WordPress plugin vulnerabilities: week 41, 2026
490 vulnerabilities published Oct 5 – Oct 11, 2026 in 364 plugins we track, by day.
35 critical 214 high 227 medium 14 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, October 11, 2026 · 14
-
high 7.1 Subscribe to Comments
-
medium 4.7 Simple Membership
-
high 8.6 Social Web Suite
-
medium 6.8 Robo Gallery
-
medium 6.8 Robo Gallery
-
medium 6.8 Robo Gallery
-
medium 6.8 Robo Gallery
-
medium 6.8 Post Snippets
-
low 2.7 Envira Gallery
-
low 2.7 Envira Gallery
-
low 2.7 Envira Gallery
-
high 7.2 Envira Gallery
-
high 8.6 Mobile builder
-
high 8.8 Mobile builder
Saturday, October 10, 2026 · 178
-
high 7.5 Forminator Forms
-
medium 5.3 YITH WooCommerce Product Add-Ons
-
high 7.3 Barcode Scanner (+Mobile App)
-
high 8.5 Barcode Scanner (+Mobile App)
-
critical 9.9 Creator LMS
-
high 7.1 Barcode Scanner (+Mobile App)
-
high 7.5 affects latest 5.0.7 DTX
-
high 7.3 eRoom
-
high 7.1 Before After Image Comparison
-
critical 9.8 affects latest 3.6.27 DirectoryPress
-
high 7.1 Document Embedder
-
high 7.2 StreamCast
-
high 7.6 affects latest 2.2.0 Directory Listings WordPress plugin
-
critical 9.3 affects latest 2.2.0 Directory Listings WordPress plugin
-
medium 6.3 affects latest 3.1.0 Upcasted S3 Offload
-
critical 9.9 affects latest 1.1.2 CodeBard Help Desk
-
critical 9.0 Tailored Tools
-
high 7.1 Team Section Block
-
high 7.6 ACF Frontend Admin by DynamiApps
-
critical 9.8 affects latest 2.4 Dynamic User Directory
-
high 7.6 WP Ultimate CSV Importer
-
high 7.6 Leyka
-
critical 9.8 payever Checkout
-
high 7.1 Photo Gallery by 10Web
-
high 7.1 affects latest 1.2.63 Slider by 10Web
-
high 7.1 Food Menu
-
critical 9.8 Booster for WooCommerce
-
high 8.5 Events Manager
-
high 7.1 FV Player 8
-
critical 10.0 SiteVault
-
high 7.1 Tutor LMS
-
medium 6.5 Jetpack VideoPress
-
high 7.1 Jotform
-
high 7.6 Pubjet
-
medium 5.9 affects latest 1.4.0 Swish Migrate and Backup
-
high 7.5 Web Plura Backup & Restore
-
high 7.1 affects latest 1.24 Additional Order Filters for WooCommerce
-
critical 9.8 AI Copilot
-
high 7.2 Builderius
-
critical 9.3 ELEX WooCommerce Bulk Edit Products, Prices &…
-
high 8.1 Everest Backup
-
high 8.1 Wordable
-
high 8.1 affects latest 1.5.1 wpsection
-
medium 5.3 Pay With MetaMask For WooCommerce
Security issue
-
medium 5.4 MicroPayments
Security issue
-
medium 4.3 ALD
-
high 8.2 Forminator Forms
-
medium 6.5 Sell Downloads
Security issue
-
critical 9.8 miniOrange OTP Login, Verification and SMS Not…
-
critical 9.8 rtMedia for WordPress, BuddyPress and bbPress
-
high 7.5 Bayarcash WooCommerce
-
high 7.2 Super Video player
-
critical 9.3 Tickera
-
high 7.2 WooCommerce
-
critical 9.8 AFFI
-
medium 6.9 GIFT4U
-
high 7.2 Tainacan
-
medium 5.9 WP Rollback
-
high 7.1 WPAdverts
-
high 7.1 WPAdverts
-
high 8.8 Slider by 10Web
-
high 7.1 Forminator Forms
-
medium 6.4 PeproDev Ultimate Profile Solutions
-
high 7.2 HivePress
-
medium 4.9 Listdom
-
high 7.5 Appointment Booking Plugin
-
high 7.2 WPO365
-
medium 6.4 Motors
-
high 7.2 WP Photo Album Plus
-
medium 6.5 WP Directory Kit
-
critical 9.8 WPCOM Member
-
