WordPress plugin vulnerabilities: week 44, 2026

476 vulnerabilities published Oct 26 – Nov 1, 2026 in 311 plugins we track, by day.

25 critical 143 high 296 medium 12 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, November 1, 2026 · 7

• critical 9.3 Bookit

  SQL injection

  CVE-2026-62048 · affected 2.6.0.6 and older · fixed in 2.6.0.7

• high 7.1 Iptanus File Upload

  Stored cross-site scripting (XSS)

  CVE-2026-66570 · affected 5.2.1 and older · fixed in 5.2.2

• medium 6.5 JetFormBuilder

  Path traversal / file read

  CVE-2026-119480 · affected 3.6.7.1 and older · fixed in 3.6.8

• medium 6.8 Media Library Assistant

  Stored cross-site scripting (XSS)

  CVE-2026-113482 · affected older than 3.44 · fixed in 3.44

• medium 4.3 Media Library Assistant

  Missing authorization check

  CVE-2026-113481 · affected older than 3.44 · fixed in 3.44

• medium 4.3 Kali Forms

  Missing authorization check

  CVE-2026-107343 · affected older than 2.4.30 · fixed in 2.4.30

• medium 4.3 Kali Forms

  Information disclosure

  CVE-2026-107342 · affected older than 2.4.30 · fixed in 2.4.30

Saturday, October 31, 2026 · 74

• high 7.2 Debug Log Manager

  Stored cross-site scripting (XSS)

  CVE-2026-120114 · affected 2.5.2 and older · fixed in 2.5.3 *

• high 8.8 Photo Gallery, Sliders, Proofing and Themes

  Remote code execution

  CVE-2026-76010 · affected 4.4.1 and older · fixed in 4.5.0 *

• medium 6.4 GeoDirectory

  Stored cross-site scripting (XSS)

  CVE-2026-116752 · affected 2.8.197 and older · fixed in 2.8.198 *

• medium 6.4 FlexStock

  Stored cross-site scripting (XSS)

  CVE-2026-107711 · affected 3.17.2 and older · fixed in 3.17.3 *

• medium 4.3 Germanized for WooCommerce

  Security issue

  CVE-2026-109231 · affected 4.1.4 and older · fixed in 4.1.5 *

• high 7.5 WP Directory Kit

  SQL injection

  CVE-2026-109197 · affected 1.6.0 and older · fix not stated

• medium 6.1 Ninja Forms

  DOM-based cross-site scripting (XSS)

  CVE-2026-100151 · affected 3.15.5 and older · fixed in 3.15.6 *

• medium 6.4 Smart Post

  Stored cross-site scripting (XSS)

  CVE-2026-119160 · affected 4.0.9 and older · fixed in 4.0.10 *

• critical 9.8 SimpleForm

  Arbitrary file upload

  CVE-2026-118235 · affected 3.10.2 and older · fixed in 3.11.0 *

• high 7.2 WP Activity Log

  Stored cross-site scripting (XSS)

  CVE-2026-120075 · affected 5.6.1 and older · fixed in 5.6.2 *

• critical 9.1 Acadlix LMS

  Arbitrary file deletion

  CVE-2026-103882 · affected 1.1.9 and older · fixed in 1.2.0 *

• medium 5.3 All in One SEO

  Information disclosure

  CVE-2026-109367 · affected 5.0.3 and older · fixed in 5.0.4 *

• medium 5.3 Booking for Appointments and Events Calendar

  Information disclosure

  CVE-2026-103915 · affected 2.4.12 and older · fixed in 2.4.13 *

• high 7.2 FeedWordPress

  Stored cross-site scripting (XSS)

  CVE-2026-110530 · affected 2026.0517 and older · fixed in 2026.1016 *

• medium 5.3 Newsletters

  SQL injection

  CVE-2026-101325 · affected 4.18.1 and older · fixed in 4.18.2 *

• critical 9.8 Uncanny Toolkit for LearnDash

  Authentication bypass

  CVE-2026-119096 · affected 3.8.2 and older · fixed in 3.8.3 *

• high 8.8 User Frontend

  Privilege escalation

  CVE-2026-120070 · affected 4.3.13 and older · fixed in 4.3.14 *

• medium 6.4 Co-Authors, Multiple Authors and Guest Authors…

  Stored cross-site scripting (XSS)

  CVE-2026-111592 · affected 4.17.0 and older · fixed in 4.18.0 *

• critical 9.8 Project Manager

  Remote code execution

  CVE-2026-116512 · affected 4.1.1 and older · fixed in 4.1.2 *

• medium 5.4 Content Pilot

  Stored cross-site scripting (XSS)

  CVE-2026-111070 · affected 2.2.4 and older · fixed in 2.2.5 *

• medium 5.9 WP Data Access

  Information disclosure

  CVE-2026-110023 · affected 5.5.88 and older · fixed in 5.5.89 *

• medium 6.4 SEOPress

  Stored cross-site scripting (XSS)

  CVE-2026-116535 · affected 10.3 and older · fixed in 10.4 *

• high 7.2 Shield Security

  Stored cross-site scripting (XSS)

  CVE-2026-118057 · affected 22.3.2 and older · fixed in 22.3.4 *

• high 7.2 WPO365

  Stored cross-site scripting (XSS)

  CVE-2026-107759 · affected 6.2 and older · fixed in 6.3 *

• medium 6.5 Redux Framework

  Missing authorization check

  CVE-2026-103997 · affected 4.5.15 and older · fixed in 4.5.16 *

• high 8.8 Rox Appointment Booking

  Privilege escalation

  CVE-2026-104012 · affected 1.3.1 and older · fixed in 1.3.2 *

• high 8.1 Wp Social Login and Register Social Counter

  Authentication bypass

  CVE-2026-103898 · affected 3.2.2 and older · fixed in 3.2.3 *

• medium 6.1 User Frontend

  Reflected cross-site scripting (XSS)

  CVE-2026-103962 · affected 4.3.13 and older · fixed in 4.3.14 *

• medium 6.5 WP2LEADS

  SQL injection

  CVE-2025-9462 · affected 3.5.6 and older · fixed in 3.5.12 *

• medium 4.3 Perfect Images

  Missing authorization check

  CVE-2025-11455 · affected 7.2.0 and older · fixed in 7.2.1 *

• critical 9.1 Popup Builder

  Missing authorization check

  CVE-2026-89270 · affected 4.4.5 and older · fixed in 4.4.6 *

• medium 5.3 Seraphinite Accelerator

  Information disclosure

  CVE-2026-90960 · affected 2.29.24 and older · fixed in 2.29.25 *

• medium 5.4 W3 Total Cache

  Stored cross-site scripting (XSS)

  CVE-2026-120019 · affected 2.10.7 and older · fixed in 2.11.0 *

• medium 6.1 Product Filter for WooCommerce by WBW

  Reflected cross-site scripting (XSS)

  CVE-2026-88942 · affected 3.4.6 and older · fixed in 3.4.7 *

• medium 5.3 Product Filter for WooCommerce by WBW

  Missing authorization check

  CVE-2026-11396 · affected 3.4.6 and older · fixed in 3.4.7 *

• high 7.5 Mail logging & Catcher

  Information disclosure

  CVE-2026-120040 · affected 2.2.0 and older · fixed in 2.3.0 *

• high 7.2 Shipping Zones by Drawing for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2026-119065 · affected 3.3.0 and older · fixed in 3.3.1 *

• high 7.2 ThirstyAffiliates

  Stored cross-site scripting (XSS)

  CVE-2026-119089 · affected 3.12.1 and older · fixed in 3.12.2 *

• medium 5.3 Welcart e-Commerce

  Missing authorization check

  CVE-2026-119166 · affected 2.12.5 and older · fixed in 2.12.6 *

• high 7.2 Welcart e-Commerce

  Stored cross-site scripting (XSS)

  CVE-2026-118070 · affected 2.12.5 and older · fixed in 2.12.6 *

• high 7.2 User Submitted Posts

  DOM-based cross-site scripting (XSS)

  CVE-2026-119162 · affected 20260916 and older · fixed in 20261029 *

• medium 6.5 UsersWP

  Privilege escalation

  CVE-2026-119980 · affected 1.2.78 and older · fixed in 1.2.79 *

• high 7.5 FunnelKit Automations

  SQL injection

  CVE-2026-119163 · affected 3.8.5.2 and older · fixed in 3.8.6 *

• high 7.2 Relevanssi

  Stored cross-site scripting (XSS)

  CVE-2026-116522 · affected 4.28.5 and older · fixed in 4.28.6 *

• high 7.2 VikRentCar Car Rental Management System

  Stored cross-site scripting (XSS)

  CVE-2026-116548 · affected 1.4.10 and older · fixed in 1.4.11 *

• high 7.2 VikRentCar Car Rental Management System

  Stored cross-site scripting (XSS)

  CVE-2026-115840 · affected 1.4.9 and older · fixed in 1.4.10 *

• critical 9.1 WP Booking System

  Missing authorization check

  CVE-2026-116557 · affected 2.1.0.5 and older · fixed in 2.1.0.6 *

• medium 6.4 WP Job Portal

  Stored cross-site scripting (XSS)

  CVE-2026-116546 · affected 2.7.0 and older · fixed in 2.7.1 *

• critical 9.8 PDF Invoice for WooCommerce + Drag and Drop Te…

  PHP object injection

  CVE-2026-109220 · affected 7.1.1 and older · fixed in 7.2.0 *

• high 7.2 W3 Total Cache

  Stored cross-site scripting (XSS)

  CVE-2026-111254 · affected 2.10.7 and older · fixed in 2.11.0 *

• medium 6.1 Webmention

  Stored cross-site scripting (XSS)

