WordPress plugin vulnerabilities: week 42, 2026
397 vulnerabilities published Oct 12 – Oct 18, 2026 in 267 plugins we track, by day.
26 critical 133 high 232 medium 6 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, October 18, 2026 · 25
-
critical 9.8 WPBot
-
medium 6.5 Kit (formerly ConvertKit)
-
medium 6.5 HivePress
-
high 7.1 PowerPack Lite for Beaver Builder
-
high 8.5 Support Genix
-
medium 6.5 2Way VideoCalls and Random Chat
-
high 7.1 Booktics
-
critical 9.3 Booktics
-
medium 6.5 Advanced File Manager
-
high 7.1 Simply Schedule Appointments
-
critical 9.8 OttoKit
-
high 8.8 Strong Testimonials
-
medium 4.9 AI Engine
-
medium 4.9 AI Engine
-
medium 6.5 Modern Events Calendar Lite
-
medium 4.3 Modern Events Calendar Lite
-
medium 4.3 Salon Booking System
-
medium 6.8 Salon Booking System
-
medium 5.5 Salon Booking System
-
high 7.2 Salon Booking System
-
high 7.1 WP Photo Album Plus
-
medium 4.9 Tasty Recipes Lite
-
medium 5.4 Otter Blocks
Saturday, October 17, 2026 · 40
-
medium 4.3 SMS Alert
-
high 7.1 PAYCOMET for WooCommerce
-
high 7.5 Gantry 5 Framework
-
medium 5.4 weForms
-
medium 6.4 YMC Filter
-
high 7.1 Fancy Comments WordPress
-
medium 6.5 Patreon WordPress
-
medium 4.3 Patreon WordPress
-
low 3.7 Patreon WordPress
-
medium 6.5 ThirstyAffiliates
-
medium 6.6 ACF Frontend Admin by DynamiApps
-
medium 5.3 ACF Frontend Admin by DynamiApps
-
medium 6.8 BSK PDF Manager
-
medium 5.0 WP Data Access
-
medium 5.3 WP User Manager
-
medium 5.3 PeachPay
-
medium 4.3 Tutor LMS
-
high 7.2 User Registration & Membership
-
medium 4.3 User Registration & Membership
-
high 8.1 User Registration & Membership
-
medium 4.9 Post Export Import with Media
-
medium 6.4 Themify Builder
-
medium 6.4 Themify Popup
-
medium 6.8 WP Booking System
-
medium 6.5 WP Booking System
-
medium 6.4 xSpeed Cache
-
medium 6.5 LearnPress
-
medium 4.9 Welcart e-Commerce
-
high 7.5 WP Booking System
-
critical 9.8 LearnPress
-
high 7.2 EU VAT Assistant for WooCommerce
-
medium 4.3 Fastcache by Host.it
-
medium 6.1 Hippoo Mobile App for WooCommerce
-
high 7.5 Kirki
-
low 3.7 Appointment Booking Plugin
-
critical 9.1 Appointment Booking Plugin
-
high 7.2 LearnPress
-
high 7.2 Kirki
Friday, October 16, 2026 · 116
-
medium 6.4 Tourfic
-
high 8.8 affects latest 1.0.8 aThemeArt Theme Helper
-
medium 5.3 YITH PayPal Express Checkout for WooCommerce
-
high 7.1 Advanced Post Manager
-
medium 5.3 Bookit
-
medium 5.3 Passster
-
medium 6.5 MapSVG
-
high 8.5 MapSVG
-
medium 5.3 MapSVG
-
medium 6.5 PowerPack Addons for Elementor
-
medium 5.4 SmartCrawl SEO checker, analyzer & optimizer
-
medium 6.5 The Events Calendar
-
medium 5.3 Eventin
-
medium 5.4 Squeeze
-
medium 6.4 GeoDirectory
-
medium 5.4 Events Made Easy
-
medium 6.4 Tutor LMS
-
high 8.8 DoubleScale CRM
-
high 7.2 SureCart
-
high 7.5 Vitepos
-
medium 6.4 Name Directory
-
medium 5.4 ProfilePress
-
medium 6.4 SureDash
-
high 8.1 Vulnity Security
-
medium 6.4 Social Share Buttons
-
medium 6.4 FiboSearch
-
high 7.2 WPConsent
-
high 8.8 YaySMTP
-
medium 5.3 Document Gallery
-
medium 6.5 Subscribe to Comments
-