high 8.1 WPO365
-
high 7.2 YITH WooCommerce Affiliates
-
medium 4.3 AutomatorWP
-
medium 5.4 Kirki
-
high 7.2 Molongui Authorship
-
medium 6.4 SureDash
-
high 7.2 WPAdverts
-
medium 6.4 Premium Packages
-
medium 4.7 WPForms
-
high 7.2 FunnelKit
-
high 7.2 Quiz and Survey Master (QSM)
-
medium 6.5 SiteOrigin Widgets Bundle
-
medium 6.4 User Frontend
-
medium 6.4 ACF Frontend Admin by DynamiApps
-
medium 5.3 WP CV Builder
-
medium 6.1 Favicon Rotator
-
medium 5.4 Fluent Forms
-
medium 6.1 Payment Plugins for Stripe WooCommerce
-
medium 4.4 Responsive Lightbox & Gallery
-
medium 6.4 Simple Membership
-
low 3.7 SpeedyCache
-
high 7.2 10Web Booster
-
critical 9.1 PPOM
-
medium 6.5 WP Booking System
-
high 7.2 LazyLoad Plugin
-
medium 6.4 Team
-
high 7.2 Revopic
-
medium 6.4 Church Admin
-
medium 6.4 GiveWP
-
high 7.2 Presto Player
-
high 7.2 Real Estate Manager
-
medium 6.4 Getwid
-
high 8.1 Groundhogg
-
medium 5.3 Order Export & Order Import for WooCommerce
-
high 7.2 Podlove Podcast Publisher
-
high 8.1 SMS Alert
-
high 8.1 SMS Alert
-
medium 6.4 Table Field Add-on for ACF and SCF
-
high 8.8 FooSales
-
high 8.8 FV Player 8
-
medium 4.3 Appointment Booking Plugin
-
medium 6.5 Tutor LMS
-
medium 5.3 Booking Calendar
-
medium 6.4 Embed Any Document
-
medium 6.4 MP3 Audio Player
-
medium 6.4 Brizy
-
medium 6.4 Data Tables Generator by Supsystic
-
medium 6.1 Download Manager
-
high 7.2 Easy Digital Downloads
-
medium 6.4 GamiPress
-
medium 6.8 Gallery PhotoBlocks
-
medium 5.4 W3 Total Cache
-
medium 5.3 Booking Package
-
medium 5.3 Accept PayPal Payments using Contact Form 7
-
medium 5.3 Accept PayPal Payments using Contact Form 7
-
medium 5.3 Contest Gallery
-
high 8.1 GeoDirectory
-
high 8.8 Appointment Booking Plugin
-
low 3.1 AI Puffer
-
low 3.1 AI Puffer
-
medium 6.4 Kadence Blocks
-
medium 4.9 Post Export Import with Media
-
low 3.5 Rank Math SEO
-
medium 4.1 Rank Math SEO
-
high 7.2 Rank Math SEO
-
high 8.8 Groundhogg
-
medium 6.4 HivePress
-
medium 4.7 JetFormBuilder
-
high 8.8 LifterLMS
-
medium 4.9 Customer Engagement System
-
medium 5.4 Noptin
-
medium 6.4 Data Tables Generator by Supsystic
-
medium 6.4 Download Manager
-
medium 6.1 Filter Everything
-
medium 6.4 FV Flowplayer Video Player
-
medium 5.4 Hello Plus
-
medium 5.3 Simply Schedule Appointments
-
medium 5.4 Anti-Spam, Spam FireWall by CleanTalk
-
medium 4.3 Download Manager
-
critical 9.8 3D Product configurator for WooCommerce
-
high 7.2 Fastcache by Host.it
-
medium 6.4 RSS Aggregator by Feedzy
-
medium 5.3 FireBox
-
medium 6.1 Form Maker by 10Web
-
medium 6.4 GeoDirectory
-
medium 6.4 Download Manager
-
medium 4.7 Fluent Forms
-
medium 6.4 Table Field Add-on for ACF and SCF
-
critical 9.8 Extensions For CF7 (Contact form 7 Database, C…
-
critical 9.1 Blocksy Companion
-
high 8.1 Advanced Form Integration
-
critical 9.8 Advanced IP Blocker
-
medium 6.4 Advanced Classifieds & Directory Pro
-
medium 6.5 Academy LMS
-
medium 5.4 Academy LMS
Friday, October 9, 2026 · 59
-
medium 6.5 FV Flowplayer Video Player
-
high 7.1 affects latest 1.0.3 Dashboard Notes
-
medium 5.4 Before After Image Comparison
-
