-
high 7.1 Ultimate Maps by Supsystic
-
medium 6.5 WP Photo Album Plus
-
medium 5.9 Supreme Modules Lite
-
medium 6.5 CF7 Views
-
medium 5.3 Two Factor
-
high 7.1 If-So Dynamic Content
-
medium 6.9 WPMobile.App
-
high 7.2 Post Views Stats Counter
-
high 7.5 Product Designer App
-
medium 6.4 ReactPress
-
medium 6.4 Real Estate Manager
-
medium 6.4 Viable URL Media Uploader
-
medium 6.4 Bold Page Builder
-
high 7.5 Motors
-
medium 6.4 Bold Page Builder
-
medium 6.4 Bold Page Builder
-
medium 6.4 Bold Page Builder
-
medium 6.4 Bold Page Builder
-
medium 6.4 HT Mega Addons for Elementor
-
medium 6.4 Smart Slider 3
-
medium 6.5 WP Directory Kit
-
critical 9.1 GiveWP
-
high 7.5 Simply Schedule Appointments
-
medium 5.8 Broken Link Notifier
-
medium 5.3 Course Booking System
-
medium 6.8 Content Egg
-
medium 4.4 EWWW Image Optimizer
Security issue
-
medium 6.6 EWWW Image Optimizer
-
medium 4.3 Image Optimizer
-
high 7.5 Robin Image Optimizer
-
medium 4.3 Robin Image Optimizer
-
medium 6.8 Hostinger Reach
-
medium 6.8 EmbedPress
-
medium 5.3 New User Approve
-
medium 5.3 Solace Extra
-
medium 5.3 User Frontend
-
high 7.4 User Frontend
Tuesday, September 29, 2026 · 1
Monday, September 28, 2026 · 1
-
medium 5.4 Blacklist Manager
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.