medium 4.3 WP Map Block
-
high 8.8 WP Photo Album Plus
-
medium 5.4 User Registration & Membership
-
high 7.2 CP Multi View Events Calendar
-
medium 6.4 GeoDirectory
-
medium 5.3 Site Reviews
-
medium 6.4 WebberZone Top 10
-
medium 4.9 WP Booking System
-
medium 6.4 Premium Packages
-
medium 5.4 WPeMatico RSS Feed Fetcher
-
medium 6.8 affiliate-toolkit
-
high 7.4 OTP Login & Register Woocommerce
-
high 8.8 Salon Booking System
-
medium 5.3 Salon Booking System
-
medium 4.8 Salon Booking System
-
medium 4.3 Salon Booking System
-
medium 6.4 HivePress
-
high 7.2 HivePress
-
high 7.2 TranslatePress
-
low 2.7 WP Mail Logging
-
medium 6.8 Photo Engine (Media Organizer & Lightroom)
-
medium 6.5 WSP MCP
-
critical 9.8 Sunshine Photo Cart
-
medium 5.3 HUSKY
-
medium 4.8 WP Compress
-
medium 6.8 Mobile builder
-
high 7.2 Opti-Behavior
-
high 7.2 Hide My WP Ghost
-
high 7.2 Opti-Behavior
-
medium 6.5 Tainacan
-
critical 9.8 Theme My Login
-
high 8.8 PilotPress
-
medium 6.1 Tutor LMS
-
medium 5.3 Lightweight Cookie Notice
-
high 7.2 SiteOrigin CSS
-
high 7.2 NotificationX
-
high 8.1 User Profile Builder
-
medium 6.4 Quick PayPal Payments
-
medium 6.5 Vitepos
-
high 7.2 Salon Booking System
-
high 7.2 SiteOrigin CSS
-
medium 6.4 User Profile Builder
-
high 8.0 Search Regex
-
medium 5.4 Slim SEO
-
high 7.2 Simply Schedule Appointments
-
critical 9.8 ELEX WordPress HelpDesk & Customer Ticketing S…
-
high 7.5 10Web Booster
-
high 7.2 Ultra Addons for Contact Form 7
-
high 7.2 User Profile Builder
-
medium 6.4 Tourfic
-
medium 6.4 SQL Chart Builder
-
medium 6.5 Broken Link Checker
-
medium 6.5 Mail Mint
-
high 7.5 Nexter Extension
-
medium 5.3 NotificationX
-
high 8.1 Groundhogg
-
high 7.5 InstaWP Connect
-
high 7.5 Klarna for WooCommerce
-
medium 4.3 Bulk Page Generator
-
critical 9.8 MailOptin
-
high 7.2 Mang Board
-
medium 6.4 Mang Board
-
critical 9.8 Mang Board
-
high 7.5 FluentCart
-
medium 6.5 Forminator Forms
-
high 7.5 FunnelKit
-
medium 6.1 Gwolle Guestbook
-
medium 4.3 Image Hub
-
high 7.5 Modula Image Gallery
-
critical 9.8 My Calendar
-
medium 6.5 Forminator Forms
-
high 8.0 Backuply
-
medium 4.3 Dokan
-
medium 6.4 Cooked
-
high 7.2 RSS Aggregator by Feedzy
-
high 7.2 Flying Scripts
-
high 7.2 Colibri Page Builder
-
medium 5.9 Debloat
-
medium 4.9 FluentCart
-
medium 4.8 Popup Box
Thursday, October 15, 2026 · 59
-
medium 5.3 WP Easy Pay
-
medium 6.5 Download Monitor
-
medium 5.3 Ninja Forms Signature Contract Add-On
-
medium 5.3 Ajax Search Lite
-
medium 6.5 Infinite Uploads
-
medium 5.3 PlanetStudio Payment Gateway
-
medium 5.4 Strong Testimonials
-
medium 6.5 Presto Player
-
medium 5.3 Sunshine Photo Cart
-
medium 5.3 Knowledge Base
-
medium 6.5 YITH WooCommerce Compare
-
medium 4.3 AI Engine
-
medium 6.3 Simply Schedule Appointments
-
medium 5.4 WordLift
-
medium 4.3 Strong Testimonials
-
medium 5.3 WC Shop Sync
-
medium 6.5 MDTF
-
medium 5.3 Booking and Rental Manager for Bike
Security issue
-
critical 9.8 ACF Frontend Admin by DynamiApps
-
high 8.8 FluentCRM
-
critical 9.3 Mang Board
-
high 7.1 affects latest 1.31 Social Share Buttons
-