medium 6.5 WPFunnels
-
medium 4.8 Jetpack
-
medium 5.4 Jetpack
-
medium 6.9 QA Assistants
-
high 7.1 AcyMailing
-
high 8.8 Quiz and Survey Master (QSM)
-
high 7.1 WP Associate Post R2
-
medium 5.3 affects latest 3.5.8 Scripts n Styles
-
medium 5.4 WP Event Manager
-
medium 4.3 All Bootstrap Blocks
-
medium 4.3 Asgaros Forum
-
medium 6.5 HTML5 Audio Player
-
medium 5.3 Restrict User Access
-
medium 5.4 AutoPoly
-
high 7.1 FiboSearch
-
critical 9.3 EduAdmin Booking
-
high 8.8 Featured Image from URL (FIFU)
-
high 7.1 NEX-Forms
-
medium 5.6 Ultimate Member
-
high 7.1 Welcart e-Commerce
-
medium 5.9 ProfilePress
-
high 7.5 Forminator Forms
-
high 7.5 GiveWP
-
high 7.1 Simple Payment
-
medium 5.6 User Registration & Membership
-
medium 6.5 ProfilePress
-
high 7.1 Media Library Assistant
-
high 7.1 HUSKY
-
medium 6.5 워드프레스 결제 심플페이
-
high 7.1 Search in Place
-
high 7.1 ShopBuilder
-
high 8.5 Taskbuilder
-
medium 6.5 Classified Listing
-
high 7.5 Generate PDF using Contact Form 7
-
high 8.5 ProfileGrid
-
high 7.1 Salon Booking System
-
high 7.1 UsersWP
-
high 7.1 BlockStrap Page Builder
-
high 7.1 Kubio AI Page Builder
-
high 7.1 Social Sharing Plugin
-
medium 4.1 Kirki
-
medium 4.8 Kirki
-
medium 6.8 Redux Framework
-
high 8.8 FooSales
-
medium 5.3 SendPress Newsletters
-
medium 4.3 SendPress Newsletters
-
medium 5.3 Social Web Suite
-
medium 6.8 Code Snippets
-
low 3.3 Code Snippets
-
high 8.8 AWP Classifieds
Thursday, October 8, 2026 · 45
-
high 7.1 aBlocks
-
high 8.8 MainWP Child
-
medium 5.3 Tutor LMS
Security issue
-
medium 6.5 Zotpress
-
medium 5.3 Creator LMS
-
high 8.8 WP 2FA
-
medium 6.5 WP Plugin Info Card
-
high 7.1 WPComplete
-
high 7.1 Forminator Forms
-
medium 5.3 Event Tickets and Registration
-
medium 4.3 Event Tickets and Registration
-
medium 5.3 GiveWP
-
medium 6.5 HollerBox
-
medium 5.3 Visual Composer Website Builder
-
medium 5.4 Event Tickets and Registration
-
medium 6.5 Kadence Blocks
-
medium 6.5 MasterStudy LMS WordPress Plugin
-
medium 6.5 Robo Gallery
-
medium 6.5 Ultimate Post Kit
-
medium 5.3 YITH WooCommerce Product Bundles
-
medium 6.5 ShortPixel Image Optimizer
-
medium 4.3 VillaTheme Core
-
high 7.6 Vitepos
-
medium 6.5 WP Store Locator
-
medium 6.5 Wallet System for WooCommerce
Security issue
-
medium 5.3 Easy Digital Downloads
-
low 2.7 SMS Alert
-
medium 6.3 Wallet System for WooCommerce
-
medium 6.5 Wallet System for WooCommerce
-
medium 4.3 Wallet System for WooCommerce
-
medium 6.6 BackWPup
-
medium 5.3 BackWPup
-
medium 5.9 BackWPup
-
low 2.7 Booking Calendar
-
medium 5.3 Appointment Booking Plugin
-
low 2.7 Appointment Booking Plugin
-
low 3.3 Appointment Booking Plugin
-
medium 4.8 Booking Calendar
Security issue
-
medium 4.3 Easy Digital Downloads
-
medium 6.8 Image Photo Gallery Final Tiles Grid
-
critical 9.8 Frontend Dashboard
-
high 7.5 GPTranslate
-
critical 9.8 Ultimate Multisite
-
medium 5.4 Appointment Booking Plugin
Wednesday, October 7, 2026 · 37
-
high 7.5 Forminator Forms
-
critical 9.8 The Events Calendar
-
critical 9.3 WP Data Access
-
high 7.1 Disable and Remove Google Fonts
-
high 7.1 Everest Forms
-
