WordPress plugin vulnerabilities: week 43, 2026
203 vulnerabilities published Oct 19 – Oct 25, 2026 in 141 plugins we track, by day.
16 critical 60 high 109 medium 18 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, October 25, 2026 · 7
-
high 7.2 Duplicator
-
low 3.1 InstaWP Connect
-
low 2.4 Qi Addons For Elementor
Security issue
-
low 2.7 WPVR
-
low 3.8 WPVR
-
medium 4.9 WPVR
-
low 3.5 Contact Form by Supsystic
Saturday, October 24, 2026 · 34
-
medium 6.5 Event Booking Manager for WooCommerce
-
high 7.2 Relevanssi
-
high 8.8 aBlocks
-
medium 6.5 affects latest 5.0.13 Social Feed Gallery
-
medium 6.5 Ad Inserter
-
medium 6.5 All-in-One Video Gallery
-
high 7.1 Events Manager
-
critical 9.8 Newsletters
-
high 7.1 QA Assistants
-
high 7.1 VOD Infomaniak
-
high 7.1 Better Messages
-
medium 5.9 LiteSpeed Cache
-
high 7.1 We’re Open!
-
critical 9.8 Paytium
-
high 7.1 W3 Total Cache
-
critical 9.3 Product Filter for WooCommerce by WBW
-
high 7.1 Eventin
-
critical 9.3 Newsletters
-
medium 6.5 SureDash
-
low 3.7 GeoDirectory
-
medium 5.4 News Kit Addons For Elementor
-
medium 4.3 News Kit Addons For Elementor
-
medium 6.8 WPVR
-
high 7.1 Download Monitor
-
high 7.2 GeoDirectory
-
medium 6.8 GeoDirectory
-
medium 5.3 GeoDirectory
-
medium 6.4 GeoDirectory
-
medium 5.3 GeoDirectory
-
medium 4.3 GeoDirectory
-
medium 6.5 MAS Videos
-
high 7.1 User Profile Builder
-
critical 9.8 Prime Mover
Friday, October 23, 2026 · 31
-
medium 4.8 Advanced Custom Fields
-
high 8.5 GamiPress
-
critical 9.8 Participants Database
-
critical 9.3 Participants Database
-
medium 6.5 Car Rental Manager
-
medium 6.5 Knit Pay
-
high 7.5 WPMobile.App
-
high 8.1 Advanced Custom Fields
-
critical 9.0 Advanced Custom Fields
-
medium 6.8 Advanced Custom Fields
-
high 8.1 Advanced Custom Fields
-
medium 5.4 Depicter
-
medium 4.9 Download Monitor
-
low 3.1 LiteSpeed Cache
-
high 7.5 LiteSpeed Cache
-
high 7.5 LiteSpeed Cache
-
low 3.7 Popup Builder
-
high 7.2 User Profile Builder
-
low 3.8 Essential Addons for Elementor
-
low 3.5 Essential Addons for Elementor
Security issue
-
high 7.5 Otter Blocks
-
medium 5.3 Otter Blocks
-
medium 5.3 Otter Blocks
-
medium 6.8 Otter Blocks
-
medium 6.8 User Profile Builder
-
medium 5.5 Speed Optimizer
-
low 3.5 Speed Optimizer
-
high 7.5 Music Store
Thursday, October 22, 2026 · 42
-
medium 6.5 Paid Membership Subscriptions
-
critical 9.8 Rootblox
-
high 7.1 Advanced Custom Fields
-
medium 6.5 affects latest 6.0 Extensions for Leaflet Map
-
medium 6.5 affects latest 2.4.4 Restaurant Menu
-
medium 6.5 affects latest 7.8 ND Shortcodes
-
medium 5.3 Page and Post Restriction
-
medium 5.3 ShopMagic
-
medium 5.3 ЮKassa для WooCommerce
-
high 7.5 Advanced Custom Fields
-
medium 6.5 Advanced Custom Fields
-
critical 9.3 Booking for Appointments and Events Calendar
-
high 7.1 Contact Form Email
-
medium 5.3 Majestic Support
-
medium 6.5 Off-Canvas Sidebars & Menus (Slidebars)
-
high 8.8 User Profile Builder
-
critical 9.8 SureCart
-
high 7.6 Royal Addons for Elementor
-
medium 5.3 Sunshine Photo Cart
-
medium 5.3 SureDash
-
medium 5.3 SureDash
-
high 7.1 WP Mailster
-
medium 5.3 MetForm
-
medium 4.3 PowerPack Addons for Elementor
-
medium 5.4 eRoom
-
medium 5.3 Falcon
-
medium 6.5 Interactive Content
-
medium 5.4 MarketKing
-
medium 4.3 Strong Testimonials