  CVE-2026-111109 · affected 5.10.1 and older · fixed in 5.10.2 *

• medium 5.4 Revopic

  Path traversal / file read

  CVE-2026-110251 · affected 1.2.31 and older · fix not stated

• medium 5.3 PDF Invoices & Packing Slips for WooCommerce

  Information disclosure

  CVE-2026-109217 · affected 5.16.5 and older · fixed in 5.16.6 *

• medium 4.3 Hustle

  Missing authorization check

  CVE-2026-109386 · affected 7.8.14.3 and older · fixed in 7.8.14.4 *

• medium 6.4 Discussion Board

  Stored cross-site scripting (XSS)

  CVE-2026-107765 · affected 2.6.0 and older · fixed in 2.6.1 *

• high 7.2 PDF Invoices & Packing Slips for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2026-107750 · affected 5.16.4 and older · fixed in 5.16.5 *

• high 7.2 SureCart

  Stored cross-site scripting (XSS)

  CVE-2026-107653 · affected 4.9.4 and older · fixed in 4.9.5 *

• medium 6.5 Spectra Legacy

  Missing authorization check

  CVE-2026-92294 · affected 2.20.4 and older · fixed in 2.20.5 *

• medium 5.3 All-in-One Video Gallery

  Information disclosure

  CVE-2026-118629 · affected older than 5.0.0 · fixed in 5.0.0

• high 7.5 Mapster WP Maps

  Missing authorization check

  CVE-2026-118638 · affected older than 2.0.6 · fixed in 2.0.6

• medium 5.3 Quick Event Manager

  Information disclosure

  CVE-2026-82214 · affected 8.4.6 up to (not including) 9.19 · fixed in 9.19

• high 8.1 WordPress

  Remote code execution

  CVE-2026-119977 · affected 4.7.0 to 4.7.38, 4.8.0 to 4.8.33, 4.9.0 to 4.9.34, 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, 5.4.0 to 5.4.24, 5.5.0 to 5.5.23, 5.6.0 to 5.6.22, 5.7.0 to 5.7.20, 5.8.0 to 5.8.18, 5.9.0 to 5.9.19, 6.0.0 to 6.0.17, 6.1.0 to 6.1.15, 6.2.0 to 6.2.14, 6.3.0 to 6.3.13, 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3 · fix not stated

• low 3.7 BuddyForms

  Missing authorization check

  CVE-2026-118437 · affected 2.8.8 up to (not including) 2.10.1 · fixed in 2.10.1

• medium 6.8 Firelight Lightbox

  Cross-site scripting (XSS)

  CVE-2026-118438 · affected older than 2.3.24 · fixed in 2.3.24

• high 7.5 Security Optimizer

  Authentication bypass

  CVE-2026-118185 · affected older than 1.6.9 · fixed in 1.6.9

• medium 5.3 Premium Packages

  Missing authorization check

  CVE-2026-118184 · affected older than 7.2.2 · fixed in 7.2.2

• medium 4.2 Essential Addons for Elementor

  Privilege escalation

  CVE-2026-110808 · affected 6.6.0 up to (not including) 6.8.8 · fixed in 6.8.8

• medium 5.4 Photo Gallery, Sliders, Proofing and Themes

  DOM-based cross-site scripting (XSS)

  CVE-2026-116563 · affected 4.5.4 and older · fixed in 4.5.5 *

• high 7.2 PPWP

  Stored cross-site scripting (XSS)

  CVE-2026-116520 · affected 1.9.26 and older · fixed in 1.9.27 *

• medium 4.9 Payment Forms for Paystack

  Information disclosure

  CVE-2026-110042 · affected older than 4.0.6 · fixed in 4.0.6

• high 7.2 Meow Lightbox

  Stored cross-site scripting (XSS)

  CVE-2026-109234 · affected 5.6.4 and older · fixed in 5.6.5 *

• high 7.2 Ninja Forms

  Stored cross-site scripting (XSS)

  CVE-2026-109997 · affected 3.15.5 and older · fixed in 3.15.6 *

• medium 5.4 Ninja Forms

  Remote code execution

  CVE-2026-101326 · affected 3.15.5 and older · fixed in 3.15.6 *

• medium 6.5 Ninja Forms

  Remote code execution

  CVE-2026-100155 · affected 3.15.5 and older · fixed in 3.15.6 *

Friday, October 30, 2026 · 101

• high 7.1 All In One Login

  Cross-site scripting (XSS)

  CVE-2026-94175 · affected 2.4.1 and older · fixed in 2.5.0

• critical 9.8 affects latest 1.25 LeadSnap

  PHP object injection

  CVE-2026-90888 · affected 1.25 and older · no fix listed yet

• high 8.8 affects latest 3.3.10 Solid Testimonials

  PHP object injection

  CVE-2026-78527 · affected 3.3.10 and older · no fix listed yet

• high 8.8 Enable Media Replace

  PHP object injection

  CVE-2026-73186 · affected 4.2.2 and older · fixed in 4.2.3

• medium 5.3 Booktics

  Missing authorization check

  CVE-2026-62122 · affected 1.0.31 and older · fixed in 1.0.32

• medium 6.5 Unlimited Elements for Elementor

  File inclusion

  CVE-2026-62121 · affected 2.0.26 and older · fixed in 2.0.27

• medium 4.3 Bookit

  Missing authorization check

  CVE-2026-62019 · affected 2.6.0.6 and older · fixed in 2.6.0.7

• medium 5.3 CF7 Mate

  Cross-site scripting (XSS)

  CVE-2026-62057 · affected 4.1.0 and older · fixed in 4.1.1

• medium 4.3 Event Tickets and Registration

  Missing authorization check

  CVE-2026-62047 · affected 5.30.2 and older · fixed in 5.30.3

• medium 5.3 FluentCRM

  Missing authorization check

  CVE-2026-62056 · affected 3.2.6 and older · fixed in 3.3.0

• medium 4.3 Unlimited Elements for Elementor

  Missing authorization check

  CVE-2026-62023 · affected 2.0.26 and older · fixed in 2.0.27

• high 7.1 User Profile Builder

  Cross-site scripting (XSS)

  CVE-2026-54855 · affected 4.0.5 and older · fixed in 4.0.6

• medium 6.3 User Profile Builder

  Privilege escalation

  CVE-2026-54854 · affected 4.0.5 and older · fixed in 4.0.6

• medium 6.5 Booking and Rental Manager for Bike

  Missing authorization check

  CVE-2026-54850 · affected 2.8.2 and older · fixed in 2.8.3

• high 7.1 Fast Velocity Minify

  Cross-site scripting (XSS)

  CVE-2026-48201 · affected 3.5.7 and older · fixed in 3.5.8

• medium 5.3 GIFTiT

  Cross-site scripting (XSS)

  CVE-2026-52710 · affected 4.5 and older · fixed in 4.6

• high 7.1 BA Book Everything

  Cross-site scripting (XSS)

  CVE-2026-39786 · affected 1.8.33 and older · fixed in 1.8.34

• medium 6.5 Ultimate Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-39739 · affected 2.9.5 and older · fixed in 2.9.6

• critical 9.3 Transliterator

  SQL injection

  CVE-2026-39732 · affected 2.5.13 and older · fixed in 2.5.14

• high 7.5 WP Easy Pay

  Path traversal / file read

  CVE-2026-39734 · affected 4.5.4 and older · fixed in 4.5.5

• critical 9.8 FunnelKit Automations

  PHP object injection

  CVE-2026-39738 · affected 3.8.6.1 and older · fixed in 3.8.6.2

• medium 6.5 User Registration & Membership

  Cross-site scripting (XSS)

  CVE-2026-27061 · affected 5.3.0 and older · fixed in 5.3.1

• high 7.1 VikRentCar Car Rental Management System

  Stored cross-site scripting (XSS)

  CVE-2026-28160 · affected 1.4.10 and older · fixed in 1.4.11

• high 7.2 Product Feed Manager for WooCommerce

  PHP object injection

  CVE-2026-118089 · affected 7.14.1 and older · fixed in 7.14.2

• high 8.8 MasterStudy LMS WordPress Plugin

  PHP object injection

  CVE-2026-118090 · affected 3.7.55 and older · fixed in 3.7.56

• high 8.8 affects latest 6.5.2 WP BASE Booking of Appointments, Services and…

  Privilege escalation

  CVE-2026-118086 · affected 6.5.2 and older · no fix listed yet

• medium 6.5 WP Customer Area

  Cross-site scripting (XSS)

  CVE-2026-116854 · affected 8.4.0 and older · fixed in 8.4.1

• high 7.5 Flexible Chat

  Information disclosure

  CVE-2026-116861 · affected 1.1.0 and older · fixed in 1.1.1

• medium 6.5 GiveWP

  Missing authorization check

  CVE-2026-116853 · affected 4.19.0.1 and older · fixed in 4.19.0.2

• critical 9.1 Widget Options

  Remote code execution

  CVE-2026-116852 · affected 4.2.5 and older · fixed in 4.2.6

• high 7.5 WP REST Cache

  Missing authorization check

  CVE-2026-116862 · affected 2026.3.1 and older · fixed in 2026.4.0

• high 7.1 eCommerce Product Catalog

  Cross-site scripting (XSS)

  CVE-2026-116851 · affected 3.6.5 and older · fixed in 3.6.6

• medium 6.5 Masteriyo LMS

  Missing authorization check

  CVE-2026-116410 · affected 3.4.3 and older · fixed in 3.5.0

• high 7.1 Mang Board

  Cross-site scripting (XSS)

  CVE-2026-116847 · affected 2.4.6 and older · fixed in 2.4.7

• high 7.1 VikRentCar Car Rental Management System

  Cross-site scripting (XSS)