high 7.1 User Registration & Membership
-
critical 9.3 Link Whisper Free
-
critical 9.8 Link Whisper Free
-
high 7.1 Link Whisper Free
-
medium 6.5 Broken Link Checker
-
medium 6.5 User Registration & Membership
-
medium 5.4 WholesaleX
-
high 7.5 FluentCart
-
critical 9.8 FluentCRM
-
critical 9.3 Booking for Appointments and Events Calendar
-
high 7.1 BSK PDF Manager
-
high 7.1 Everest Forms
-
medium 4.3 Blog2Social
-
high 7.5 Tutor LMS
-
medium 5.3 Rede Itaú for WooCommerce
Security issue
-
medium 5.3 Rede Itaú for WooCommerce
Security issue
-
high 7.1 Document Gallery
-
medium 4.3 Elementor Website Builder
-
medium 6.5 Spin Wheel
-
high 7.2 Mang Board
-
medium 6.5 Ocean Extra
-
medium 6.4 Post and Page Builder by BoldGrid
-
medium 6.4 VK Blocks
-
high 7.2 Groundhogg
-
medium 6.1 Photo Gallery by 10Web
-
high 7.2 Premium Packages
-
medium 6.4 Import and export users and customers
-
high 7.5 Link Library
-
medium 6.1 Tracking Code Manager
-
high 7.3 PhastPress
-
medium 6.4 Kirki
-
critical 9.8 10Web Booster
Wednesday, October 14, 2026 · 97
-
high 8.8 FV Flowplayer Video Player
-
high 7.1 Hippoo Mobile App for WooCommerce
-
high 8.2 Skydropx
-
high 7.1 Paymattic
-
medium 5.3 MDTF
-
high 7.1 SimplyRETS Real Estate IDX
-
high 7.5 Salevo Boost Sales for WooCommerce
-
high 7.2 Polylang
-
critical 9.8 Affiliates
-
medium 6.5 Bus Ticket Booking with Seat Reservation
-
critical 9.8 Frontend Dashboard
-
medium 6.5 WP OAuth Server ( Login with WordPress )
-
high 7.3 Paid Videochat Turnkey Site
-
medium 6.5 Push Notification for Post and BuddyPress
-
high 7.3 Broadcast Live Video
Security issue
-
medium 6.5 WP w3all phpBB
-
high 8.8 SureCart
-
high 7.1 SureCart
-
medium 5.4 Responsive Blocks
-
high 7.5 JetFormBuilder
-
high 8.5 Modern Events Calendar Lite
-
high 7.5 Mailonix
-
high 7.1 Paid Videochat Turnkey Site
-
high 8.5 CP Multi View Events Calendar
-
medium 4.9 Gallery Custom Links
-
high 7.5 LifterLMS
-
medium 5.3 Restricted Site Access
-
medium 6.4 GeoDirectory
-
medium 6.4 GeoDirectory
-
high 7.2 Mang Board
-
medium 6.4 Meow Lightbox
-
high 8.1 Mang Board
-
medium 6.4 Mang Board
-
high 7.2 Post Export Import with Media
-
medium 6.5 Jeg Kit for Elementor
-
medium 4.3 Appointment Booking Plugin
-
high 7.5 Appointment Booking Plugin
-
high 7.4 Appointment Booking Plugin
-
medium 6.4 PeproDev Branches Map (Mapify)
-
high 8.1 ShopMagic
-
critical 9.8 SimpleForm
-
medium 5.3 AWP Classifieds
-
medium 6.8 Donation Thermometer
-
medium 5.3 Cart Abandonment Recovery for WooCommerce
-
medium 4.3 Tainacan
-
high 7.2 affiliate-toolkit
-
medium 5.3 EmbedPress
-
medium 4.1 FV Flowplayer Video Player
-
medium 5.3 Sunshine Photo Cart
Security issue
-
low 2.7 WP 2FA
-
medium 6.5 WP Encryption
-
medium 5.9 Classified Listing
-
medium 6.8 Image Photo Gallery Final Tiles Grid
-
medium 5.3 GamiPress
-
medium 4.3 GamiPress
-
medium 6.8 Gutenverse Form
-
medium 5.3 NEX-Forms
-
high 8.6 Ultimate Multisite
-
high 8.8 WP Booking System
-
medium 6.8 Image Photo Gallery Final Tiles Grid
-
medium 5.3 Rank Math SEO
-
medium 5.3 WP Data Access
-
medium 5.3 WP Data Access
-