-
high 8.8 Xpro Addons
-
medium 6.8 Link Library
-
low 2.7 MasterStudy LMS WordPress Plugin
-
high 7.5 WebP Express
-
high 7.5 Royal MCP
-
medium 4.9 Photo Engine (Media Organizer & Lightroom)
-
medium 6.8 Photo Engine (Media Organizer & Lightroom)
-
low 3.7 Infility Global
-
high 7.2 PixelYourSite
-
medium 4.8 WP Ultimate Review
Wednesday, October 21, 2026 · 51
-
medium 6.5 Tailored Tools
-
medium 4.3 eRoom
-
medium 4.3 Interactive Content
-
critical 9.3 Ajax Search Lite
-
high 7.1 Geo Mashup
-
high 7.1 SureCart
-
medium 6.5 Contest Gallery
-
critical 9.9 Mang Board
-
high 7.1 Paid Videochat Turnkey Site
-
high 7.1 ThemeHunk Customizer
-
high 7.5 weForms
-
medium 6.5 BjornTech Swish for WooCommerce
-
critical 10.0 WP Mailster
-
medium 5.3 Travelly
-
high 8.8 GS Pinterest Portfolio
-
high 8.8 Team Members
-
high 7.1 Live Summary for Gravity Forms
-
medium 5.4 Happyforms
Security issue
-
medium 5.3 Contest Gallery
Security issue
-
low 2.7 Simple Shopping Cart
Security issue
-
medium 5.3 Simple Shopping Cart
Security issue
-
high 7.1 Ninja Forms
-
high 7.1 Strong Testimonials
-
medium 4.3 Download Manager
-
high 7.5 Formidable Forms
-
medium 6.5 Wava Payment Plugin
-
medium 5.3 Wava Payment Plugin
-
medium 6.8 Elementor Website Builder
-
medium 6.4 Elementor Website Builder
-
high 7.1 Advanced File Manager
-
medium 4.9 AI Engine
-
medium 5.5 Pricing Table WordPress Plugin
-
high 7.5 miniOrange 2FA
-
high 7.1 User Profile Builder
-
medium 5.3 TI WooCommerce Wishlist
-
medium 5.9 WholesaleX
-
medium 6.5 WholesaleX
-
high 7.5 Redirection for Contact Form 7
-
medium 5.3 SureCart
-
high 7.1 WP Booking System
-
high 8.1 WP User Manager
-
medium 4.9 WPZOOM Portfolio Lite
-
medium 5.3 Booking Package
-
medium 5.3 Booking Package
-
medium 4.8 Booking Package
Security issue
-
medium 5.0 Uncanny Toolkit for LearnDash
-
high 7.5 Uncanny Toolkit for LearnDash
-
low 2.7 Appointment Booking Plugin
-
high 8.8 Duplicator
Tuesday, October 20, 2026 · 13
-
medium 6.3 Participants Database
-
medium 6.5 SureCart
-
medium 5.3 Booktics
-
medium 5.3 Bus Ticket Booking with Seat Reservation
-
medium 4.3 WP User Manager
-
medium 6.5 Meta Box
-
medium 6.5 Rootblox
-
medium 5.3 Seriously Simple Podcasting
-
medium 6.5 Seriously Simple Podcasting
-
medium 6.5 Brizy
-
medium 4.3 Easy Property Listings
-
medium 5.3 Easy Property Listings
Monday, October 19, 2026 · 25
-
medium 5.4 Surfer
-
medium 4.3 Classified Listing
Security issue
-
medium 6.5 WP Mailster
-
medium 4.3 Event Tickets and Registration
-
medium 6.5 YITH WooCommerce Wishlist
-
medium 4.3 FluentCommunity
-
medium 5.3 Fluent Forms
-
medium 5.3 Broadcast Live Video
-
medium 5.3 YITH WooCommerce Product Bundles
-
medium 6.5 E2Pdf
-
medium 5.4 LearnPress
-
critical 9.9 MapSVG
-
high 8.8 Quiz and Survey Master (QSM)
-
medium 6.5 Tutor LMS
-
medium 6.4 Essential Addons for Elementor
-
critical 9.9 HivePress
-
high 7.7 MapSVG
-
high 7.1 Quiz Maker by AYS
-
medium 5.3 App Builder
-
medium 5.3 iPOSpays Payment Gateway for WooCommerce
Security issue
-
low 3.8 Subscribe to Comments
Security issue
-
medium 5.3 Document Gallery
Security issue
-
medium 6.8 Document Gallery
-
low 3.7 Salon Booking System
Security issue
-
medium 6.8 Blaze Demo Importer
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.