  CVE-2026-116405 · affected 1.4.9 and older · fixed in 1.4.10

• critical 9.8 SMS Alert

  Privilege escalation

  CVE-2026-116386 · affected 4.0.2 and older · fixed in 4.0.3

• high 7.5 HUSKY

  Missing authorization check

  CVE-2026-116401 · affected 1.4.6 and older · fixed in 1.4.7

• medium 6.5 HUSKY

  Information disclosure

  CVE-2026-115947 · affected 1.4.6 and older · fixed in 1.4.7

• medium 6.5 MultiVendorX

  Cross-site scripting (XSS)

  CVE-2026-114711 · affected 5.0.20 and older · fixed in 5.0.21

• medium 5.0 SureDash

  Arbitrary file deletion

  CVE-2026-115604 · affected 1.12.3 and older · fixed in 1.12.4

• medium 5.3 YITH WooCommerce Product Add-Ons

  Missing authorization check

  CVE-2026-107868 · affected 4.34.0 and older · fixed in 4.34.1

• high 7.1 Ad Inserter

  Cross-site scripting (XSS)

  CVE-2026-105077 · affected 2.8.19 and older · fixed in 2.8.20

• medium 4.3 Booktics

  Missing authorization check

  CVE-2026-104674 · affected 1.0.31 and older · fixed in 1.0.32

• high 7.2 ERP

  Stored cross-site scripting (XSS)

  CVE-2026-96894 · affected 1.17.10 and older · fixed in 1.17.11 *

• high 7.5 Forminator Forms

  Missing authorization check

  CVE-2026-97638 · affected 1.57.3.1 and older · fixed in 1.58.0 *

• medium 6.4 Meow Gallery

  Stored cross-site scripting (XSS)

  CVE-2026-9239 · affected 5.5.1 and older · fixed in 5.5.2 *

• high 7.5 Photo Gallery, Sliders, Proofing and Themes

  Arbitrary file upload

  CVE-2026-76012 · affected 4.4.1 and older · fixed in 4.5.0 *

• medium 6.5 Meow Gallery

  Missing authorization check

  CVE-2026-13747 · affected 5.5.4 and older · fixed in 5.5.5 *

• medium 6.4 CP Multi View Events Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-119176 · affected 1.4.43 and older · fixed in 1.4.44 *

• medium 6.4 GeoDirectory

  Stored cross-site scripting (XSS)

  CVE-2026-119113 · affected 2.8.199 and older · fixed in 2.8.200 *

• high 7.4 Essential Addons for Elementor

  Privilege escalation

  CVE-2026-118205 · affected 6.8.7 and older · fixed in 6.8.8 *

• medium 6.5 GeoDirectory

  Remote code execution

  CVE-2026-118635 · affected 2.8.198 and older · fixed in 2.8.199 *

• medium 4.7 Like Button Rating ♥ LikeBtn

  Stored cross-site scripting (XSS)

  CVE-2026-116552 · affected 2.6.64 and older · fixed in 2.6.65 *

• medium 6.5 Majestic Support

  SQL injection

  CVE-2026-115820 · affected 1.2.2 and older · fixed in 1.2.3 *

• medium 6.4 Themify Builder

  Stored cross-site scripting (XSS)

  CVE-2026-115869 · affected 7.8.4 and older · fixed in 7.8.5 *

• high 7.5 Advanced Custom Fields

  Information disclosure

  CVE-2026-110305 · affected 0.9.2.7 and older · fixed in 0.9.2.8 *

• high 7.2 easy.jobs

  Stored cross-site scripting (XSS)

  CVE-2026-112365 · affected 2.8.4 and older · fixed in 2.8.5 *

• medium 6.4 FV Flowplayer Video Player

  Stored cross-site scripting (XSS)

  CVE-2026-110533 · affected 7.5.55.7212 and older · fix not stated

• medium 4.3 OpenStation

  Missing authorization check

  CVE-2026-109592 · affected 1.1.16 and older · fixed in 1.1.17 *

• high 7.5 Email Templates Customizer and Designer for Wo…

  Missing authorization check

  CVE-2026-107630 · affected 1.5.14 and older · fixed in 1.5.15 *

• medium 5.4 FV Flowplayer Video Player

  Stored cross-site scripting (XSS)

  CVE-2026-110001 · affected 7.5.55.7212 and older · fix not stated

• medium 5.4 FV Flowplayer Video Player

  Stored cross-site scripting (XSS)

  CVE-2026-109984 · affected 7.5.55.7212 and older · fix not stated

• medium 4.9 JS Help Desk

  Arbitrary file deletion

  CVE-2026-104739 · affected 5.0.1 and older · fixed in 5.0.2 *

• medium 6.5 Ad Inserter

  Remote code execution

  CVE-2026-102905 · affected 2.8.19 and older · fixed in 2.8.20 *

• medium 6.4 Redux Framework

  Stored cross-site scripting (XSS)

  CVE-2026-102918 · affected 4.5.15 and older · fixed in 4.5.16 *

• high 8.7 Database Cleaner

  Missing authorization check

  CVE-2025-8574 · affected 1.4.7 and older · fixed in 1.4.8 *

• high 8.8 AI Engine

  Cross-site request forgery (CSRF)

  CVE-2026-65566 · affected 3.8.8 and older · fixed in 3.8.9

• medium 4.3 Event Tickets and Registration

  Missing authorization check

  CVE-2026-62055 · affected 5.30.2 and older · fixed in 5.30.3

• medium 5.4 WC Shop Sync

  Cross-site request forgery (CSRF)

  CVE-2026-119466 · affected 4.7.5 and older · fixed in 4.7.6

• medium 6.5 Media Player Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-119365 · affected 1.1.10 and older · fixed in 1.1.11

• medium 5.4 The Events Calendar

  Missing authorization check

  CVE-2026-119367 · affected 6.18.2 and older · fixed in 6.18.3

• medium 5.4 FluentCRM

  Missing authorization check

  CVE-2026-62141 · affected 3.2.6 and older · fixed in 3.3.0

• medium 5.3 JetFormBuilder

  Cross-site scripting (XSS)

  CVE-2026-119479 · affected 3.6.7.1 and older · fixed in 3.6.8

• medium 6.5 The Events Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-119369 · affected 6.18.2 and older · fixed in 6.18.3

• medium 5.4 Easy Appointment Booking & Scheduling Plugin

  Missing authorization check

  CVE-2026-116407 · affected 6.5.4 and older · fixed in 6.5.5

• medium 6.5 Blocksy Companion

  Stored cross-site scripting (XSS)

  CVE-2026-65444 · affected 2.1.60 and older · fixed in 2.1.61

• medium 5.3 JetFormBuilder

  Missing authorization check

  CVE-2026-119482 · affected 3.6.7.1 and older · fixed in 3.6.8

• medium 6.5 The Events Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-119370 · affected 6.18.2 and older · fixed in 6.18.3

• medium 5.3 The Events Calendar

  Missing authorization check

  CVE-2026-119368 · affected 6.18.2 and older · fixed in 6.18.3

• medium 5.3 Timetics

  Missing authorization check

  CVE-2026-116860 · affected 1.0.65 and older · fixed in 1.0.66

• high 8.8 Formidable Forms

  Content injection

  CVE-2026-89435 · affected 6.35 and older · fixed in 7.0 *

• high 7.2 Food Store

  Stored cross-site scripting (XSS)

  CVE-2026-116622 · affected 1.5.5 and older · fix not stated

• high 7.5 AI Engine

  Missing authorization check

  CVE-2026-110732 · affected 3.8.6 and older · fixed in 3.8.7 *

• medium 4.3 Content Egg

  Missing authorization check

  CVE-2026-119087 · affected 12.0.0 and older · fixed in 12.1.0 *

• medium 4.3 Content Egg

  Missing authorization check

  CVE-2026-119059 · affected 12.0.0 and older · fixed in 12.1.0 *

• medium 6.5 JoomSport

  SQL injection

  CVE-2026-118698 · affected 5.7.14 and older · fixed in 5.7.15 *

• medium 6.8 Firelight Lightbox

  Stored cross-site scripting (XSS)

  CVE-2026-118165 · affected older than 2.3.23 · fixed in 2.3.23

• medium 6.4 Events Made Easy

  Stored cross-site scripting (XSS)

  CVE-2026-118634 · affected 3.3.1 and older · fixed in 3.3.2 *

• medium 6.4 Cool FormKit Lite

  DOM-based cross-site scripting (XSS)

  CVE-2026-118500 · affected 2.7.9 and older · fixed in 2.7.10 *

• medium 6.5 Page and Post Restriction

  Authentication bypass

  CVE-2026-118194 · affected 1.6.1 and older · fixed in 1.6.2 *

• medium 5.3 BuddyForms

  Missing authorization check

  CVE-2026-118101 · affected older than 2.10.1 · fixed in 2.10.1

• medium 5.3 BuddyForms

  Information disclosure

  CVE-2026-118100 · affected older than 2.10.3 · fixed in 2.10.3

• medium 5.4 Fraud Prevention For WooCommerce and EDD

  Missing authorization check

  CVE-2026-118072 · affected older than 2.3.6 · fixed in 2.3.6

• medium 4.1 WP Visitor Statistics (Real Time Traffic)

  SQL injection

  CVE-2026-117572 · affected older than 8.8 · fixed in 8.8

• high 8.8 WP Visitor Statistics (Real Time Traffic)

  Cross-site scripting (XSS)