high 8.8 Unlimited Elements for Elementor
-
high 7.1 Unlimited Elements for Elementor
-
high 7.6 affects latest 1.2.63 Slider by 10Web
-
high 7.6 WP Post Author
-
high 7.6 affects latest 2.1.2 Pix por Piggly (para Woocommerce)
-
high 7.6 Post title marquee scroll
-
medium 6.5 Media Library Assistant
-
high 7.6 affiliate-toolkit
-
medium 6.5 Element Pack Addons for Elementor
-
medium 6.5 Prime Slider
-
high 7.6 affects latest 2.4 Dynamic User Directory
-
medium 5.3 Modula Image Gallery
-
medium 6.5 LazyLoad Plugin
-
medium 6.5 Element Pack Addons for Elementor
-
medium 4.3 Booktics
-
medium 6.5 HappyAddons for Elementor
-
medium 6.5 Quiz and Survey Master (QSM)
-
medium 4.3 Hustle
-
high 7.2 OMGF
-
medium 4.1 PowerPress Podcasting plugin by Blubrry
-
medium 4.3 User Private Files
-
high 7.1 If-So Dynamic Content
-
medium 5.4 MetForm
-
medium 6.8 Animated Number Counters
-
low 2.7 CP Media Player
-
medium 6.8 Envira Gallery
-
medium 4.3 Academy LMS
-
medium 4.3 Academy LMS
-
medium 6.8 Envira Gallery
-
medium 4.3 Frontend Dashboard
-
medium 4.3 Yaad Sarig Payment Gateway For WC
-
high 7.2 Kirki
Tuesday, October 6, 2026 · 97
-
medium 4.8 Login Lockdown & Protection
Security issue
-
high 8.1 SMS Alert
-
high 7.3 BEAR
-
high 8.8 Progress Planner
-
high 7.2 PublishPress Capabilities
-
high 7.5 Easy Digital Downloads
-
high 7.1 WPLP Cookie Consent
-
medium 6.5 PayPlug for WooCommerce (Official)
-
high 7.1 Video Background Block
-
high 7.5 Norvis Backup
-
high 7.5 Snapshotify
-
high 7.1 Social Rocket
-
high 7.1 affects latest 2.1.0 Blog, Posts and Category Filter for Elementor
-
high 7.1 affects latest 3.2.6 CF7 Views
-
high 7.5 Museder RestoreOne
-
critical 9.3 affects latest 1.5.9 Newsletter Subscription Form
-
high 7.5 SafeSnap
-
high 7.5 affects latest 1.0.2 WXD Backup Lite
-
high 7.5 Advanced Posts Listing
-
critical 9.8 The GDPR Framework By Data443
-
critical 9.3 SendPress Newsletters
-
high 8.6 Simple File List
-
high 8.8 Simple JWT Login
-
medium 6.5 TrueBooker
-
high 7.5 affects latest 1.6.3 WCFM
-
medium 6.5 Front End PM
-
critical 9.3 Gmedia Photo Gallery
-
medium 5.3 Mailjet Email Marketing
-
medium 6.5 affects latest 1.4.35 10WebSocial
-
high 7.1 Ansar Import
-
high 7.1 Document Gallery
-
high 7.1 Hotel Booking
-
high 8.0 Tabs Responsive
-
high 7.1 affects latest 1.3.7 Youzify
-
medium 5.3 Captcha by BestWebSoft
Security issue
-
high 7.5 Graphina
-
critical 9.3 Radius Booking
-
medium 6.5 WPBase Cache
-
critical 9.9 affects latest 1.1.11 WP Duplicate
-
high 7.1 affects latest 2.32.3 Midtrans-WooCommerce
-
medium 6.5 Piotnet Addons For Elementor
-
medium 6.5 affects latest 2.7.7 Appointment Bookings for Zoom GoogleMeet and m…
-
medium 6.5 App for Cloudflare®
-
high 7.7 Job Postings
-
high 7.5 PayPlug for WooCommerce (Official)
-
high 7.1 StoreGrowth
-
high 7.1 affects latest 1.7.6 Contact Form to DB by BestWebSoft
-
high 7.1 Database for CF7
-
high 7.2 affects latest 4.3.4 Edwiser Bridge
-
high 7.2 Instapage Plugin
-
high 7.1 Wise Chat
-
high 7.1 HTTP Requests Manager
-
high 7.1 Mapster WP Maps
-
high 7.2 affects latest 1.0.4 PDF Smart Viewer for Elementor