medium 6.4 Social Share Buttons & Analytics Plugin
-
high 7.2 NewStatPress
-
high 7.2 FV Flowplayer Video Player
-
medium 6.4 PO/MO Editor
-
high 7.5 Gmedia Photo Gallery
-
high 7.5 Form Maker by 10Web
-
medium 6.4 FV Player 8
-
high 7.2 Smart Forms
-
high 7.2 Verified Reviews (Avis Vérifiés)
-
high 7.2 Cryptocurrency Donation Box
-
critical 9.8 JTL-Connector for WooCommerce
-
high 7.2 Contact Form DB for Enfold
-
high 7.2 Document Gallery
-
high 7.5 JTL-Connector for WooCommerce
-
medium 6.4 Countdown Timer
-
critical 9.8 AGE-GATE
-
medium 6.4 Directorist
-
high 7.2 NewStatPress
-
medium 4.7 Tutor LMS
-
critical 9.8 Snazzy Social Media Feed
-
high 7.2 AnyComment
-
critical 9.1 Click to Chat
-
critical 9.8 Printcart Store
-
high 8.1 Directorist
-
medium 5.3 Database Addon for Contact Form 7
-
high 7.5 Bit integrations
-
high 8.1 BP Profile Search
-
medium 6.4 Booking Package
-
high 7.5 Booking Package
Tuesday, October 13, 2026 · 33
-
medium 4.3 Download Monitor integration for WooCommerce
-
medium 5.3 Premium Addons for Elementor
-
medium 5.3 Eventin
-
medium 5.3 Booking for Appointments and Events Calendar
-
medium 6.5 Prime Slider
-
medium 5.4 FluentBoards
-
high 7.6 Link Whisper Free
-
medium 6.5 SureCart
-
medium 5.4 User Registration & Membership
-
medium 6.5 SureForms
-
medium 5.3 WP User Manager
-
high 7.6 WOLF
-
medium 6.5 PowerPack Addons for Elementor
-
medium 6.5 Premium Addons for Elementor
-
medium 5.3 Quick PayPal Payments
-
medium 5.3 FOX
-
medium 5.3 Pay for Payment for WooCommerce
-
medium 6.5 Books Gallery
-
medium 5.3 User Registration & Membership
-
medium 5.3 User Registration & Membership
-
medium 6.5 User Registration & Membership
-
medium 5.4 User Registration & Membership
-
medium 4.3 Ad Inserter
-
medium 4.9 Animated Number Counters
-
medium 5.3 WPGraphQL
-
high 7.2 AcyMailing
-
high 7.2 Bit integrations
-
medium 5.3 WP-BusinessDirectory
-
medium 6.5 Weaver Xtreme Theme Support
-
medium 6.5 affects latest 3.3.1 IMPress for IDX Broker
-
medium 6.5 FV Simpler SEO
-
medium 6.5 affects latest 0.1.9 Responsive Slider
Monday, October 12, 2026 · 27
-
low 3.7 Events Manager
Security issue
-
medium 5.4 WP-Members Membership Plugin
-
medium 5.3 Forminator Forms
-
high 7.4 Patreon WordPress
-
high 8.1 Patreon WordPress
-
medium 6.5 Premium Addons for Elementor
-
medium 5.4 Booktics
-
medium 6.5 Quiz and Survey Master (QSM)
-
medium 5.3 Salevo Boost Sales for WooCommerce
Security issue
-
medium 6.5 Element Pack Addons for Elementor
-
medium 5.3 Booktics
-
medium 5.0 Paid Videochat Turnkey Site
-
medium 4.3 Broadcast Live Video
-
medium 6.5 Ad Inserter
-
medium 4.3 Flexible Subscriptions
-
medium 6.5 Custom Query Blocks
-
medium 5.3 Products Restricted Users for WooCommerce
-
medium 4.3 WP User Manager
-
medium 5.4 Event Post
-
medium 6.5 Event Post
-
medium 5.3 Flexible Quantity & Price Calculator for WooCo…
Security issue
-
medium 4.3 Paid Videochat Turnkey Site
Security issue
-
medium 5.4 TMDS
-
medium 4.3 Hotel Booking
-
medium 4.3 Hotel Booking
-
medium 6.5 WP Comment Cleaner
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.