  CVE-2026-117571 · affected older than 8.8 · fixed in 8.8

• medium 4.4 Security Plugin, Firewall & Malware Scanner wi…

  Information disclosure

  CVE-2026-114444 · affected older than 2.191 · fixed in 2.191

• high 7.5 Security Plugin, Firewall & Malware Scanner wi…

  Authentication bypass

  CVE-2026-114443 · affected older than 2.191 · fixed in 2.191

• medium 4.7 User Frontend

  Reflected cross-site scripting (XSS)

  CVE-2026-115277 · affected older than 4.3.14 · fixed in 4.3.14

• high 7.5 Enable Media Replace

  PHP object injection

  CVE-2026-114422 · affected 4.1.4 up to (not including) 4.2.3 · fixed in 4.2.3

• medium 6.5 Forminator Forms

  Security issue

  CVE-2026-5461 · affected 1.55.0.2 and older · fixed in 1.55.1 *

• high 8.8 Export and Import Users and Customers

  Privilege escalation

  CVE-2026-104368 · affected 2.7.5 and older · fixed in 2.7.6 *

Thursday, October 29, 2026 · 142

• critical 9.8 Zoho Flow

  PHP object injection

  CVE-2026-62131 · affected 2.14.5 and older · fixed in 2.14.6 *

• high 7.1 affects latest 3.11.0 Bitcoin Payments

  Cross-site scripting (XSS)

  CVE-2026-61993 · affected 3.11.0 only · no fix listed yet

• high 7.1 affects latest 4.1.0 Video Gallery

  Cross-site scripting (XSS)

  CVE-2026-61995 · affected 4.1.0 and older · no fix listed yet

• high 7.1 Auction Nudge

  Cross-site scripting (XSS)

  CVE-2026-61988 · affected 8.4.0 and older · fix not stated

• high 7.1 Easy Property Listings

  Cross-site scripting (XSS)

  CVE-2026-61989 · affected 3.5.25 and older · fixed in 3.5.26

• critical 9.8 GEO my WP

  PHP object injection

  CVE-2026-61992 · affected 4.5.5.3 and older · fixed in 4.5.5.4

• medium 6.5 Podamibe Custom User Gravatar

  Cross-site scripting (XSS)

  CVE-2026-54865 · affected 1.0.8 and older · fix not stated

• high 7.1 Razorpay Payment Button Elementor Plugin

  Cross-site scripting (XSS)

  CVE-2026-54866 · affected 1.2.8 and older · fix not stated

• high 7.1 affects latest 1.165 Cincopa video and media plug-in

  Cross-site scripting (XSS)

  CVE-2026-54864 · affected 1.165 and older · no fix listed yet

• medium 5.3 Document Library Lite

  Information disclosure

  CVE-2026-48200 · affected 1.3.0 and older · fixed in 1.3.1

• medium 4.3 Kirki

  Cross-site scripting (XSS)

  CVE-2026-42694 · affected 6.4.0 and older · fixed in 6.4.1

• medium 5.4 LearnPress

  Missing authorization check

  CVE-2026-42690 · affected 4.4.10 and older · fixed in 4.4.11

• high 7.1 affects latest 2.2.2 WP Crowdfunding

  Cross-site scripting (XSS)

  CVE-2026-42692 · affected 2.2.2 and older · no fix listed yet

• high 7.2 YayMail

  PHP object injection

  CVE-2026-42701 · affected 4.4.6 and older · fixed in 4.4.7

• high 7.1 Eventer

  Cross-site scripting (XSS)

  CVE-2026-27394 · affected 0.1.1 and older · fix not stated

• high 7.1 affects latest 1.23.3 GlobalPayments Gateway Provider for WooCommerce

  Cross-site scripting (XSS)

  CVE-2026-118085 · affected 1.23.3 and older · no fix listed yet

• medium 6.5 Hotel Booking

  Missing authorization check

  CVE-2026-118084 · affected 3.8 and older · fix not stated

• high 7.5 affects latest 2.2.2 WP Crowdfunding

  Information disclosure

  CVE-2026-118083 · affected 2.2.2 and older · no fix listed yet

• high 7.2 affects latest 2.21.0 Finale Lite

  PHP object injection

  CVE-2026-118074 · affected 2.21.0 and older · no fix listed yet

• high 7.2 FV Flowplayer Video Player

  PHP object injection

  CVE-2026-118079 · affected 7.5.56.7212 and older · fixed in 7.5.57.7212

• high 7.2 Product Catalog Feed by PixelYourSite

  PHP object injection

  CVE-2026-118078 · affected 3.1.4 and older · fix not stated

• high 8.8 Frisbii Pay

  PHP object injection

  CVE-2026-118076 · affected 1.8.19 and older · fixed in 1.8.20 *

• high 7.2 Spexo Addons for Elementor

  PHP object injection

  CVE-2026-118077 · affected 1.2.3 and older · fix not stated

• high 8.8 Social Snap

  PHP object injection

  CVE-2026-118080 · affected 1.5.4 and older · fix not stated

• high 8.8 10WebSocial

  PHP object injection

  CVE-2026-118081 · affected 1.5.6 and older · fix not stated

• high 8.8 WP Media folders

  PHP object injection

  CVE-2026-118075 · affected 1.1.10 and older · fix not stated

• high 8.8 affects latest 1.3.1 BuddyPress Xprofile Custom Field Types

  PHP object injection

  CVE-2026-116868 · affected 1.3.1 and older · no fix listed yet

• high 8.8 affects latest 1.0.1 Dynamic QR Code

  PHP object injection

  CVE-2026-116867 · affected 1.0.1 and older · no fix listed yet

• high 7.2 affects latest 1.4.5 myPOS Checkout

  PHP object injection

  CVE-2026-116869 · affected 1.4.5 and older · no fix listed yet

• high 8.8 affects latest 1.5.0 News Kit Addons For Elementor

  PHP object injection

  CVE-2026-118073 · affected 1.5.0 and older · no fix listed yet

• high 8.8 affects latest 4.4.0 Extra Fees for WooCommerce

  PHP object injection

  CVE-2026-116866 · affected 4.4.0 and older · no fix listed yet

• high 7.2 WPCargo Track & Trace

  PHP object injection

  CVE-2026-116864 · affected 8.0.5 and older · fixed in 8.0.6 *

• high 7.2 affects latest 1.7.0 Zippy

  PHP object injection

  CVE-2026-116865 · affected 1.7.0 and older · no fix listed yet

• medium 6.5 The Plus Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-116848 · affected 6.5.3 and older · fixed in 6.6.0

• high 7.1 Chained Quiz

  Cross-site scripting (XSS)

  CVE-2026-108494 · affected 1.4.1 and older · fixed in 1.4.2

• medium 6.4 HappyAddons for Elementor

  Missing authorization check

  CVE-2026-109891 · affected 3.50.1 and older · fixed in 3.51.0

• medium 5.3 Points Management System For Gamification, Ran…

  Missing authorization check

  CVE-2026-97073 · affected 4.0.2 and older · fixed in 4.0.3

• medium 5.4 EventPrime

  Missing authorization check

  CVE-2026-42691 · affected 4.3.6.0 and older · fixed in 4.3.6.1

• medium 5.3 Page and Post Restriction

  Missing authorization check

  CVE-2026-54852 · affected 1.6.1 and older · fixed in 1.6.2

• medium 5.3 User Profile Builder

  Missing authorization check

  CVE-2026-54853 · affected 4.0.5 and older · fixed in 4.0.6

• medium 5.3 ShopBuilder

  Missing authorization check

  CVE-2026-54871 · affected 3.4.2 and older · fixed in 3.4.3

• medium 4.3 User Frontend

  Missing authorization check

  CVE-2026-52708 · affected 4.3.13 and older · fixed in 4.3.14

• medium 5.3 User Frontend

  Missing authorization check

  CVE-2026-48884 · affected 4.3.13 and older · fixed in 4.3.14

• medium 5.3 Kit (formerly ConvertKit)

  Missing authorization check

  CVE-2026-27063 · affected 3.4.7 and older · fixed in 3.4.8

• medium 4.3 ERP

  Missing authorization check

  CVE-2026-25448 · affected 1.17.10 and older · fixed in 1.17.11

• medium 6.5 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2026-39742 · affected 3.8.0.2 and older · fixed in 3.8.1

• medium 5.3 User Registration & Membership

  Missing authorization check

  CVE-2026-25450 · affected 5.3.0 and older · fixed in 5.3.1

• medium 4.3 WPFunnels

  Cross-site request forgery (CSRF)

  CVE-2026-27062 · affected 3.13.5 and older · fixed in 3.13.6

• medium 6.5 HTML5 Video Player

  Stored cross-site scripting (XSS)

  CVE-2026-118097 · affected 2.14.0 and older · fixed in 2.14.1

• medium 4.3 MasterStudy LMS WordPress Plugin

  Missing authorization check

  CVE-2026-118092 · affected 3.7.55 and older · fixed in 3.7.56

• medium 6.5 Media Library Assistant

  Cross-site scripting (XSS)

  CVE-2026-118095 · affected 3.42 and older · fixed in 3.43

• medium 5.3 Flexible Quantity & Price Calculator for WooCo…

  Missing authorization check

  CVE-2026-116856 · affected 2.3.24 and older · fixed in 2.3.25

• medium 6.5 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-116850 · affected 3.50.1 and older · fixed in 3.51.0

• medium 6.5 StreamCast

  Stored cross-site scripting (XSS)