-
medium 6.5 affects latest 4.1.12 WC Fields Factory
-
critical 10.0 Kognetiks Chatbot
-
high 7.1 ECPay Ecommerce for WooCommerce
-
high 7.1 affects latest 4.16.2 Mooberry Book Manager
-
high 7.1 Frontend File Manager Plugin
-
high 7.1 Smart Forms
-
high 8.5 Paid Membership Subscriptions
-
high 8.5 WP2LEADS
-
high 7.1 WP2LEADS
-
medium 6.5 WP Comment Cleaner
-
high 8.8 Salon Booking System
-
high 7.5 SiteVault
-
high 7.1 WP Mailster
-
high 8.8 WP User Profiles
-
medium 5.3 Zero Spam for WordPress
Security issue
-
high 7.1 Form Block
-
high 7.1 GiveWP
-
high 8.1 GiveWP
-
high 7.1 LearnPress
-
high 7.3 picu
-
high 7.1 Charitable
-
medium 6.9 Motors
-
high 7.1 picu
-
medium 5.3 Advanced Google reCAPTCHA
-
high 7.5 Groundhogg
-
high 7.1 Payflex Payment Gateway
-
high 8.5 WPO365
-
high 7.5 XServer Migrator
-
medium 5.3 Slider Pro
-
medium 6.5 Eventin
-
high 7.2 Post SMTP
-
high 7.1 Real3D Flipbook
-
high 7.5 affects latest 1.0.1 Sitemovr
-
high 7.5 WP Synchro
Security issue
-
medium 6.5 IATO MCP
-
high 7.5 Morning for WooCommerce
-
medium 4.3 affects latest 3.10.4 WDS MCP Content Manager
-
medium 6.5 Faktur Pro for WooCommerce
Monday, October 5, 2026 · 60
-
high 8.8 Simple Event Planner
-
high 7.2 Sunshine Photo Cart
-
medium 6.5 SmartyParcel
-
high 8.8 VK Google Job Posting Manager
-
high 7.2 WP Spell Check
-
critical 9.8 Advanced Post Manager
-
high 7.1 RepairBuddy
-
medium 6.9 Hyve Lite
-
high 7.6 Scratch & Win
-
medium 6.5 Timetics
-
medium 6.9 Cozy Blocks
-
medium 5.3 BuildKit
Security issue
-
high 7.5 Five Star Restaurant Reservations
-
medium 6.5 UsersWP
-
critical 9.3 WP BASE Booking of Appointments, Services and…
-
medium 6.5 WP User Manager
-
medium 6.5 RepairBuddy
-
medium 6.5 Lookzy LookBook for WooCommerce
-
high 7.1 Revopic
-
medium 6.5 affects latest 1.1.130 Image Slider
-
high 7.1 Adsmonetizer
-
medium 5.3 Kit (formerly ConvertKit) for WooCommerce
-
medium 4.3 Polylang
-
medium 5.3 Eventin
-
medium 5.3 Eventin
-
medium 4.3 affects latest 4.0.0 WP Dummy Content Generator
-
medium 5.4 Starter Templates
-
medium 5.3 CURCY
Security issue
-
medium 5.3 Events Manager
-
medium 6.5 QR Redirector
-
medium 6.5 Unlimited Elements for Elementor
Security issue
-
medium 4.3 WP Admin Audit
-
medium 6.5 eCommerce Product Catalog
-
medium 6.5 Logo Showcase
-
medium 5.3 WP Mailster
-
medium 4.3 Event Tickets and Registration
-
medium 6.5 bBlocks
-
medium 6.5 Image Photo Gallery Final Tiles Grid
-
medium 6.5 GiveWP
-
high 7.6 Groundhogg
-
medium 4.3 Memberful
-
medium 6.5 MP3 Audio Player
-
medium 5.3 Name Directory
-
medium 6.5 Name Directory
-
medium 5.3 PowerPress Podcasting plugin by Blubrry
-
high 8.5 Image Optimizer, Resizer and CDN
-
medium 6.5 WPVR
-
medium 5.3 E-cab Taxi Booking Manager for Woocommerce
Security issue
-
medium 5.4 JS Help Desk
-
medium 4.3 JS Help Desk
-
medium 6.5 Premium Addons for Elementor
-
medium 6.5 Presto Player
-
medium 5.3 Video Conferencing with Zoom
-
medium 6.5 Starter Templates
-
medium 5.9 File Uploads Addon for WooCommerce
-
medium 5.9 File Uploads Addon for WooCommerce
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.