  CVE-2026-116849 · affected 2.4.6 and older · fixed in 2.4.7

• medium 5.3 WP User Manager

  Missing authorization check

  CVE-2026-116846 · affected 2.9.26 and older · fixed in 2.10.0

• medium 5.3 WPFunnels

  Missing authorization check

  CVE-2026-118091 · affected 3.13.5 and older · fixed in 3.13.6

• medium 5.3 WPFunnels

  Missing authorization check

  CVE-2026-118088 · affected 3.13.5 and older · fixed in 3.13.6

• medium 5.3 SureForms

  Missing authorization check

  CVE-2026-116387 · affected 2.12.9 and older · fixed in 2.13.0

• medium 4.3 Easy Appointment Booking & Scheduling Plugin

  Missing authorization check

  CVE-2026-116406 · affected 6.5.4 and older · fixed in 6.5.5

• medium 5.3 Custom Price for WooCommerce

  Missing authorization check

  CVE-2026-115601 · affected 1.1.29 and older · fixed in 1.1.30

• medium 6.5 Co-Authors, Multiple Authors and Guest Authors…

  Stored cross-site scripting (XSS)

  CVE-2026-115610 · affected 4.17.0 and older · fixed in 4.18.0

• medium 4.3 SureDash

  Missing authorization check

  CVE-2026-115605 · affected 1.12.3 and older · fixed in 1.12.4

• medium 5.3 E-cab Taxi Booking Manager for Woocommerce

  Missing authorization check

  CVE-2026-114181 · affected 2.1.6 and older · fixed in 2.1.7

• medium 6.5 Strong Testimonials

  Stored cross-site scripting (XSS)

  CVE-2026-114706 · affected 3.3.15 and older · fixed in 3.3.16

• medium 6.5 SureDash

  Stored cross-site scripting (XSS)

  CVE-2026-110881 · affected 1.12.3 and older · fixed in 1.12.4

• medium 5.3 Brave

  Cross-site scripting (XSS)

  CVE-2026-48202 · affected 0.8.8 and older · fixed in 0.8.9

• medium 6.5 Import and export users and customers

  Stored cross-site scripting (XSS)

  CVE-2026-54862 · affected 2.5.9 and older · fixed in 2.5.10

• medium 4.3 HivePress Claim Listings

  Missing authorization check

  CVE-2026-42707 · affected 1.1.4 and older · fixed in 1.1.5

• medium 6.5 PDF Poster

  Stored cross-site scripting (XSS)

  CVE-2026-48195 · affected 2.6.1 and older · fixed in 2.6.2

• medium 5.3 Kali Forms

  Missing authorization check

  CVE-2026-39782 · affected 2.4.27 and older · fixed in 2.4.28

• medium 5.3 User Registration & Membership

  Cross-site scripting (XSS)

  CVE-2026-25467 · affected 5.3.0 and older · fixed in 5.3.1

• high 8.8 InstaWP Connect

  Cross-site request forgery (CSRF)

  CVE-2026-116399 · affected 0.1.4.2 and older · fixed in 0.1.4.3

• medium 5.3 SureForms

  Cross-site scripting (XSS)

  CVE-2026-116402 · affected 2.12.9 and older · fixed in 2.13.0

• medium 6.5 The Post Grid

  Stored cross-site scripting (XSS)

  CVE-2026-56056 · affected 7.9.7 and older · fixed in 7.9.8

• medium 6.5 Video Gallery Block

  Stored cross-site scripting (XSS)

  CVE-2026-52709 · affected 1.6.0 and older · fixed in 1.7.0

• medium 6.5 Kali Forms

  Stored cross-site scripting (XSS)

  CVE-2026-48196 · affected 2.4.27 and older · fixed in 2.4.28

• medium 6.5 Kali Forms

  Missing authorization check

  CVE-2026-42703 · affected 2.4.27 and older · fixed in 2.4.28

• medium 5.3 Simple CAPTCHA with Cloudflare Turnstile

  Missing authorization check

  CVE-2026-39741 · affected 1.44.0 and older · fixed in 1.44.1

• medium 6.5 Cozy Blocks

  Stored cross-site scripting (XSS)

  CVE-2026-24533 · affected 2.2.27 and older · fixed in 2.2.28

• medium 4.3 WP Job Portal

  Missing authorization check

  CVE-2026-22386 · affected 2.7.1 and older · fixed in 2.7.2

• medium 6.5 Ad Inserter

  Stored cross-site scripting (XSS)

  CVE-2026-118094 · affected 2.8.18 and older · fixed in 2.8.19

• medium 5.3 Product Feed Manager for WooCommerce

  Missing authorization check

  CVE-2026-118093 · affected 7.14.1 and older · fixed in 7.14.2

• medium 6.5 Site Reviews

  Stored cross-site scripting (XSS)

  CVE-2026-118087 · affected 8.3.5 and older · fixed in 8.3.6

• medium 5.3 MW WP Form

  Information disclosure

  CVE-2026-92086 · affected 5.1.7 and older · fixed in 5.1.8 *

• high 7.2 NEX-Forms

  Stored cross-site scripting (XSS)

  CVE-2026-96767 · affected 9.3.2 and older · fixed in 9.3.3 *

• medium 5.3 YITH PayPal Express Checkout for WooCommerce

  Missing authorization check

  CVE-2026-27401 · affected 1.62.0 and older · fixed in 1.62.1

• high 7.2 NewsmanApp

  Stored cross-site scripting (XSS)

  CVE-2026-115821 · affected 3.7.29 and older · fixed in 3.7.32 *

• medium 4.9 Meta Box

  Stored cross-site scripting (XSS)

  CVE-2026-109216 · affected 5.15.2 and older · fixed in 5.15.3 *

• high 8.5 BuddyPress

  SQL injection

  CVE-2026-115965 · affected 14.5.2 and older · fixed in 14.5.3

• high 8.8 OTP Login With Phone Number, OTP Verification

  Security issue

  CVE-2026-115967 · affected 1.8.78 and older · fixed in 1.8.79

• critical 9.3 Motors

  SQL injection

  CVE-2026-115964 · affected 1.4.126 and older · fixed in 1.4.127

• high 7.1 Upsell Funnel Builder for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2026-116409 · affected 3.1.6 and older · fixed in 3.1.7 *

• high 7.1 Broadcast Live Video

  Missing authorization check

  CVE-2026-115963 · affected 7.3.9 and older · fixed in 7.3.12

• high 7.5 LearnPress

  Missing authorization check

  CVE-2026-115599 · affected 4.4.11 and older · fixed in 4.4.12

• medium 4.3 Points Management System For Gamification, Ran…

  Authentication bypass

  CVE-2026-115962 · affected 4.0.1 and older · fixed in 4.0.2

• high 7.1 TableOn

  Reflected cross-site scripting (XSS)

  CVE-2026-115611 · affected 1.0.7 and older · fixed in 1.0.8

• high 7.5 GEO my WP

  Missing authorization check

  CVE-2026-114193 · affected 4.5.5.5 and older · fixed in 4.5.5.7

• high 7.1 HANDMADE

  Missing authorization check

  CVE-2026-112827 · affected 1.0.10 and older · fixed in 1.0.11

• medium 5.3 Everest Forms

  Information disclosure

  CVE-2026-91153 · affected 3.6.2 and older · fixed in 3.6.3 *

• medium 6.1 Everest Forms

  Reflected cross-site scripting (XSS)

  CVE-2026-91152 · affected 3.6.2 and older · fixed in 3.6.3 *

• medium 5.4 HT Mega Addons for Elementor

  DOM-based cross-site scripting (XSS)

  CVE-2026-111318 · affected 3.2.7 and older · fixed in 3.2.8 *

• medium 6.5 JoomSport

  SQL injection

  CVE-2026-118192 · affected 5.7.11 and older · fixed in 5.7.14 *

• medium 5.4 LiteSpeed Cache

  Stored cross-site scripting (XSS)

  CVE-2026-116763 · affected 7.9.1 and older · fixed in 7.9.2 *

• medium 4.7 RSS Aggregator by Feedzy

  Stored cross-site scripting (XSS)

  CVE-2026-110707 · affected 5.2.12 and older · fixed in 5.2.13 *

• medium 5.4 Greenshift

  DOM-based cross-site scripting (XSS)

  CVE-2026-107629 · affected 13.2.1 and older · fixed in 13.2.2 *

• medium 5.4 Greenshift

  DOM-based cross-site scripting (XSS)

  CVE-2026-107627 · affected 13.2.1 and older · fixed in 13.2.2 *

• medium 6.4 LiteSpeed Cache

  Stored cross-site scripting (XSS)

  CVE-2026-109215 · affected 7.9.1 and older · fixed in 7.9.2 *

• high 7.2 Mapster WP Maps

  Stored cross-site scripting (XSS)

  CVE-2026-107743 · affected 2.0.5 and older · fixed in 2.0.6 *

• medium 6.4 Sequential Order Numbers for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2026-104727 · affected 3.6.5 and older · fixed in 3.7 *

• medium 4.7 Media Library Assistant

  Reflected cross-site scripting (XSS)

  CVE-2026-103875 · affected 3.42 and older · fixed in 3.43 *

• medium 5.4 Extensions for Leaflet Map

  DOM-based cross-site scripting (XSS)

  CVE-2026-103485 · affected 5.4 and older · fixed in 6.0 *

• low 3.7 Contact Form by Supsystic

  Security issue

  CVE-2026-115303 · affected older than 1.11.1 · fixed in 1.11.1

• high 8.8 Community Events

  Cross-site scripting (XSS)

  CVE-2026-86794 · affected 1.4.9 up to (not including) 1.6.0 · fixed in 1.6.0

• medium 5.3 Link Library

  Information disclosure

  CVE-2026-78396 · affected older than 7.10.0 · fixed in 7.10.0

• medium 5.3 Link Library

  Missing authorization check

  CVE-2026-78395 · affected older than 7.10.0 · fixed in 7.10.0

• medium 6.4 Password Protected

  Stored cross-site scripting (XSS)

  CVE-2026-93293 · affected 2.8.4 and older · fixed in 2.8.5 *

• medium 6.5 PAYCOMET for WooCommerce

  Authentication bypass

  CVE-2026-88928 · affected 5.36 up to (not including) 5.46 · fixed in 5.46

• low 3.8 Video Player for YouTube

  Missing authorization check

  CVE-2026-85007 · affected older than 2.1.4 · fixed in 2.1.4

• medium 5.3 Contact Form by Supsystic

  Missing authorization check

  CVE-2026-115302 · affected older than 1.11.1 · fixed in 1.11.1

• high 7.2 Contact Form by Supsystic

  Remote code execution

  CVE-2026-115301 · affected older than 1.11.1 · fixed in 1.11.1

• medium 4.3 Contact Form by Supsystic

  Cross-site request forgery (CSRF)

  CVE-2026-115300 · affected older than 1.11.1 · fixed in 1.11.1

• medium 5.4 Contact Form by Supsystic

  Cross-site request forgery (CSRF)

  CVE-2026-115299 · affected older than 1.11.1 · fixed in 1.11.1

• medium 5.3 Recipe Card Blocks Lite

  Information disclosure

  CVE-2026-115282 · affected 2.6.4 up to (not including) 3.6.4 · fixed in 3.6.4

• medium 4.9 Photo Engine (Media Organizer & Lightroom)

  Missing authorization check

  CVE-2026-115259 · affected older than 6.6.0 · fixed in 6.6.0

• high 7.5 All-In-One Security (AIOS)

  Authentication bypass

  CVE-2026-111739 · affected older than 5.5.0 · fixed in 5.5.0

• medium 6.8 Enable SVG, WebP, and ICO Upload

  Stored cross-site scripting (XSS)

  CVE-2026-110505 · affected older than 1.1.6 · fixed in 1.1.6

• medium 6.8 Enable SVG, WebP, and ICO Upload

  Stored cross-site scripting (XSS)

  CVE-2026-110504 · affected 1.1.3 up to (not including) 1.1.6 · fixed in 1.1.6

• medium 5.3 GeoDirectory

  Information disclosure

  CVE-2026-114270 · affected older than 2.8.197 · fixed in 2.8.197

• medium 4.3 WP Photo Album Plus

  Cross-site request forgery (CSRF)

  CVE-2026-110983 · affected older than 9.3.04.004 · fixed in 9.3.04.004

• critical 9.0 Frontend Dashboard

  PHP object injection

  CVE-2026-103693 · affected older than 3.0.5 · fixed in 3.0.5

• low 3.5 Appointment Booking Plugin

  Cross-site scripting (XSS)

  CVE-2026-105258 · affected older than 5.7.6 · fixed in 5.7.6

• medium 4.3 Wallet System for WooCommerce

  Missing authorization check

  CVE-2026-108763 · affected older than 2.8.2 · fixed in 2.8.2

• low 3.7 WP Post Author

  Information disclosure

  CVE-2026-108686 · affected older than 4.2.0 · fixed in 4.2.0

• low 3.7 WP Post Author

  Missing authorization check

  CVE-2026-108685 · affected older than 4.2.0 · fixed in 4.2.0

• high 7.2 DSGVO All in one for WP

  Stored cross-site scripting (XSS)

  CVE-2026-96741 · affected 5.0 and older · fix not stated

• high 7.2 Food Store

  Stored cross-site scripting (XSS)

  CVE-2026-96669 · affected 1.5.5 and older · fix not stated

• high 7.2 Schema App Structured Data

  Stored cross-site scripting (XSS)

  CVE-2026-96666 · affected 2.3.2 and older · fix not stated

• high 8.1 SSL Wireless SMS Notification

  Authentication bypass

  CVE-2026-96228 · affected 3.8.1 and older · fix not stated

• high 7.5 Social Web Suite

  SQL injection

  CVE-2026-93904 · affected 4.1.12 and older · fix not stated

• high 7.5 SendPress Newsletters

  SQL injection

  CVE-2026-93855 · affected 1.26.1.20 and older · fix not stated

• high 7.5 Wild Apricot Login

  Authentication bypass

  CVE-2026-93757 · affected 1.0.18 and older · fix not stated

• critical 9.8 Bot for Telegram on WooCommerce

  Authentication bypass

  CVE-2026-109516 · affected 1.3.0 and older · fix not stated

Wednesday, October 28, 2026 · 106

• high 7.2 Filter Everything

  PHP object injection

  CVE-2026-116390 · affected 1.9.7 and older · fixed in 1.9.8 *

• high 8.8 Phoenix Media Rename

  PHP object injection

  CVE-2026-116389 · affected 3.13.5 and older · fixed in 3.13.6 *

• critical 9.8 Ultimate Member

  PHP object injection

  CVE-2026-115968 · affected 2.13.1 and older · fixed in 2.14.0

• high 7.2 Dokan

  PHP object injection

  CVE-2026-115590 · affected 5.3.1 and older · fixed in 5.3.2

• medium 6.5 affects latest 4.5.16 Redux Framework

  Missing authorization check

  CVE-2026-116404 · affected 4.5.16 and older · no fix listed yet

• high 7.2 affects latest 2.3.25 Accordions

  PHP object injection

  CVE-2026-116392 · affected 2.3.25 and older · no fix listed yet

• high 8.8 Logo Slider

  PHP object injection

  CVE-2026-116391 · affected 3.8.9 and older · fixed in 3.9.0

• high 7.1 Payment forms, Buy now buttons, and Invoicing…

  Stored cross-site scripting (XSS)

  CVE-2026-115609 · affected 2.8.62 and older · fixed in 2.8.63

• high 7.5 Optima Express IDX

  Missing authorization check

  CVE-2026-116393 · affected 9.0.0 and older · fixed in 9.0.1 *

• high 7.1 Affiliate Program Suite

  Stored cross-site scripting (XSS)

  CVE-2026-115612 · affected 1.2.13 and older · fixed in 1.2.14

• medium 6.5 Discussion Board

  Stored cross-site scripting (XSS)

  CVE-2026-115957 · affected 2.6.0 and older · fixed in 2.6.1

• high 8.5 BuddyPress

  SQL injection

  CVE-2026-111850 · affected 14.5.2 and older · fixed in 14.5.3

• high 7.5 Contact Form by Supsystic

  Information disclosure

  CVE-2026-115591 · affected 1.10.5 and older · fixed in 1.10.7

• critical 9.3 DXP ToolKit

  SQL injection

  CVE-2026-115607 · affected 2.0.1 and older · fixed in 2.0.2

• high 7.1 DXP ToolKit

  Stored cross-site scripting (XSS)

  CVE-2026-115606 · affected 2.0.1 and older · fixed in 2.0.2

• high 7.1 eCommerce Product Catalog

  Reflected cross-site scripting (XSS)

  CVE-2026-115596 · affected 3.6.4 and older · fixed in 3.6.5

• high 7.1 Unlimited Elements for Elementor

  Reflected cross-site scripting (XSS)

  CVE-2026-115593 · affected 2.0.24 and older · fixed in 2.0.25

• critical 9.3 FunnelKit Automations

  SQL injection

  CVE-2026-111411 · affected 3.8.5.2 and older · fixed in 3.8.6

• medium 5.4 My auctions allegro

  Missing authorization check

  CVE-2026-116855 · affected 4.0.3 and older · fixed in 4.0.4

• medium 5.3 Essential Addons for Elementor

  Missing authorization check

  CVE-2026-110508 · affected 6.7.3 up to (not including) 6.8.7 · fixed in 6.8.7

• medium 4.3 Enable Media Replace

  Missing authorization check

  CVE-2026-85655 · affected 4.2.2 and older · fixed in 4.2.3 *

• medium 6.1 Echo Knowledge Base

  Reflected cross-site scripting (XSS)

  CVE-2026-101935 · affected 17.214.0 and older · fixed in 17.311.0 *

• medium 6.3 BeyondSEO

  Privilege escalation

  CVE-2026-76780 · affected 1.3.6 and older · fixed in 1.3.7 *

• medium 6.1 Webheadcoder Multi-Step Forms for Contact Form 7

  Reflected cross-site scripting (XSS)

  CVE-2026-92098 · affected 4.7 and older · fixed in 4.7.1 *

• medium 6.4 Post Snippets

  Stored cross-site scripting (XSS)

  CVE-2026-77871 · affected 4.2.4 and older · fix not stated

• medium 6.4 Waitlist Woocommerce ( Back in stock notifier )

  Stored cross-site scripting (XSS)

  CVE-2026-77188 · affected 2.9.1 and older · fixed in 2.9.2 *

• medium 5.3 Advanced Custom Fields

  Missing authorization check

  CVE-2026-2839 · affected 0.9.2.7 and older · fixed in 0.9.2.8 *

• medium 6.4 If-So Dynamic Content

  Stored cross-site scripting (XSS)

  CVE-2026-118164 · affected 1.10.2 and older · fixed in 1.10.3 *

• medium 5.3 PayPal Brasil para WooCommerce

  Missing authorization check

  CVE-2026-76058 · affected 1.7.8 and older · fixed in 1.7.9 *

• medium 4.9 Hustle

  Stored cross-site scripting (XSS)

  CVE-2026-118169 · affected 7.8.14.3 and older · fixed in 7.8.14.4 *

• medium 6.5 WP Inventory Manager

  SQL injection

  CVE-2026-76005 · affected 2.5.5 and older · fixed in 2.5.6 *

• medium 4.3 Clean Login

  Missing authorization check

  CVE-2026-116610 · affected 1.20.1 and older · fixed in 1.21 *

• medium 5.4 CMB2

  Stored cross-site scripting (XSS)

  CVE-2026-116761 · affected 2.13.4 and older · fixed in 2.13.5 *

• medium 6.5 VikRentCar Car Rental Management System

  SQL injection

  CVE-2026-116750 · affected 1.4.10 and older · fixed in 1.4.11 *

• medium 6.4 VikRentCar Car Rental Management System

  Stored cross-site scripting (XSS)

  CVE-2026-116749 · affected 1.4.10 and older · fixed in 1.4.11 *

• medium 4.3 AI ChatBot for WooCommerce

  Missing authorization check

  CVE-2026-111372 · affected 5.0.0 and older · fixed in 5.0.1 *

• medium 6.5 WP Visitor Statistics (Real Time Traffic)

  SQL injection

  CVE-2026-116609 · affected 8.8 and older · fixed in 8.9 *

• high 7.2 Prime Slider

  Stored cross-site scripting (XSS)

  CVE-2026-111111 · affected 4.7.2 and older · fixed in 4.7.3 *

• medium 5.9 Bit Flows

  File inclusion

  CVE-2026-110185 · affected 1.31.0 and older · fixed in 1.32.0 *

• medium 4.4 DesignSetGo

  Stored cross-site scripting (XSS)

  CVE-2026-111068 · affected 2.11.0 and older · fixed in 2.11.1 *

• medium 6.4 Mang Board

  Stored cross-site scripting (XSS)

  CVE-2026-110071 · affected 2.4.5 and older · fixed in 2.4.6 *

• high 7.2 MxChat

  DOM-based cross-site scripting (XSS)

  CVE-2026-110662 · affected 3.2.25 and older · fixed in 3.2.26 *

• medium 4.3 Travelly

  Missing authorization check

  CVE-2026-111213 · affected 2.3.6 and older · fixed in 2.3.8 *

• high 8.8 VikRentCar Car Rental Management System

  Cross-site request forgery (CSRF)

  CVE-2026-111120 · affected 1.4.8 and older · fixed in 1.4.9 *

• medium 6.4 Cozy Blocks

  Stored cross-site scripting (XSS)

  CVE-2026-109978 · affected 2.2.27 and older · fixed in 2.2.28 *

• medium 6.4 Cozy Blocks

  Stored cross-site scripting (XSS)

  CVE-2026-109975 · affected 2.2.27 and older · fixed in 2.2.28 *

• medium 4.3 Related Posts for WordPress

  Information disclosure

  CVE-2026-109980 · affected 3.0.0 and older · fixed in 3.0.1 *

• medium 4.3 Related Posts for WordPress

  Information disclosure

  CVE-2026-109979 · affected 3.0.0 and older · fixed in 3.0.1 *

• medium 6.4 s2Member

  Stored cross-site scripting (XSS)

  CVE-2026-109972 · affected 261011 and older · fixed in 261017 *

• medium 6.5 Rich Showcase for Google Reviews

  Missing authorization check

  CVE-2026-110020 · affected 7.1.6 and older · fixed in 7.1.7 *

• medium 4.4 Product Addons for Woocommerce

  Stored cross-site scripting (XSS)

  CVE-2026-109988 · affected 3.1.8 and older · fixed in 3.1.9 *

• critical 9.8 Contact Manager

  Arbitrary file upload

  CVE-2026-109218 · affected 9.1.2 and older · fixed in 9.1.3 *

• medium 6.4 Document Embedder

  DOM-based cross-site scripting (XSS)

  CVE-2026-109370 · affected 2.4.0 and older · fixed in 2.4.1 *

• high 8.8 The Innovative Form Builder

  Arbitrary file upload

  CVE-2026-109384 · affected 1.5.1 and older · fixed in 1.5.2 *

• high 7.2 Event Booking Manager for WooCommerce

  Privilege escalation

  CVE-2026-109381 · affected 5.7.8 and older · fixed in 5.7.9 *

• medium 6.4 Travelly

  Stored cross-site scripting (XSS)

  CVE-2026-109590 · affected 2.3.6 and older · fixed in 2.3.8 *

• medium 6.4 UiChemy

  Stored cross-site scripting (XSS)

  CVE-2026-109385 · affected 5.3.0 and older · fixed in 5.4.0 *

• medium 6.4 Awesome Support

  Stored cross-site scripting (XSS)

  CVE-2026-103370 · affected 6.4.1 and older · fixed in 6.4.2 *

• medium 6.4 easy.jobs

  Stored cross-site scripting (XSS)

  CVE-2026-108366 · affected 2.8.2 and older · fixed in 2.8.3 *

• medium 6.4 If-So Dynamic Content

  Stored cross-site scripting (XSS)

  CVE-2026-104740 · affected 1.10.2 and older · fixed in 1.10.3 *

• medium 6.4 If-So Dynamic Content

  Stored cross-site scripting (XSS)

  CVE-2026-103996 · affected 1.10.2 and older · fixed in 1.10.3 *

• medium 4.9 Tainacan

  Path traversal / file read

  CVE-2026-104743 · affected 1.3.0 and older · fixed in 1.4.0 *

• medium 6.4 Hustle

  Stored cross-site scripting (XSS)

  CVE-2026-107710 · affected 7.8.14.3 and older · fixed in 7.8.14.4 *

• medium 5.4 Postie

  Stored cross-site scripting (XSS)

  CVE-2026-100175 · affected 1.9.87 and older · fixed in 1.9.88 *

• low 2.7 GeoDirectory

  Information disclosure

  CVE-2026-113494 · affected older than 2.8.195 · fixed in 2.8.195

• medium 6.8 GeoDirectory

  Stored cross-site scripting (XSS)

  CVE-2026-113488 · affected older than 2.8.196 · fixed in 2.8.196

• medium 6.8 GeoDirectory

  Stored cross-site scripting (XSS)

  CVE-2026-113487 · affected older than 2.8.196 · fixed in 2.8.196

• medium 6.5 Media Library Assistant

  Cross-site request forgery (CSRF)

  CVE-2026-113486 · affected older than 3.42 · fixed in 3.42

• medium 6.5 PayPlug for WooCommerce (Official)

  Missing authorization check

  CVE-2026-113813 · affected 2.8.0 up to (not including) 3.1.1 · fixed in 3.1.1

• medium 5.8 Customer Engagement System

  Server-side request forgery (SSRF)

  CVE-2026-115225 · affected older than 2.0.2 · fixed in 2.0.2

• medium 4.1 Customer Engagement System

  SQL injection

  CVE-2026-115224 · affected older than 2.0.2 · fixed in 2.0.2

• medium 6.8 Recipe Card Blocks Lite

  SQL injection

  CVE-2026-115281 · affected 3.5.0 up to (not including) 3.6.4 · fixed in 3.6.4

• high 7.2 GoSMTP

  Privilege escalation

  CVE-2026-111577 · affected older than 1.2.5 · fixed in 1.2.5

• medium 6.5 Media Library Assistant

  Cross-site request forgery (CSRF)

  CVE-2026-113485 · affected older than 3.42 · fixed in 3.42

• medium 6.8 MP3 Audio Player

  Cross-site scripting (XSS)

  CVE-2026-111967 · affected 5.9 up to (not including) 5.16 · fixed in 5.16

• high 7.1 افزونه پیامک ووکامرس

  Reflected cross-site scripting (XSS)

  CVE-2026-111021 · affected 7.2.0 up to (not including) 7.3.2 · fixed in 7.3.2

• low 3.8 Royal MCP

  Missing authorization check

  CVE-2026-111961 · affected older than 1.5.10 · fixed in 1.5.10

• medium 4.3 Royal MCP

  Missing authorization check

  CVE-2026-111960 · affected 1.4.38 up to (not including) 1.5.10 · fixed in 1.5.10

• low 3.8 Welcart e-Commerce

  Missing authorization check

  CVE-2026-111032 · affected older than 2.12.6 · fixed in 2.12.6

• medium 4.7 Welcart e-Commerce

  Open redirect

  CVE-2026-111031 · affected older than 2.12.6 · fixed in 2.12.6

• medium 6.8 Welcart e-Commerce

  SQL injection

  CVE-2026-111027 · affected older than 2.12.6 · fixed in 2.12.6

• medium 4.8 Customer Email Verification for WooCommerce

  Authentication bypass

  CVE-2026-109236 · affected 2.8.2 and older · fixed in 2.8.3 *

• medium 5.3 Essential Addons for Elementor

  Information disclosure

  CVE-2026-110509 · affected older than 6.8.7 · fixed in 6.8.7

• medium 6.5 PayPlug for WooCommerce (Official)

  Information disclosure

  CVE-2026-110292 · affected 2.9.0 up to (not including) 3.1.1 · fixed in 3.1.1

• medium 5.3 Royal Addons for Elementor

  Information disclosure

  CVE-2026-107100 · affected 1.3.81 up to (not including) 1.7.1070 · fixed in 1.7.1070

• medium 6.8 Royal Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2026-107098 · affected 1.7.1037 up to (not including) 1.7.1070 · fixed in 1.7.1070

• low 2.7 Page Builder by SiteOrigin

  Information disclosure

  CVE-2026-110507 · affected older than 2.38.0 · fixed in 2.38.0

• medium 6.8 Page Builder by SiteOrigin

  Stored cross-site scripting (XSS)

  CVE-2026-110506 · affected older than 2.38.0 · fixed in 2.38.0

• medium 5.3 Booking Package

  Missing authorization check

  CVE-2026-105997 · affected older than 1.7.33 · fixed in 1.7.33

• critical 9.8 Checkout Files Upload for WooCommerce

  Remote code execution

  CVE-2026-103688 · affected older than 2.4.0 · fixed in 2.4.0

• medium 5.3 Court Reservation

  Missing authorization check

  CVE-2026-106003 · affected older than 1.12.4 · fixed in 1.12.4

• medium 5.3 Court Reservation

  Missing authorization check

  CVE-2026-106002 · affected older than 1.12.4 · fixed in 1.12.4

• medium 5.3 Royal Addons for Elementor

  Missing authorization check

  CVE-2026-107097 · affected 1.3.71 up to (not including) 1.7.1070 · fixed in 1.7.1070

• low 3.8 Royal Addons for Elementor

  Missing authorization check

  CVE-2026-106647 · affected 1.3.68 up to (not including) 1.7.1070 · fixed in 1.7.1070

• high 8.8 Rank Math SEO

  PHP object injection

  CVE-2026-1928 · affected 1.0.276 and older · fixed in 1.0.277 *

• high 7.5 Animated Text Block

  Information disclosure

  CVE-2026-116613 · affected 1.2.6 and older · fixed in 1.2.7 *

• medium 6.4 Appointment Booking Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-111727 · affected 1.4.05 and older · fixed in 1.4.06 *

• high 7.5 affiliate-toolkit

  Arbitrary file upload

  CVE-2026-111255 · affected 3.9.2 and older · fixed in 3.9.3 *

• high 7.2 AMP for WP

  Stored cross-site scripting (XSS)

  CVE-2026-97019 · affected 1.1.17 and older · fixed in 1.1.18 *

• high 7.2 affiliate-toolkit

  Stored cross-site scripting (XSS)

  CVE-2026-111314 · affected 3.9.2 and older · fixed in 3.9.3 *

• medium 4.2 AI Engine

  Path traversal / file read

  CVE-2026-107745 · affected 3.8.4 and older · fixed in 3.8.5 *

• high 7.2 AI Marketing Expert

  DOM-based cross-site scripting (XSS)

  CVE-2026-109999 · affected 1.2.8 and older · fixed in 1.2.9 *

• medium 6.4 All-in-One Video Gallery

  Stored cross-site scripting (XSS)

  CVE-2026-109974 · affected 4.9.7 and older · fixed in 5.0.0 *

• medium 6.4 All-in-One Video Gallery

  Stored cross-site scripting (XSS)

  CVE-2026-109209 · affected 4.9.7 and older · fixed in 5.0.0 *

• medium 6.4 Ultimate Member

  Stored cross-site scripting (XSS)

  CVE-2026-107625 · affected 2.14.0 and older · fixed in 2.14.1 *

• critical 9.8 Jupiter X Core

  Authentication bypass

  CVE-2026-106013 · affected 4.61.0 and older · fixed in 4.62.0 *

Tuesday, October 27, 2026 · 6

• critical 9.6 affects latest 4.18.2 Newsletters

  Cross-site request forgery (CSRF)

  CVE-2026-116863 · affected 4.18.2 and older · no fix listed yet

• medium 4.8 Advanced Custom Fields

  Missing authorization check

  CVE-2026-10752 · affected 0.9.2.6 and older · fixed in 0.9.2.7 *

• high 7.2 Advanced Views

  Stored cross-site scripting (XSS)

  CVE-2026-109995 · affected 3.9.6 and older · fixed in 3.9.7 *

• medium 6.4 Jupiter X Core

  Stored cross-site scripting (XSS)

  CVE-2026-10511 · affected 4.61.0 and older · fixed in 4.62.0 *

• high 8.8 Kirki

  PHP object injection

  CVE-2026-75891 · affected 6.2.5 and older · fixed in 6.3.0 *

• high 7.2 Analytics Insights

  Stored cross-site scripting (XSS)

  CVE-2026-111820 · affected 6.3.12 and older · fixed in 6.4 *

Monday, October 26, 2026 · 40

• medium 6.5 Button Block

  Stored cross-site scripting (XSS)

  CVE-2026-116400 · affected 1.2.7 and older · fixed in 1.2.8

• medium 6.5 Content Slider Block

  Stored cross-site scripting (XSS)

  CVE-2026-116398 · affected 3.2.1 and older · fixed in 3.2.2

• medium 6.5 Gallery PhotoBlocks

  Stored cross-site scripting (XSS)

  CVE-2026-116408 · affected 1.3.7 and older · fixed in 1.3.8

• medium 6.5 Text Typing

  Stored cross-site scripting (XSS)

  CVE-2026-115966 · affected 2.2.0 and older · fixed in 2.2.1

• medium 4.3 Customer Coupons for WooCommerce

  Missing authorization check

  CVE-2026-112839 · affected 1.3.14 and older · fixed in 1.3.15

• low 3.7 Revopic

  Security issue

  CVE-2026-111404 · affected 1.2.31 and older · fixed in 1.2.32

• medium 6.5 Booking for Appointments and Events Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-116396 · affected 2.4.12 and older · fixed in 2.4.13

• medium 5.3 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2026-116388 · affected 2.4.10 and older · fixed in 2.4.11

• medium 5.9 Easy Digital Downloads

  Security issue

  CVE-2026-116403 · affected 3.7.1 and older · fixed in 3.7.2

• medium 6.5 All In One Lightbox

  Stored cross-site scripting (XSS)

  CVE-2026-116395 · affected 1.2.0 and older · fixed in 1.2.1

• medium 5.3 LearnPress

  Missing authorization check

  CVE-2026-115598 · affected 4.4.11 and older · fixed in 4.4.12

• medium 5.4 LearnPress

  Missing authorization check

  CVE-2026-115597 · affected 4.4.11 and older · fixed in 4.4.12

• medium 6.5 Gallery PhotoBlocks

  Stored cross-site scripting (XSS)

  CVE-2026-114710 · affected 1.3.7 and older · fixed in 1.3.8

• medium 5.3 Event Booking Manager for WooCommerce

  Cross-site scripting (XSS)

  CVE-2026-116394 · affected 5.7.9 and older · fixed in 5.7.10

• medium 6.5 Advanced Post Block

  Stored cross-site scripting (XSS)

  CVE-2026-115955 · affected 2.5.1 and older · fixed in 2.5.2

• medium 6.5 bSlider

  Stored cross-site scripting (XSS)

  CVE-2026-115961 · affected 2.2.2 and older · fixed in 2.2.4

• medium 5.4 Geo Mashup

  Missing authorization check

  CVE-2026-115954 · affected 1.13.22 and older · fixed in 1.13.23

• medium 6.5 Geo Mashup

  Stored cross-site scripting (XSS)

  CVE-2026-115953 · affected 1.13.22 and older · fixed in 1.13.23

• medium 6.5 Panorama

  Stored cross-site scripting (XSS)

  CVE-2026-115956 · affected 1.8.3 and older · fixed in 1.8.4

• medium 4.3 WC Shop Sync

  Missing authorization check

  CVE-2026-115960 · affected 4.7.5 and older · fixed in 4.7.6

• medium 5.3 WC Shop Sync

  Missing authorization check

  CVE-2026-115959 · affected 4.7.5 and older · fixed in 4.7.6

• medium 6.5 Better Post & Filter Widgets for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-115950 · affected 1.9.1 and older · fixed in 1.9.2

• medium 6.5 Lazy Load for Videos

  Stored cross-site scripting (XSS)

  CVE-2026-115951 · affected 2.18.11 and older · fixed in 2.18.12

• high 8.5 Media Library Assistant

  SQL injection

  CVE-2026-115948 · affected 3.42 and older · fixed in 3.43

• medium 5.3 Contact Form by Supsystic

  Missing authorization check

  CVE-2026-115595 · affected 1.10.7 and older · fixed in 1.11.1

• medium 6.5 Media Library Assistant

  Information disclosure

  CVE-2026-115594 · affected 3.42 and older · fixed in 3.43

• medium 4.3 Media Library Assistant

  Cross-site request forgery (CSRF)

  CVE-2026-97295 · affected 3.42 and older · fixed in 3.43

• medium 5.3 Royal Addons for Elementor

  Missing authorization check

  CVE-2026-97255 · affected 1.7.1069 and older · fixed in 1.7.1070

• medium 6.5 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-97254 · affected 1.7.1069 and older · fixed in 1.7.1070

• medium 6.5 Better Post & Filter Widgets for Elementor

  Missing authorization check

  CVE-2026-115949 · affected 1.9.1 and older · fixed in 1.9.2

• medium 5.3 Booking and Rental Manager for Bike

  Missing authorization check

  CVE-2026-115614 · affected 2.8.2 and older · fixed in 2.8.3

• medium 5.3 Discussion Board

  Missing authorization check

  CVE-2026-115958 · affected 2.6.0 and older · fixed in 2.6.1

• medium 6.5 Image Gallery Block

  Stored cross-site scripting (XSS)

  CVE-2026-115613 · affected 2.4.1 and older · fixed in 2.4.2

• medium 6.5 Ad Inserter

  Reflected cross-site scripting (XSS)

  CVE-2026-114709 · affected 2.8.18 and older · fixed in 2.8.19

• medium 5.3 Bopo

  Missing authorization check

  CVE-2026-110377 · affected 1.2.3 and older · fixed in 1.2.4

• medium 6.5 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2026-115602 · affected 3.8.0.1 and older · fixed in 3.8.0.2

• medium 6.5 Royal Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2026-112865 · affected 1.7.1069 and older · fixed in 1.7.1070

• medium 4.3 AI Engine

  Missing authorization check

  CVE-2026-112828 · affected 3.8.6 and older · fixed in 3.8.7

• medium 4.3 DEPART

  Missing authorization check

  CVE-2026-110376 · affected 1.0.10 and older · fixed in 1.1.0

• high 8.8 FunnelKit Automations

  Cross-site request forgery (CSRF)

  CVE-2026-111841 · affected 3.8.5.2 and older · fixed in 3.8.6

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan