HomeWordPress vulnerabilitiesWordPress vulnerabilities this week
WordPress vulnerabilities this week
This page lists WordPress vulnerabilities published in the last 7 days, newest first. Use the live table to check the affected software, severity, vulnerable versions and whether a fixed version is available.
600 published in the last 7 days. Last checked 10 min ago.
| Plugin or theme | Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|---|
| WP-Members Membership Plugin 50,000+ installs | Broken access control CVE-2026-61994 | Medium 5.4 | Up to 3.5.7 | No fixed version yet | 5 h ago |
| Events Manager - Calendar, Bookings, Tickets, Appointments and more! 60,000+ installs | Security weakness CVE-2026-42689 | Low 3.7 | Up to 7.4.7 | No fixed version yet | 5 h ago |
| Patreon WordPress 3,000+ installs | Cross-site request forgery (CSRF) CVE-2026-108479 | High 8.1 | Up to 1.9.17 | No fixed version yet | 5 h ago |
| Patreon WordPress 3,000+ installs | Cross-site request forgery (CSRF) CVE-2026-108481 | High 7.4 | Up to 1.10.0 | No fixed version yet | 5 h ago |
| Salevo Boost Sales for WooCommerce - Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon 200+ installs | Broken access control CVE-2026-103080 | Medium 5.3 | Up to 1.3.0 | Fixed in a later version (latest 1.3.1) | 5 h ago |
| Premium Addons for Elementor - AI-Ready Elementor Addons, Widgets & Templates 600,000+ installs | Cross-site scripting (XSS) CVE-2026-108482 | Medium 6.5 | Up to 4.11.110 | No fixed version yet | 6 h ago |
| Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker 40,000+ installs | Cross-site scripting (XSS) CVE-2026-107862 | Medium 6.5 | Up to 11.2.7 | No fixed version yet | 6 h ago |
| Forminator Forms - Contact Form, Payment Form & Custom Form Builder 600,000+ installs | Broken access control CVE-2026-108486 | Medium 5.3 | Up to 1.58.0 | No fixed version yet | 6 h ago |
| Booktics - Appointment Booking Calendar for Service Businesses 800+ installs | Broken access control CVE-2026-107418 | Medium 5.4 | Up to 1.0.28 | No fixed version yet | 6 h ago |
| Element Pack Addons for Elementor - Elementor Widgets, Elementor Templates, Elementor Addons 100,000+ installs | Cross-site scripting (XSS) CVE-2026-108478 | Medium 6.5 | Up to 8.8.8 | No fixed version yet | 6 h ago |
| Broadcast Live Video - Live Streaming : WebRTC, HLS, RTSP, RTMP 400+ installs | Broken access control CVE-2026-108475 | Medium 4.3 | Up to 7.3.6 | No fixed version yet | 6 h ago |
| Paid Videochat Turnkey Site - HTML5 PPV Live Webcams 20+ installs | Broken access control CVE-2026-108476 | Medium 5.0 | Up to 7.5.13 | No fixed version yet | 6 h ago |
| Booktics - Appointment Booking Calendar for Service Businesses 800+ installs | Broken access control CVE-2026-108477 | Medium 5.3 | Up to 1.0.28 | No fixed version yet | 6 h ago |
| Ad Inserter - Ad Manager & AdSense Ads 300,000+ installs | Cross-site scripting (XSS) CVE-2026-107864 | Medium 6.5 | Up to 2.8.18 | Fixed in a later version (latest 2.8.19) | 14 h ago |
| Crocoblock JetMenu jet-menu | Cross-site scripting (XSS) CVE-2026-107865 | Medium 6.5 | Up to 3.0.5 | Check for an update | 14 h ago |
| Crocoblock JetElements For Elementor jet-elements | Cross-site scripting (XSS) CVE-2026-107866 | Medium 6.5 | Up to 2.9.2.3 | Check for an update | 14 h ago |
| WP User Manager - Registration Form, Login Form, User Profile & Member Directory 10,000+ installs | Broken access control CVE-2026-107423 | Medium 4.3 | Up to 2.9.22 | No fixed version yet | 15 h ago |
| Flexible Subscriptions 1,000+ installs | Broken access control CVE-2026-107869 | Medium 4.3 | Up to 1.8.4 | Fixed in a later version (latest 1.8.6) | 15 h ago |
| Products Restricted Users for WooCommerce 400+ installs | Broken access control CVE-2026-107863 | Medium 5.3 | Up to 0.7 | Fixed in a later version (latest 0.8) | 15 h ago |
| Custom Query Blocks 700+ installs | Cross-site scripting (XSS) CVE-2026-108168 | Medium 6.5 | Up to 5.6.0 | Fixed in a later version (latest 5.7.0) | 15 h ago |
| Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce | Security weakness CVE-2023-25996 | Medium 6.5 | Before 8.4.0 | Fixed in 8.4.0 | 15 h ago |
| Event Post 1,000+ installs | Broken access control CVE-2026-107432 | Medium 5.4 | Up to 6.1.1 | Fixed in a later version (latest 6.1.2) | 15 h ago |
| TMDS - Dropshipping for TEMU and Woo 400+ installs | Broken access control CVE-2026-103356 | Medium 5.4 | Up to 1.0.15 | Fixed in a later version (latest 1.0.16) | 15 h ago |
| VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok 10+ installs | Broken access control CVE-2026-107430 | Medium 5.4 | Up to 1.2.10 | Fixed in a later version (latest 1.2.12) | 15 h ago |
| Paid Videochat Turnkey Site - HTML5 PPV Live Webcams 20+ installs | Security weakness CVE-2026-107429 | Medium 4.3 | Up to 7.5.12 | No fixed version yet | 15 h ago |
| Event Post 1,000+ installs | Broken access control CVE-2026-107427 | Medium 6.5 | Up to 6.1.1 | Fixed in a later version (latest 6.1.2) | 15 h ago |
| Flexible Quantity - Measurement Price Calculator for WooCommerce 2,000+ installs | Security weakness CVE-2026-106605 | Medium 5.3 | Up to 2.3.22 | Fixed in a later version (latest 2.3.23) | 15 h ago |
| Hotel Booking | Broken access control CVE-2026-84167 | Medium 4.3 | Up to 3.8 | Check for an update | 17 h ago |
| Hotel Booking | Cross-site request forgery (CSRF) CVE-2026-84166 | Medium 4.3 | Up to 3.8 | Check for an update | 17 h ago |
| WP Comment Cleaner - Delete All Comments, Disable Comments, Bulk Delete & Remove Comments 20,000+ installs | Broken access control CVE-2026-107791 | Medium 6.5 | Before 7.2 | Fixed in 7.2 | 17 h ago |
| HireZoot - Job Listings, Career Page & Recruitment Tool 30,000+ installs | Cross-site scripting (XSS) CVE-2025-15703 | Low 3.5 | Before 4.0.0 | Fixed in 4.0.0 | 17 h ago |
| ngx_cache_purge | Security weakness CVE-2026-108981 | Low 3.6 | Before 3.0.4 | Fixed in 3.0.4 | 21 h ago |
| WP-Invoice | Sensitive data exposure CVE-2026-97183 | Medium 4.3 | Up to 4.3.1 | Check for an update | 1 d ago |
| Piotnet Forms 2,000+ installs | Cross-site scripting (XSS) CVE-2026-96227 | High 8.8 | Up to 1.0.30 | No fixed version yet | 1 d ago |
| Veeqo for WooCommerce | Arbitrary file upload CVE-2026-93550 | Medium 4.3 | Up to 2.2.8 | Check for an update | 1 d ago |
| Subscribe to Comments 10,000+ installs | Cross-site scripting (XSS) CVE-2026-91829 | High 7.1 | Before 2.3.3 | Fixed in 2.3.3 | 1 d ago |
| paymendo | SQL injection CVE-2026-89305 | Medium 6.5 | Up to 1.1 | Check for an update | 1 d ago |
| paymendo | SQL injection CVE-2026-89304 | Medium 6.5 | Up to 1.1 | Check for an update | 1 d ago |
| Post Voting System | SQL injection CVE-2026-89302 | High 8.6 | Up to 1.0 | Check for an update | 1 d ago |
| WP Verify API | SQL injection CVE-2026-89299 | High 8.6 | Up to 1.0.0 | Check for an update | 1 d ago |
| Loja Automática | SQL injection CVE-2026-89297 | High 8.6 | Up to 1.0.0 | Check for an update | 1 d ago |
| ASPL Product Quotation | SQL injection CVE-2026-89287 | High 8.6 | Up to 1.1.0 | Check for an update | 1 d ago |
| Datalist it | SQL injection CVE-2026-89285 | High 8.6 | Up to 0.0.3 | Check for an update | 1 d ago |
| WP Posts Password Batch Manager | Broken access control CVE-2026-89283 | High 8.6 | Up to 1.1 | Check for an update | 1 d ago |
| WP-Partner | SQL injection CVE-2026-89234 | High 8.6 | Up to 1.2.1 | Check for an update | 1 d ago |
| Recordbrowser | SQL injection CVE-2026-89232 | High 8.6 | Up to 1.1.7 | Check for an update | 1 d ago |
| WpCues Basic Quiz | SQL injection CVE-2026-89214 | High 8.6 | Up to 1.6.5 | Check for an update | 1 d ago |
| Llavero.io | SQL injection CVE-2026-89213 | High 8.6 | Up to 0.1.4 | Check for an update | 1 d ago |
| Site Setup Wizard | SQL injection CVE-2026-89195 | High 8.6 | Up to 1.5.8 | Check for an update | 1 d ago |
| Social Web Suite | SQL injection CVE-2026-88930 | High 8.6 | Up to 4.1.12 | Check for an update | 1 d ago |
| KeyWord Collector | Cross-site scripting (XSS) CVE-2026-88905 | High 8.8 | Up to 1.4 | Check for an update | 1 d ago |
| Topcontent | Cross-site scripting (XSS) CVE-2026-88903 | High 8.8 | Up to 1.2.1 | Check for an update | 1 d ago |
| Disable Users | Authentication bypass CVE-2026-88827 | High 8.8 | Up to 1.0.5 | Check for an update | 1 d ago |
| SmugMug Embed | Cross-site scripting (XSS) CVE-2026-88826 | High 8.8 | Up to 3.13 | Check for an update | 1 d ago |
| Simple Membership 40,000+ installs | Sensitive data exposure CVE-2026-88785 | Medium 4.7 | Before 4.8.3 | Fixed in 4.8.3 | 1 d ago |
| BuddyPress Instant Chat | Cross-site scripting (XSS) CVE-2026-87764 | High 8.8 | Up to 1.6 | Check for an update | 1 d ago |
| Adwised Web Push Notification | Cross-site scripting (XSS) CVE-2026-87762 | High 8.8 | Up to 2.5.7 | Check for an update | 1 d ago |
| Adwised Web Push Notification | Cross-site scripting (XSS) CVE-2026-87761 | High 8.0 | Up to 2.5.7 | Check for an update | 1 d ago |
| Web Vitals Tracking | Cross-site scripting (XSS) CVE-2026-87760 | High 8.8 | Up to 5.4.2 | Check for an update | 1 d ago |
| HootBoard | Cross-site scripting (XSS) CVE-2026-86798 | High 8.8 | Up to 3.1.4 | Check for an update | 1 d ago |
| Insurify | Broken access control CVE-2026-86717 | Critical 9.1 | Up to 1.0 | Check for an update | 1 d ago |
| Quick quotes | Broken access control CVE-2026-86706 | Critical 9.1 | Up to 1.0.0 | Check for an update | 1 d ago |
| Crowdfundly | Privilege escalation CVE-2026-85126 | High 7.2 | Up to 2.2.2 | Check for an update | 1 d ago |
| Insurify | Broken access control CVE-2026-85121 | Critical 9.1 | Up to 1.0 | Check for an update | 1 d ago |
| AI Content Generator Marketing | Privilege escalation CVE-2026-85118 | Critical 9.8 | Up to 1.0.0 | Check for an update | 1 d ago |
| Freeton WP | Authentication bypass CVE-2026-84737 | Critical 9.8 | Up to 1.0.0 | Check for an update | 1 d ago |
| Mindstien Quick Login | Authentication bypass CVE-2026-84734 | Critical 9.8 | Up to 1.0 | Check for an update | 1 d ago |
| click5 CRM add-on to Contact Form 7 | Cross-site scripting (XSS) CVE-2026-84261 | High 8.8 | Up to 1.0.4 | Check for an update | 1 d ago |
| click5 CRM add-on to Gravity Forms | Cross-site scripting (XSS) CVE-2026-84260 | High 8.8 | Up to 1.0.3 | Check for an update | 1 d ago |
| click5 CRM add-on to WPForms | Cross-site scripting (XSS) CVE-2026-84259 | High 8.8 | Up to 1.0.3 | Check for an update | 1 d ago |
| click5 CRM add-on to Ninja Forms | Cross-site scripting (XSS) CVE-2026-84258 | High 8.8 | Up to 1.0.1 | Check for an update | 1 d ago |
| click5 CRM add-on to Contact Form 7 | Cross-site request forgery (CSRF) CVE-2026-84254 | Critical 9.8 | Up to 1.0.4 | Check for an update | 1 d ago |
| click5 CRM add-on to Gravity Forms | Cross-site request forgery (CSRF) CVE-2026-84253 | Critical 9.8 | Up to 1.0.3 | Check for an update | 1 d ago |
| click5 CRM add-on to WPForms | Cross-site request forgery (CSRF) CVE-2026-84252 | Critical 9.8 | Up to 1.0.3 | Check for an update | 1 d ago |
| click5 CRM add-on to Ninja Forms | Cross-site request forgery (CSRF) CVE-2026-84251 | Critical 9.8 | Up to 1.0.1 | Check for an update | 1 d ago |
| Fundiin cho WooCommerce | Cross-site scripting (XSS) CVE-2026-81649 | Critical 9.1 | Up to 3.4.0 | Check for an update | 1 d ago |
| Tcard WP | SQL injection CVE-2026-81420 | High 8.6 | Up to 1.8.0 | Check for an update | 1 d ago |
| Robo Gallery - Photo & Image Slider 40,000+ installs | Cross-site scripting (XSS) CVE-2026-81156 | Medium 6.8 | Before 5.2.6 | Fixed in 5.2.6 | 1 d ago |
| Robo Gallery - Photo & Image Slider 40,000+ installs | Cross-site scripting (XSS) CVE-2026-81155 | Medium 6.8 | Before 5.2.6 | Fixed in 5.2.6 | 1 d ago |
| Robo Gallery - Photo & Image Slider 40,000+ installs | Cross-site scripting (XSS) CVE-2026-81154 | Medium 6.8 | Before 5.2.6 | Fixed in 5.2.6 | 1 d ago |
| Robo Gallery - Photo & Image Slider 40,000+ installs | Cross-site scripting (XSS) CVE-2026-81153 | Medium 6.8 | Before 5.2.6 | Fixed in 5.2.6 | 1 d ago |
| WooCommerce Bookings | Denial of service CVE-2026-14854 | High 7.5 | Before 3.11.0 | Fixed in 3.11.0 | 1 d ago |
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | Sensitive data exposure CVE-2026-107694 | Low 2.7 | Before 5.2.0 | Fixed in 5.2.0 | 1 d ago |
| Squadeno - Club Sports Manager 30+ installs | Broken access control CVE-2026-107507 | Low 2.7 | Before 1.12.0 | Fixed in 1.12.0 | 1 d ago |
| WeddingCity Lite | Broken access control CVE-2026-106029 | High 7.5 | Up to 1.0.4 | Check for an update | 1 d ago |
| Envira Gallery - Image Photo Gallery, Albums, Video Gallery, Slideshows & More 100,000+ installs | Broken access control CVE-2026-104684 | Low 2.7 | Before 1.16.2 | Fixed in 1.16.2 | 1 d ago |
| Envira Gallery - Image Photo Gallery, Albums, Video Gallery, Slideshows & More 100,000+ installs | Broken access control CVE-2026-104682 | Low 2.7 | Before 1.16.2 | Fixed in 1.16.2 | 1 d ago |
| Envira Gallery - Image Photo Gallery, Albums, Video Gallery, Slideshows & More 100,000+ installs | Sensitive data exposure CVE-2026-104681 | Low 2.7 | Before 1.16.2 | Fixed in 1.16.2 | 1 d ago |
| Envira Gallery - Image Photo Gallery, Albums, Video Gallery, Slideshows & More 100,000+ installs | Privilege escalation CVE-2026-104680 | High 7.2 | Before 1.16.2 | Fixed in 1.16.2 | 1 d ago |
| MemberHero | Broken access control CVE-2026-94235 | Medium 4.3 | Up to 6.9 | Check for an update | 1 d ago |
| Post Snippets | Cross-site scripting (XSS) CVE-2026-12980 | Medium 6.8 | Up to 4.2.4 | Check for an update | 1 d ago |
| Anton Extensions | Remote code execution CVE-2026-104028 | Critical 9.8 | Up to 1.2.2 | Check for an update | 1 d ago |
| Mobile builder | SQL injection CVE-2026-103695 | High 8.6 | Up to 1.4.2 | Check for an update | 1 d ago |
| Mobile builder | Privilege escalation CVE-2026-103694 | High 8.8 | Up to 1.4.2 | Check for an update | 1 d ago |
| Prenotazioni | Cross-site scripting (XSS) CVE-2026-103305 | High 8.8 | Up to 1.7.5 | Check for an update | 1 d ago |
| MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions 2,000+ installs | Broken access control CVE-2026-108695 | High 7.1 | Up to 5.0.19 | No fixed version yet | 1 d ago |
| ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce 9,000+ installs | Broken access control CVE-2026-103685 | Medium 4.3 | Up to 2.2.4 | Fixed in a later version (latest 2.2.5) | 2 d ago |
| Builderius - Landing Page Builder + Dynamic Templates 200+ installs | Server-side request forgery (SSRF) CVE-2026-27350 | High 7.2 | Up to 1.4-beta | No fixed version yet | 2 d ago |
| YITH WooCommerce Product Add-Ons 20,000+ installs | Broken access control CVE-2026-66480 | Medium 5.3 | Up to 4.34.0 | Fixed in a later version (latest 4.34.1) | 2 d ago |
| ThemeREX Group Kids Planet | Cross-site scripting (XSS) CVE-2026-57742 | High 7.1 | Up to 2.2.14.2 | Check for an update | 2 d ago |
| MicroPayments - Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet 20+ installs | Security weakness CVE-2026-107434 | Medium 5.4 | Up to 3.2.9 | No fixed version yet | 2 d ago |
| Pay With MetaMask For WooCommerce - Cryptocurrency Payment Gateway 400+ installs | Security weakness CVE-2026-107420 | Medium 5.3 | Up to 1.7.2 | Fixed in a later version (latest 1.7.3) | 2 d ago |
| Buzz Stone | Magazine & Viral Blog WordPress Theme | PHP object injection CVE-2026-81797 | Critical 9.8 | Up to 1.0.2 | Check for an update | 2 d ago |
| Photolia | PHP object injection CVE-2026-78535 | Critical 9.8 | Up to 1.0.3 | Check for an update | 2 d ago |
| Educavo | Cross-site scripting (XSS) CVE-2026-78534 | High 7.1 | Up to 3.4.2 | Check for an update | 2 d ago |
| Qwery | PHP object injection CVE-2026-78533 | Critical 9.8 | Up to 3.6.1 | Check for an update | 2 d ago |
| LMS | Cross-site scripting (XSS) CVE-2026-78532 | High 7.1 | Up to 8.3 | Check for an update | 2 d ago |
| Jacqueline | PHP object injection CVE-2026-78531 | Critical 9.8 | Up to 2.22 | Check for an update | 2 d ago |
| FoodBakery | Arbitrary file deletion CVE-2026-78530 | High 7.7 | Up to 4.6 | Check for an update | 2 d ago |
| Alliance | PHP object injection CVE-2026-78529 | Critical 9.8 | Up to 3.11 | Check for an update | 2 d ago |
| Kicker | PHP object injection CVE-2026-66569 | Critical 9.8 | Up to 2.2.1 | Check for an update | 2 d ago |
| Original | PHP object injection CVE-2026-66568 | Critical 9.8 | Up to 1.9.0 | Check for an update | 2 d ago |
| Anesta | PHP object injection CVE-2026-66567 | Critical 9.8 | Up to 1.5.3 | Check for an update | 2 d ago |
| Ambient | File inclusion CVE-2026-66566 | High 8.1 | Up to 1.7 | Check for an update | 2 d ago |
| FC United | PHP object injection CVE-2026-66565 | Critical 9.8 | Up to 1.1.1 | Check for an update | 2 d ago |
| ShiftCV | PHP object injection CVE-2026-66564 | Critical 9.8 | Up to 3.0.14 | Check for an update | 2 d ago |
| Windsor | PHP object injection CVE-2026-66563 | Critical 9.8 | Up to 2.10 | Check for an update | 2 d ago |
| Education Center | PHP object injection CVE-2026-66483 | Critical 9.8 | Up to 3.6.12 | Check for an update | 2 d ago |
| Drone Media | PHP object injection CVE-2026-66482 | Critical 9.8 | Up to 2.2.0 | Check for an update | 2 d ago |
| Presto Player Pro | Arbitrary file deletion CVE-2026-66481 | Medium 6.8 | Up to 3.0.1 | Check for an update | 2 d ago |
| Forminator Forms - Contact Form, Payment Form & Custom Form Builder 600,000+ installs | Broken access control CVE-2026-65459 | High 7.5 | Up to 1.57.3 | Fixed in a later version (latest 1.58.0) | 2 d ago |
| WPML Multilingual & Multicurrency for WooCommerce 100,000+ installs | PHP object injection CVE-2026-62130 | High 7.2 | Up to 5.5.8 | No fixed version yet | 2 d ago |
| Creator LMS - WordPress LMS Plugin for Coaches, Cohorts & Course Creators 90+ installs | Arbitrary file upload CVE-2026-62129 | Critical 9.9 | Up to 1.2.21 | Fixed in a later version (latest 1.2.22) | 2 d ago |
| Asia Garden | PHP object injection CVE-2026-62125 | Critical 9.8 | Up to 1.3.1 | Check for an update | 2 d ago |
| N7 | Golf Club Sports & Events | PHP object injection CVE-2026-62124 | Critical 9.8 | Up to 2.21 | Check for an update | 2 d ago |
| Invetex | PHP object injection CVE-2026-62123 | Critical 9.8 | Up to 2.18 | Check for an update | 2 d ago |
| Law Office | PHP object injection CVE-2026-62120 | Critical 9.8 | Up to 3.20 | Check for an update | 2 d ago |
| Barcode Scanner (+Mobile App) - Inventory manager, Order fulfillment system, POS (Point of Sale) 700+ installs | Broken access control CVE-2026-62118 | High 7.3 | Up to 1.13.1 | Fixed in a later version (latest 1.13.6) | 2 d ago |
| Barcode Scanner (+Mobile App) - Inventory manager, Order fulfillment system, POS (Point of Sale) 700+ installs | SQL injection CVE-2026-62117 | High 8.5 | Up to 1.13.1 | Fixed in a later version (latest 1.13.6) | 2 d ago |
| Barcode Scanner (+Mobile App) - Inventory manager, Order fulfillment system, POS (Point of Sale) 700+ installs | Cross-site scripting (XSS) CVE-2026-62116 | High 7.1 | Up to 1.13.1 | Fixed in a later version (latest 1.13.6) | 2 d ago |
| KuteShop | File inclusion CVE-2026-62115 | High 8.1 | Up to 4.2.9 | Check for an update | 2 d ago |
| KuteShop | Cross-site scripting (XSS) CVE-2026-62100 | High 7.1 | Up to 4.2.9 | Check for an update | 2 d ago |
| Boutique | File inclusion CVE-2026-62099 | High 8.1 | Up to 2.3.3 | Check for an update | 2 d ago |
| Boutique | Content injection CVE-2026-62098 | Medium 6.5 | Up to 2.3.3 | Check for an update | 2 d ago |
| Biolife | File inclusion CVE-2026-62096 | High 8.1 | Up to 3.2.3 | Check for an update | 2 d ago |
| Biolife | Cross-site scripting (XSS) CVE-2026-62095 | High 7.1 | Up to 3.2.3 | Check for an update | 2 d ago |
| TechOne | File inclusion CVE-2026-62094 | High 8.1 | Up to 3.0.3 | Check for an update | 2 d ago |
| TechOne | Cross-site scripting (XSS) CVE-2026-62093 | High 7.1 | Up to 3.0.3 | Check for an update | 2 d ago |
| Armania | File inclusion CVE-2026-62092 | High 8.1 | Up to 1.4.8 | Check for an update | 2 d ago |
| Armania | Cross-site scripting (XSS) CVE-2026-62091 | High 7.1 | Up to 1.4.8 | Check for an update | 2 d ago |
| WineShop | PHP object injection CVE-2026-62090 | Critical 9.8 | Up to 3.20 | Check for an update | 2 d ago |
| Equadio | PHP object injection CVE-2026-62087 | Critical 9.8 | Up to 1.1.4 | Check for an update | 2 d ago |
| Juno | PHP object injection CVE-2026-62086 | Critical 9.8 | Up to 2.25 | Check for an update | 2 d ago |
| Pin WP | Cross-site scripting (XSS) CVE-2026-62082 | High 7.1 | Up to 7.0 | Check for an update | 2 d ago |
| Avala | PHP object injection CVE-2026-62077 | Critical 9.8 | Up to 1.1.4 | Check for an update | 2 d ago |
| Kalles | PHP object injection CVE-2026-62076 | Critical 9.8 | Up to 1.1.7.1 | Check for an update | 2 d ago |
| Backhoe | File inclusion CVE-2026-62075 | High 8.1 | Up to 2.0 | Check for an update | 2 d ago |
| Ozeum | File inclusion CVE-2026-62074 | High 8.1 | Up to 1.3.0 | Check for an update | 2 d ago |
| Flipmart | File inclusion CVE-2026-62070 | High 8.1 | Up to 2.8 | Check for an update | 2 d ago |
| Fabius | File inclusion CVE-2026-62069 | High 8.1 | Up to 1.0 | Check for an update | 2 d ago |
| Teoro | File inclusion CVE-2026-62068 | High 8.1 | Up to 1.1 | Check for an update | 2 d ago |
| Kaven | File inclusion CVE-2026-62067 | High 8.1 | Up to 1.2 | Check for an update | 2 d ago |
| Volos | File inclusion CVE-2026-62066 | High 8.1 | Up to 1.2 | Check for an update | 2 d ago |
| Cardea | File inclusion CVE-2026-62065 | High 8.1 | Up to 2.3 | Check for an update | 2 d ago |
| Ambed | Cross-site scripting (XSS) CVE-2026-62064 | High 7.1 | Up to 1.0.0 | Check for an update | 2 d ago |
| Yacht Rental | PHP object injection CVE-2026-62054 | Critical 9.8 | Up to 2.6 | Check for an update | 2 d ago |
| Wine House | PHP object injection CVE-2026-62053 | Critical 9.8 | Up to 3.20 | Check for an update | 2 d ago |
| Tipsy | PHP object injection CVE-2026-62052 | Critical 9.8 | Up to 1.6 | Check for an update | 2 d ago |
| Stargaze | PHP object injection CVE-2026-62051 | Critical 9.8 | Up to 1.10 | Check for an update | 2 d ago |
| Splendour | PHP object injection CVE-2026-62050 | Critical 9.8 | Up to 1.23 | Check for an update | 2 d ago |
| DTX - Dynamic Text Extension for Contact Form 7 100,000+ installs | Sensitive data exposure CVE-2026-62043 | High 7.5 | Up to 5.0.7 | No fixed version yet | 2 d ago |
| eRoom - Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams 8,000+ installs | Authentication bypass CVE-2026-62038 | High 7.3 | Up to 1.7.1 | No fixed version yet | 2 d ago |
| Document Embedder - let visitors read files without downloading 9,000+ installs | Cross-site scripting (XSS) CVE-2026-62037 | High 7.1 | Up to 2.4.0 | No fixed version yet | 2 d ago |
| Upcasted S3 Offload - AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration 200+ installs | Broken access control CVE-2026-62035 | Medium 6.3 | Up to 3.1.0 | No fixed version yet | 2 d ago |
| Before After Image Comparison - Visual Comparison for Two Images 3,000+ installs | Cross-site scripting (XSS) CVE-2026-62034 | High 7.1 | Up to 1.1.21 | No fixed version yet | 2 d ago |
| Directory Listings WordPress plugin - uListing 1,000+ installs | Broken access control CVE-2026-62033 | High 7.6 | Up to 2.2.0 | No fixed version yet | 2 d ago |
| DirectoryPress - Business Directory And Classified Ad Listing 700+ installs | File inclusion CVE-2026-62032 | Critical 9.8 | Up to 3.6.27 | No fixed version yet | 2 d ago |
| Directory Listings WordPress plugin - uListing 1,000+ installs | SQL injection CVE-2026-62031 | Critical 9.3 | Up to 2.2.0 | No fixed version yet | 2 d ago |
| StreamCast - bring live radio to your site with a sleek player 1,000+ installs | Server-side request forgery (SSRF) CVE-2026-62030 | High 7.2 | Up to 2.4.5 | No fixed version yet | 2 d ago |
| Team Section Block - Showcase Team Members with Layout Options 1,000+ installs | Cross-site scripting (XSS) CVE-2026-62027 | High 7.1 | Up to 2.0.4 | No fixed version yet | 2 d ago |
| Tailored Tools 60+ installs | Arbitrary file upload CVE-2026-62025 | Critical 9.0 | Up to 3.0.3 | No fixed version yet | 2 d ago |
| CodeBard Help Desk 10+ installs | Arbitrary file upload CVE-2026-62024 | Critical 9.9 | Up to 1.1.2 | No fixed version yet | 2 d ago |
| Tonda Membership | Privilege escalation CVE-2026-62022 | Critical 9.8 | Up to 1.0.1 | Check for an update | 2 d ago |
| Angio | PHP object injection CVE-2026-62021 | High 8.8 | Up to 1.1.1 | Check for an update | 2 d ago |
| TouchUp | File inclusion CVE-2026-62020 | High 8.1 | Before 1.4 | Fixed in 1.4 | 2 d ago |
| DukaMarket | File inclusion CVE-2026-48194 | High 8.1 | Up to 1.3.0 | Check for an update | 2 d ago |
| Uminex | File inclusion CVE-2026-48193 | High 8.1 | Up to 1.0.9 | Check for an update | 2 d ago |
| WP Ultimate CSV Importer - WordPress CSV, XML & Excel Import Export 20,000+ installs | SQL injection CVE-2026-45440 | High 7.6 | Up to 9.2 | No fixed version yet | 2 d ago |
| Aalto | File inclusion CVE-2026-42777 | High 8.1 | Up to 1.8 | Check for an update | 2 d ago |
| CleanSkin | File inclusion CVE-2026-42724 | High 8.1 | Up to 1.5.0 | Check for an update | 2 d ago |
| CleanSkin | PHP object injection CVE-2026-42723 | Critical 9.8 | Up to 1.5.0 | Check for an update | 2 d ago |
| Frontend Admin by DynamiApps | SQL injection CVE-2026-42722 | High 7.6 | Up to 3.29.13 | Check for an update | 2 d ago |
| Dynamic User Directory 1,000+ installs | PHP object injection CVE-2026-42719 | Critical 9.8 | Up to 2.4 | No fixed version yet | 2 d ago |
| Booster for WooCommerce - PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools 30,000+ installs | PHP object injection CVE-2026-42718 | Critical 9.8 | Up to 8.4.0 | No fixed version yet | 2 d ago |
| Leyka | SQL injection CVE-2026-42717 | High 7.6 | Up to 3.32.3 | Check for an update | 2 d ago |
| payever - WooCommerce Gateway 800+ installs | PHP object injection CVE-2026-42716 | Critical 9.8 | Up to 4.8.2 | No fixed version yet | 2 d ago |
| Photo Gallery by 10Web - Mobile-Friendly Image Gallery 100,000+ installs | Cross-site scripting (XSS) CVE-2026-42715 | High 7.1 | Up to 1.8.47 | No fixed version yet | 2 d ago |
| Qode Tours | SQL injection CVE-2026-42712 | High 8.5 | Up to 3.1.3.2 | Check for an update | 2 d ago |
| Slider by 10Web - Responsive Image Slider 10,000+ installs | Cross-site scripting (XSS) CVE-2026-42711 | High 7.1 | Up to 1.2.63 | No fixed version yet | 2 d ago |
| Food Menu - Restaurant Menu & Online Ordering for WooCommerce 3,000+ installs | Cross-site scripting (XSS) CVE-2026-42709 | High 7.1 | Up to 6.0.5 | No fixed version yet | 2 d ago |
| DK 200+ installs | Broken access control CVE-2026-42706 | High 7.5 | Up to 3.2.1 | No fixed version yet | 2 d ago |
| Grand News | Broken access control CVE-2026-42705 | High 7.5 | Up to 3.4 | Check for an update | 2 d ago |
| Kids Care | File inclusion CVE-2026-42704 | High 8.1 | Up to 3.2.4 | Check for an update | 2 d ago |
| Tutor LMS - eLearning and online course solution 100,000+ installs | Cross-site scripting (XSS) CVE-2026-42702 | High 7.1 | Up to 4.1.0 | No fixed version yet | 2 d ago |
| FV Player 8 1,000+ installs | Cross-site scripting (XSS) CVE-2026-42699 | High 7.1 | Up to 8.1.8 | Fixed in a later version (latest 8.1.9) | 2 d ago |
| Social Share Icons & Social Share Buttons 10,000+ installs | Cross-site scripting (XSS) CVE-2026-42697 | High 7.1 | Up to 3.7.5 | Fixed in a later version (latest 3.7.6) | 2 d ago |
| SiteVault - Backup, Restore, Migration & Cloning 30+ installs | Remote code execution CVE-2026-42696 | Critical 10.0 | Up to 1.5.19 | No fixed version yet | 2 d ago |
| Jannah | Cross-site scripting (XSS) CVE-2026-42693 | High 7.1 | Up to 7.6.5 | Check for an update | 2 d ago |
| Events Manager - Calendar, Bookings, Tickets, Appointments and more! 60,000+ installs | SQL injection CVE-2026-42633 | High 8.5 | Up to 7.4.6 | Fixed in a later version (latest 7.4.7) | 2 d ago |
| Qode Real Estate | Cross-site scripting (XSS) CVE-2026-42632 | High 7.1 | Up to 1.1.7.3 | Check for an update | 2 d ago |
| Qode Music | Cross-site scripting (XSS) CVE-2026-42631 | High 7.1 | Up to 2.1.8.2 | Check for an update | 2 d ago |
| Web Plura Backup & Restore - Local Backups, Restore & Recovery | Sensitive data exposure CVE-2026-42630 | High 7.5 | Up to 0.2.25 | No fixed version yet | 2 d ago |
| Swish Migrate and Backup | Sensitive data exposure CVE-2026-42419 | Medium 5.9 | Up to 1.4.0 | No fixed version yet | 2 d ago |
| Jetpack VideoPress 7,000+ installs | Broken access control CVE-2026-40808 | Medium 6.5 | Up to 3.6 | Fixed in a later version (latest 3.7) | 2 d ago |
| PeepSo | Arbitrary file deletion CVE-2026-40805 | High 7.7 | Up to 9.0.5.4 | Check for an update | 2 d ago |
| Jotform - AI Chatbot 5,000+ installs | Cross-site scripting (XSS) CVE-2026-40803 | High 7.1 | Up to 3.8.2 | No fixed version yet | 2 d ago |
| Pubjet | پابجت 1,000+ installs | Broken access control CVE-2026-40802 | High 7.6 | Up to 5.4.8 | No fixed version yet | 2 d ago |
| Wordable - Export Google Docs to WordPress | Broken access control CVE-2026-40801 | High 8.1 | Up to 8.2.10 | Check for an update | 2 d ago |
| ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) 4,000+ installs | SQL injection CVE-2026-40800 | Critical 9.3 | Up to 1.5.3 | No fixed version yet | 2 d ago |
| wpsection 3,000+ installs | Broken access control CVE-2026-40777 | High 8.1 | Up to 1.5.1 | No fixed version yet | 2 d ago |
| Everest Backup - WordPress Cloud Backup, Migration, Restore & Cloning Plugin 3,000+ installs | Remote code execution CVE-2026-39802 | High 8.1 | Up to 2.3.13 | No fixed version yet | 2 d ago |
| AI Copilot - Content Generator | Privilege escalation CVE-2026-39801 | Critical 9.8 | Up to 1.5.9 | Check for an update | 2 d ago |
| Additional Order Filters for WooCommerce 2,000+ installs | Cross-site scripting (XSS) CVE-2026-39800 | High 7.1 | Up to 1.24 | No fixed version yet | 2 d ago |
| WP File Download | Cross-site scripting (XSS) CVE-2026-39799 | High 7.1 | Up to 6.3.6 | Check for an update | 2 d ago |
| Sell Downloads 100+ installs | Broken access control CVE-2026-94590 | Medium 6.5 | Up to 1.2.3 | Fixed in a later version (latest 1.2.4) | 2 d ago |
| drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury | Cross-site scripting (XSS) CVE-2026-57806 | High 7.1 | Up to 3.3.9 | Check for an update | 2 d ago |
| Forminator Forms - Contact Form, Payment Form & Custom Form Builder 600,000+ installs | Privilege escalation CVE-2026-96341 | High 8.2 | Up to 1.57.3 | Fixed in a later version (latest 1.58.0) | 2 d ago |
| miniOrange OTP Login, Verification and SMS Notifications 5,000+ installs | Privilege escalation CVE-2026-106610 | Critical 9.8 | Up to 5.5.7 | No fixed version yet | 2 d ago |
| rtMedia for WordPress, BuddyPress and bbPress 7,000+ installs | Arbitrary file deletion CVE-2026-105892 | Critical 9.8 | Up to 4.7.13 | Fixed in a later version (latest 4.7.14) | 2 d ago |
| Bayarcash WooCommerce 700+ installs | Broken access control CVE-2026-106609 | High 7.5 | Up to 4.4.2 | Fixed in a later version (latest 4.4.3) | 2 d ago |
| WooCommerce 7m+ installs | Privilege escalation CVE-2026-106608 | High 7.2 | Up to 11.1.2 | No fixed version yet | 2 d ago |
| Tickera - Sell Tickets & Manage Events 2,000+ installs | SQL injection CVE-2026-105889 | Critical 9.3 | Up to 3.6.0.6 | No fixed version yet | 2 d ago |
| AFFI - Affiliate Marketing for WooCommerce 10+ installs | PHP object injection CVE-2026-104398 | Critical 9.8 | Up to 1.0.10 | Fixed in a later version (latest 1.0.11) | 2 d ago |
| GIFT4U - Gift Cards All in One for Woo 200+ installs | Broken access control CVE-2026-103357 | Medium 6.9 | Up to 1.1.3 | Fixed in a later version (latest 1.1.4) | 2 d ago |
| Thanko Thank You Page Customizer for WooCommerce - Increase Your Sales 3,000+ installs | Remote code execution CVE-2026-103071 | High 7.5 | Up to 1.2.3 | No fixed version yet | 2 d ago |
| themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras | Cross-site scripting (XSS) CVE-2026-94160 | High 7.1 | Up to 8.4 | Check for an update | 2 d ago |
| Super Video player - Fully Customizable Video Player with Playlist 2,000+ installs | PHP object injection CVE-2026-62044 | High 7.2 | Up to 1.8.13 | No fixed version yet | 2 d ago |
| WPAdverts - Classifieds Plugin 4,000+ installs | Cross-site scripting (XSS) CVE-2026-97264 | High 7.1 | Up to 2.3.4 | No fixed version yet | 2 d ago |
| WP Rollback - Rollback Plugins and Themes 300,000+ installs | Sensitive data exposure CVE-2026-66435 | Medium 5.9 | Up to 3.1.2 | No fixed version yet | 2 d ago |
| WPAdverts - Classifieds Plugin 4,000+ installs | Cross-site scripting (XSS) CVE-2026-97263 | High 7.1 | Up to 2.3.4 | No fixed version yet | 2 d ago |
| Tainacan 1,000+ installs | PHP object injection CVE-2026-94676 | High 7.2 | Up to 1.3.0 | No fixed version yet | 2 d ago |
| Slider by 10Web - Responsive Image Slider 10,000+ installs | PHP object injection CVE-2026-105885 | High 8.8 | Up to 1.2.62 | No fixed version yet | 2 d ago |
| Forminator Forms - Contact Form, Payment Form & Custom Form Builder 600,000+ installs | Cross-site scripting (XSS) CVE-2026-102388 | High 7.1 | Up to 1.57.3 | Fixed in a later version (latest 1.58.0) | 2 d ago |
| HivePress - Business Directory, Listings & Classified Ads Plugin 10,000+ installs | Cross-site scripting (XSS) CVE-2026-107657 | High 7.2 | Up to 1.7.31 | Fixed in a later version (latest 1.7.32) | 2 d ago |
| PeproDev Ultimate Profile Solutions 40+ installs | Cross-site scripting (XSS) CVE-2026-4791 | Medium 6.4 | Up to 8.2.36 | Fixed in a later version (latest 8.3.0) | 2 d ago |
| Listdom: AI-powered Business Directory with Classifieds Ads Listings 1,000+ installs | Remote code execution CVE-2026-104722 | Medium 4.9 | Up to 6.1.2 | No fixed version yet | 2 d ago |
| Divi Plus | Remote code execution CVE-2026-91136 | High 7.5 | Up to 2.4.0 | Check for an update | 2 d ago |
| Bracketweb Zeinet zeinet | Cross-site scripting (XSS) CVE-2026-93951 | High 7.1 | Up to 1.0.0 | Check for an update | 2 d ago |
| Avada | Website Builder For WordPress & WooCommerce | Cross-site scripting (XSS) CVE-2026-97340 | Medium 6.4 | Up to 7.16.1 | Check for an update | 2 d ago |
| WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels 50,000+ installs | Broken access control CVE-2026-93746 | High 7.5 | Up to 5.0.2 | Fixed in a later version (latest 5.0.3) | 2 d ago |
| Premium Packages - Sell Digital Products Securely 2,000+ installs | Cross-site scripting (XSS) CVE-2026-103478 | Medium 6.4 | Up to 7.2.6 | No fixed version yet | 2 d ago |
| WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) 10,000+ installs | Authentication bypass CVE-2026-104759 | High 8.1 | Up to 44.1 | No fixed version yet | 2 d ago |
| Kirki - Freeform Page Builder, Website Builder & Customizer 500,000+ installs | Security weakness CVE-2026-102291 | Medium 5.4 | Up to 6.3.1 | Fixed in a later version (latest 6.3.2) | 2 d ago |
| WP Directory Kit 2,000+ installs | SQL injection CVE-2026-96653 | Medium 6.5 | Up to 1.5.9 | No fixed version yet | 2 d ago |
| AutomatorWP - No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI 7,000+ installs | Broken access control CVE-2026-104728 | Medium 4.3 | Up to 5.8.4 | Fixed in a later version (latest 6.0.4) | 2 d ago |
| SureDash - Community, Courses & Member Dashboard 1,000+ installs | Cross-site scripting (XSS) CVE-2026-102774 | Medium 6.4 | Up to 1.12.1 | No fixed version yet | 2 d ago |
| Email Marketing for WordPress and WooCommerce - Retainful 600+ installs | Cross-site scripting (XSS) CVE-2026-97396 | Medium 6.4 | Up to 1.0.10 | Fixed in a later version (latest 1.0.11) | 2 d ago |
| WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) 10,000+ installs | Cross-site scripting (XSS) CVE-2026-96765 | High 7.2 | Up to 44.1 | No fixed version yet | 2 d ago |
| WPAdverts - Classifieds Plugin 4,000+ installs | Cross-site scripting (XSS) CVE-2026-100178 | High 7.2 | Up to 2.3.4 | No fixed version yet | 2 d ago |
| WPCOM Member 1,000+ installs | Authentication bypass CVE-2026-104803 | Critical 9.8 | Up to 1.7.27 | No fixed version yet | 2 d ago |
| WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More 5m+ installs | Cross-site scripting (XSS) CVE-2026-101921 | Medium 4.7 | Up to 2.0.2.1 | No fixed version yet | 2 d ago |
| Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress 100,000+ installs | SQL injection CVE-2026-96662 | High 7.5 | Up to 5.7.2 | Fixed in a later version (latest 5.7.3) | 2 d ago |
| Molongui Authorship - Author Boxes, Guest Authors & Co-Authors for WordPress 10,000+ installs | Cross-site scripting (XSS) CVE-2026-101920 | High 7.2 | Up to 5.2.12 | No fixed version yet | 2 d ago |
| FunnelKit - Funnel Builder for WooCommerce Checkout 30,000+ installs | Cross-site scripting (XSS) CVE-2026-100147 | High 7.2 | Up to 3.16.0.5 | Fixed in a later version (latest 3.16.0.6) | 2 d ago |
| Motors - Car Dealership & Classified Listings Plugin 9,000+ installs | Cross-site scripting (XSS) CVE-2026-96563 | Medium 6.4 | Up to 1.4.123 | Fixed in a later version (latest 1.4.124) | 2 d ago |
| WP Photo Album Plus 10,000+ installs | Cross-site scripting (XSS) CVE-2026-96278 | High 7.2 | Up to 9.3.03.002 | Fixed in a later version (latest 9.3.03.003) | 2 d ago |
| ThemeREX Group Booklovers booklovers | PHP object injection CVE-2026-62045 | Critical 9.8 | Up to 2.13.0 | Check for an update | 2 d ago |
| Axiomthemes Balance balance | PHP object injection CVE-2026-93945 | Critical 9.8 | Up to 1.12.0 | Check for an update | 2 d ago |
| ThemeREX Group Camelia camelia | PHP object injection CVE-2026-93944 | Critical 9.8 | Up to 1.2.15 | Check for an update | 2 d ago |
| ThemeREX Group Convex convex | PHP object injection CVE-2026-93943 | Critical 9.8 | Up to 1.16.0 | Check for an update | 2 d ago |
| ThemeREX Group Dwell dwell | PHP object injection CVE-2026-93942 | Critical 9.8 | Up to 1.16.0 | Check for an update | 2 d ago |
| ThemeREX Group Gutentype gutentype | PHP object injection CVE-2026-62046 | Critical 9.8 | Up to 2.1.12 | Check for an update | 2 d ago |
| ThemeREX Group Edema edema | PHP object injection CVE-2026-93941 | Critical 9.8 | Up to 1.2.2.2 | Check for an update | 2 d ago |
| ThemeREX Group Greeny greeny | PHP object injection CVE-2026-93940 | Critical 9.8 | Up to 2.10.0 | Check for an update | 2 d ago |
| ThemeREX Group Hogwords hogwords | PHP object injection CVE-2026-93938 | Critical 9.8 | Up to 1.2.7 | Check for an update | 2 d ago |
| ThemeREX Group Hygia hygia | PHP object injection CVE-2026-93937 | Critical 9.8 | Up to 1.21.0 | Check for an update | 2 d ago |
| ThemeREX Group IPharm ipharm | PHP object injection CVE-2026-93936 | Critical 9.8 | Up to 1.2.4 | Check for an update | 2 d ago |
| ThemeREX Group Let's Play playhockey | PHP object injection CVE-2026-93935 | Critical 9.8 | Up to 1.1.15 | Check for an update | 2 d ago |
| ThemeREX Group Partiso partiso | PHP object injection CVE-2026-93934 | Critical 9.8 | Up to 1.1.13 | Check for an update | 2 d ago |
| ThemeREX Group Rosalinda rosalinda | PHP object injection CVE-2026-93933 | Critical 9.8 | Up to 1.2.4 | Check for an update | 2 d ago |
| ThemeREX Group Smart Casa smart-casa | PHP object injection CVE-2026-93932 | Critical 9.8 | Up to 1.0.12 | Check for an update | 2 d ago |
| ThemeREX Group Smash smash | PHP object injection CVE-2026-93931 | Critical 9.8 | Up to 1.12.0 | Check for an update | 2 d ago |
| ThemeREX Group Tantra tantra | PHP object injection CVE-2026-93930 | Critical 9.8 | Up to 2.9.0 | Check for an update | 2 d ago |
| StylemixThemes Motors motors | Broken access control CVE-2026-93950 | High 7.5 | Up to 1.4.108 | Check for an update | 2 d ago |
| Omegathemes Grocery Shopping Store grocery-shopping-store | Authentication bypass CVE-2026-93949 | High 7.1 | Up to 1.3.3 | Check for an update | 2 d ago |
| ThemeREX Group Travesia travesia | PHP object injection CVE-2026-93929 | Critical 9.8 | Up to 1.1.16 | Check for an update | 2 d ago |
| Axiomthemes Veto veto | PHP object injection CVE-2026-93927 | Critical 9.8 | Up to 1.6.0 | Check for an update | 2 d ago |
| YITH WooCommerce Affiliates 6,000+ installs | PHP object injection CVE-2026-106606 | High 7.2 | Up to 3.31.0 | Fixed in a later version (latest 3.31.1) | 2 d ago |
| WP Meteor Website Speed Optimization Addon 20,000+ installs | Cross-site scripting (XSS) CVE-2026-96572 | High 7.2 | Up to 3.4.18 | No fixed version yet | 2 d ago |
| Simple Membership 40,000+ installs | Cross-site scripting (XSS) CVE-2026-103427 | Medium 6.4 | Up to 4.8.4 | No fixed version yet | 2 d ago |
| WP CV Builder 30+ installs | Arbitrary file upload CVE-2026-3717 | Medium 5.3 | Up to 1.3.1 | Fixed in a later version (latest 1.8.14) | 2 d ago |
| 10Web Booster - Website speed optimization, Cache & Page Speed optimizer 70,000+ installs | Cross-site scripting (XSS) CVE-2026-107742 | High 7.2 | Up to 2.34.8 | No fixed version yet | 2 d ago |
| SpeedyCache - Cache, Optimization, Performance 600,000+ installs | Sensitive data exposure CVE-2026-104006 | Low 3.7 | Up to 1.4.2 | No fixed version yet | 2 d ago |
| Team - Team Members Showcase Plugin 10,000+ installs | Cross-site scripting (XSS) CVE-2026-102402 | Medium 6.4 | Up to 6.0.2 | Fixed in a later version (latest 6.0.3) | 2 d ago |
| LazyLoad Plugin - Lazy Load Images, Videos, and Iframes 100,000+ installs | Cross-site scripting (XSS) CVE-2026-100196 | High 7.2 | Up to 2.4.0 | Fixed in a later version (latest 2.4.1) | 2 d ago |
| Frontend Admin by DynamiApps | Cross-site scripting (XSS) CVE-2026-6243 | Medium 6.4 | Up to 3.28.36 | Check for an update | 2 d ago |
| Favicon Rotator 20,000+ installs | Cross-site scripting (XSS) CVE-2026-5725 | Medium 6.1 | Up to 1.2.11 | Fixed in a later version (latest 1.3.0) | 2 d ago |
| WP Booking System - Booking Calendar 10,000+ installs | SQL injection CVE-2026-107712 | Medium 6.5 | Up to 2.1.0.1 | No fixed version yet | 2 d ago |
| WP File Download | Arbitrary file deletion CVE-2026-94538 | High 8.1 | Up to 6.3.9 | Check for an update | 2 d ago |
| Photo Reviews for WooCommerce 10,000+ installs | Cross-site scripting (XSS) CVE-2026-100161 | High 7.2 | Up to 1.2.30 | Fixed in a later version (latest 1.2.31) | 2 d ago |
| Payment Plugins for Stripe WooCommerce 100,000+ installs | Cross-site scripting (XSS) CVE-2026-89100 | Medium 6.1 | Up to 4.0.17 | No fixed version yet | 2 d ago |
| PPOM - Product Addons & Custom Fields for WooCommerce 20,000+ installs | Remote code execution CVE-2026-104801 | Critical 9.1 | Up to 34.0.10 | No fixed version yet | 2 d ago |
| Responsive Lightbox & Gallery 100,000+ installs | Cross-site scripting (XSS) CVE-2026-103897 | Medium 4.4 | Up to 2.7.9 | No fixed version yet | 2 d ago |
| SiteOrigin Widgets Bundle 400,000+ installs | Arbitrary file read CVE-2026-97348 | Medium 6.5 | Up to 1.74.3 | No fixed version yet | 2 d ago |
| Online Scheduling and Appointment Booking System - Bookly 60,000+ installs | PHP object injection CVE-2026-12626 | High 7.2 | Up to 28.2 | Fixed in a later version (latest 28.5) | 2 d ago |
| Post Grid Gutenberg Blocks - PostX 30,000+ installs | Cross-site scripting (XSS) CVE-2026-96840 | High 7.2 | Up to 5.1.0 | No fixed version yet | 2 d ago |
| User Frontend - Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission 20,000+ installs | Cross-site scripting (XSS) CVE-2026-96574 | Medium 6.4 | Up to 4.3.12 | Fixed in a later version (latest 4.3.13) | 2 d ago |
| VikBooking Hotel Booking Engine & PMS 8,000+ installs | Cross-site scripting (XSS) CVE-2026-95684 | High 7.2 | Up to 1.8.15 | No fixed version yet | 2 d ago |
| Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker 40,000+ installs | Cross-site scripting (XSS) CVE-2026-96558 | High 7.2 | Up to 11.2.6 | Fixed in a later version (latest 11.2.7) | 2 d ago |
| Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 700,000+ installs | Broken access control CVE-2026-15178 | Medium 5.4 | Up to 6.2.5 | Fixed in a later version (latest 6.2.15) | 2 d ago |
| SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery 3,000+ installs | Privilege escalation CVE-2026-94257 | High 8.1 | Before 4.0.1 | Fixed in 4.0.1 | 2 d ago |
| SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery 3,000+ installs | Authentication bypass CVE-2026-94256 | High 8.1 | Before 4.0.1 | Fixed in 4.0.1 | 2 d ago |
| LTL Freight Quotes - Worldwide Express Edition 100+ installs | SQL injection CVE-2026-87781 | High 8.6 | Before 4.2.19 | Fixed in 4.2.19 | 2 d ago |
| LTL Freight Quotes - Worldwide Express Edition 100+ installs | Cross-site scripting (XSS) CVE-2026-87780 | High 8.8 | Before 4.2.19 | Fixed in 4.2.19 | 2 d ago |
| Tutor LMS - eLearning and online course solution 100,000+ installs | Broken access control CVE-2026-85571 | Medium 6.5 | Before 4.1.1 | Fixed in 4.1.1 | 2 d ago |
| Gallery PhotoBlocks 3,000+ installs | Cross-site scripting (XSS) CVE-2026-107323 | Medium 6.8 | Before 1.3.6 | Fixed in 1.3.6 | 2 d ago |
| W3 Total Cache 900,000+ installs | Path traversal CVE-2026-107321 | Medium 5.4 | Before 2.10.6 | Fixed in 2.10.6 | 2 d ago |
| Contest Gallery - Upload & Vote Photos, Media, Sell with PayPal & Stripe 1,000+ installs | Authentication bypass CVE-2026-107120 | Medium 5.3 | Before 33.0.1 | Fixed in 33.0.1 | 2 d ago |
| Booking Package 10,000+ installs | Sensitive data exposure CVE-2026-105995 | Medium 5.3 | Before 1.7.30 | Fixed in 1.7.30 | 2 d ago |
| Accept PayPal Payments using Contact Form 7 600+ installs | Sensitive data exposure CVE-2026-105990 | Medium 5.3 | Before 4.0.7 | Fixed in 4.0.7 | 2 d ago |
| Accept PayPal Payments using Contact Form 7 600+ installs | Broken access control CVE-2026-105989 | Medium 5.3 | Before 4.0.7 | Fixed in 4.0.7 | 2 d ago |
| Portfolio Filter Gallery - Photo Gallery 20,000+ installs | Broken access control CVE-2026-105977 | Low 2.2 | Before 2.2.1 | Fixed in 2.2.1 | 2 d ago |
| Portfolio Filter Gallery - Photo Gallery 20,000+ installs | Broken access control CVE-2026-105976 | Medium 4.7 | Before 2.2.1 | Fixed in 2.2.1 | 2 d ago |
| Rank Math SEO - AI SEO Tools to Dominate SEO Rankings 4m+ installs | Cross-site scripting (XSS) CVE-2026-104754 | Low 3.5 | Before 1.0.280 | Fixed in 1.0.280 | 2 d ago |
| Rank Math SEO - AI SEO Tools to Dominate SEO Rankings 4m+ installs | SQL injection CVE-2026-104753 | Medium 4.1 | Before 1.0.280 | Fixed in 1.0.280 | 2 d ago |
| Rank Math SEO - AI SEO Tools to Dominate SEO Rankings 4m+ installs | Remote code execution CVE-2026-104752 | High 7.2 | Before 1.0.280 | Fixed in 1.0.280 | 2 d ago |
| Graphene 10,000+ installs | Cross-site scripting (XSS) CVE-2026-17025 | Medium 6.4 | Up to 2.9.4 | Fixed in a later version (latest 2.9.6) | 2 d ago |
| Easy Digital Downloads - eCommerce Payments and Subscriptions made easy 40,000+ installs | Cross-site scripting (XSS) CVE-2026-14335 | High 7.2 | Up to 3.6.9 | Fixed in a later version (latest 3.7.1.1) | 2 d ago |
| Download Manager 100,000+ installs | Cross-site scripting (XSS) CVE-2026-12054 | Medium 6.1 | Up to 3.3.57 | Fixed in a later version (latest 3.3.72) | 2 d ago |
| Brizy - Page Builder 60,000+ installs | Cross-site scripting (XSS) CVE-2026-14882 | Medium 6.4 | Up to 2.8.18 | Fixed in a later version (latest 2.8.23) | 2 d ago |
| JetFormBuilder - Dynamic Blocks Form Builder 80,000+ installs | Cross-site scripting (XSS) CVE-2026-103912 | Medium 4.7 | Up to 3.6.6 | No fixed version yet | 2 d ago |
| Podlove Podcast Publisher 3,000+ installs | Cross-site scripting (XSS) CVE-2026-93775 | High 7.2 | Up to 4.5.6 | Fixed in a later version (latest 4.5.7) | 2 d ago |
| Data Tables Generator by Supsystic 10,000+ installs | Cross-site scripting (XSS) CVE-2026-14877 | Medium 6.4 | Up to 1.12.03 | Fixed in a later version (latest 1.15.4) | 2 d ago |
| Simple Newsletter Plugin - Noptin 10,000+ installs | Cross-site scripting (XSS) CVE-2026-103482 | Medium 5.4 | Up to 4.3.10 | No fixed version yet | 2 d ago |
| GiveWP - Donation Plugin and Fundraising Platform 100,000+ installs | Cross-site scripting (XSS) CVE-2026-97643 | Medium 6.4 | Up to 4.17.0 | Fixed in a later version (latest 4.18.0.1) | 2 d ago |
| LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes 10,000+ installs | PHP object injection CVE-2026-104723 | High 8.8 | Up to 10.2.1 | No fixed version yet | 2 d ago |
| Presto Player 100,000+ installs | Cross-site scripting (XSS) CVE-2026-96682 | High 7.2 | Up to 4.5.1 | Fixed in a later version (latest 4.5.3) | 2 d ago |
| Groundhogg - CRM, Newsletters, and Marketing Automation 2,000+ installs | Privilege escalation CVE-2026-92975 | High 8.1 | Up to 4.8.3 | Fixed in a later version (latest 4.9.2) | 2 d ago |
| Kadence Blocks - Page Builder Toolkit for Gutenberg Editor 600,000+ installs | Cross-site scripting (XSS) CVE-2026-104762 | Medium 6.4 | Up to 3.7.12 | No fixed version yet | 2 d ago |
| Embed Any Document - Embed PDF, Word, PowerPoint and Excel Files 50,000+ installs | Cross-site scripting (XSS) CVE-2026-18558 | Medium 6.4 | Up to 2.7.13 | Fixed in a later version (latest 2.7.14) | 2 d ago |
| GeoDirectory - WP Business Directory Plugin and Classified Listings Directory 10,000+ installs | File inclusion CVE-2026-104899 | High 8.1 | Up to 2.8.187 | Fixed in a later version (latest 2.8.191) | 2 d ago |
| Church Admin 900+ installs | Cross-site scripting (XSS) CVE-2026-94421 | Medium 6.4 | Up to 5.1.2 | Fixed in a later version (latest 5.1.4) | 2 d ago |
| Getwid - Gutenberg Blocks 50,000+ installs | Cross-site scripting (XSS) CVE-2026-91862 | Medium 6.4 | Up to 3.0.1 | Fixed in a later version (latest 3.0.2) | 2 d ago |
| FooSales - Point of Sale (POS) for WooCommerce 700+ installs | Privilege escalation CVE-2026-77183 | High 8.8 | Up to 1.43.0 | Fixed in a later version (latest 1.43.4) | 2 d ago |
| Real Estate Manager - Property Listing and Agent Management | Cross-site scripting (XSS) CVE-2026-96667 | High 7.2 | Up to 7.3 | Check for an update | 2 d ago |
| Order Export & Order Import for WooCommerce 60,000+ installs | Sensitive data exposure CVE-2026-94375 | Medium 5.3 | Up to 2.7.8 | No fixed version yet | 2 d ago |
| Post Export Import with Media 1,000+ installs | Arbitrary file read CVE-2026-104763 | Medium 4.9 | Up to 1.17.1 | No fixed version yet | 2 d ago |
| Groundhogg - CRM, Newsletters, and Marketing Automation 2,000+ installs | Privilege escalation CVE-2026-104725 | High 8.8 | Up to 4.9 | Fixed in a later version (latest 4.9.2) | 2 d ago |
| HivePress - Business Directory, Listings & Classified Ads Plugin 10,000+ installs | Cross-site scripting (XSS) CVE-2026-103520 | Medium 6.4 | Up to 1.7.31 | Fixed in a later version (latest 1.7.32) | 2 d ago |
| FV Player 8 1,000+ installs | Remote code execution CVE-2026-83526 | High 8.8 | Up to 8.1.7 | Fixed in a later version (latest 8.1.9) | 2 d ago |
| MP3 Audio Player - Music Player, Podcast Player & Radio by Sonaar 20,000+ installs | Cross-site scripting (XSS) CVE-2026-16776 | Medium 6.4 | Up to 5.14.2 | No fixed version yet | 2 d ago |
| GamiPress - Gamification plugin to reward points, badges & ranks in WordPress, now with AI 10,000+ installs | Cross-site scripting (XSS) CVE-2026-14379 | Medium 6.4 | Up to 7.9.4 | Fixed in a later version (latest 8.0.6) | 2 d ago |
| Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress 100,000+ installs | Privilege escalation CVE-2026-104766 | High 8.8 | Up to 5.7.3 | No fixed version yet | 2 d ago |
| AI Puffer - AI Chatbot, AI Writer & Automation 10,000+ installs | Broken access control CVE-2026-104742 | Low 3.1 | Up to 2.4.89 | Fixed in a later version (latest 2.4.97) | 2 d ago |
| Table Field Add-on for ACF and SCF 50,000+ installs | Cross-site scripting (XSS) CVE-2026-78068 | Medium 6.4 | Up to 1.3.35 | Fixed in a later version (latest 1.4.1) | 2 d ago |
| AI Puffer - AI Chatbot, AI Writer & Automation 10,000+ installs | Broken access control CVE-2026-104741 | Low 3.1 | Up to 2.4.89 | Fixed in a later version (latest 2.4.97) | 2 d ago |
| Smart Popup by Supsystic 10,000+ installs | SQL injection CVE-2026-104023 | Medium 4.9 | Up to 1.13.2 | No fixed version yet | 2 d ago |
| Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress 100,000+ installs | Broken access control CVE-2026-91050 | Medium 4.3 | Up to 5.7.2 | Fixed in a later version (latest 5.7.3) | 2 d ago |
| Booking Calendar 40,000+ installs | Sensitive data exposure CVE-2026-18496 | Medium 5.3 | Up to 11.4.3 | Fixed in a later version (latest 11.9) | 2 d ago |
| rtMedia for WordPress, BuddyPress and bbPress 7,000+ installs | Broken access control CVE-2026-89301 | High 7.5 | Up to 4.7.13 | Fixed in a later version (latest 4.7.14) | 2 d ago |
| Avada (Fusion) Builder | Denial of service CVE-2026-97670 | Critical 9.1 | Up to 7.16.1 | Check for an update | 2 d ago |
| Fastcache by Host.it 1,000+ installs | Remote code execution CVE-2026-104021 | High 7.2 | Up to 1.7.4 | Fixed in a later version (latest 1.7.6) | 2 d ago |
| Download Manager 100,000+ installs | Cross-site scripting (XSS) CVE-2026-9696 | Medium 6.4 | Up to 3.3.58 | Fixed in a later version (latest 3.3.72) | 2 d ago |
| FireBox - WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment 6,000+ installs | SQL injection CVE-2026-104724 | Medium 5.3 | Up to 3.1.13 | Fixed in a later version (latest 3.1.14) | 2 d ago |
| Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder 30,000+ installs | Cross-site scripting (XSS) CVE-2026-103998 | Medium 6.1 | Up to 1.15.48 | Fixed in a later version (latest 1.15.49) | 2 d ago |
| Simply Schedule Appointments 50,000+ installs | Broken access control CVE-2026-6723 | Medium 5.3 | Up to 1.6.11.11 | Fixed in a later version (latest 1.6.12.33) | 2 d ago |
| Anti-Spam by CleanTalk - Spam Protection Without CAPTCHA 200,000+ installs | Cross-site scripting (XSS) CVE-2026-103424 | Medium 5.4 | Up to 6.88 | Fixed in a later version (latest 6.89.1) | 2 d ago |
| Filter Everything - WordPress & WooCommerce Filters 50,000+ installs | Cross-site scripting (XSS) CVE-2026-87869 | Medium 6.1 | Up to 1.9.6 | Fixed in a later version (latest 1.9.7) | 2 d ago |
| RSS Aggregator by Feedzy - Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 40,000+ installs | Cross-site scripting (XSS) CVE-2026-104735 | Medium 6.4 | Up to 5.2.10 | Fixed in a later version (latest 5.2.11) | 2 d ago |
| Download Manager 100,000+ installs | Authentication bypass CVE-2026-103964 | Medium 4.3 | Up to 3.3.71 | Fixed in a later version (latest 3.3.72) | 2 d ago |
| FV Flowplayer Video Player 10,000+ installs | Cross-site scripting (XSS) CVE-2026-97630 | Medium 6.4 | Up to 7.5.54.7212 | Fixed in a later version (latest 7.5.55.7212) | 2 d ago |
| Hello Plus 70,000+ installs | Broken access control CVE-2026-5727 | Medium 5.4 | Up to 1.7.7 | Fixed in a later version (latest 1.7.8) | 2 d ago |
| Download Manager 100,000+ installs | Cross-site scripting (XSS) CVE-2026-102401 | Medium 6.4 | Up to 3.3.71 | Fixed in a later version (latest 3.3.72) | 2 d ago |
| 3D Product configurator for WooCommerce 100+ installs | Remote code execution CVE-2026-103889 | Critical 9.8 | Up to 2.16.2 | Fixed in a later version (latest 2.16.3) | 2 d ago |
| Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 700,000+ installs | Cross-site scripting (XSS) CVE-2026-101324 | Medium 4.7 | Up to 6.2.14 | Fixed in a later version (latest 6.2.15) | 2 d ago |
| Data Tables Generator by Supsystic 10,000+ installs | Cross-site scripting (XSS) CVE-2026-96648 | Medium 6.4 | Up to 1.15.1 | Fixed in a later version (latest 1.15.4) | 2 d ago |
| GeoDirectory - WP Business Directory Plugin and Classified Listings Directory 10,000+ installs | Cross-site scripting (XSS) CVE-2026-104993 | Medium 6.4 | Up to 2.8.188 | Fixed in a later version (latest 2.8.191) | 2 d ago |
| Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) 5,000+ installs | Remote code execution CVE-2026-94589 | Critical 9.8 | Up to 3.4.5 | Fixed in a later version (latest 3.4.6) | 2 d ago |
| Advanced IP Blocker 2,000+ installs | Authentication bypass CVE-2026-104732 | Critical 9.8 | Up to 8.13.13 | Fixed in a later version (latest 8.13.15) | 2 d ago |
| Online Scheduling and Appointment Booking System - Bookly 60,000+ installs | Sensitive data exposure CVE-2026-103365 | Medium 5.3 | Up to 28.4 | Fixed in a later version (latest 28.5) | 2 d ago |
| Table Field Add-on for ACF and SCF 50,000+ installs | Cross-site scripting (XSS) CVE-2026-96743 | Medium 6.4 | Up to 1.4.1-RC2 | No fixed version yet | 2 d ago |
| Blocksy Companion 300,000+ installs | Privilege escalation CVE-2026-107645 | Critical 9.1 | Up to 2.1.58 | Fixed in a later version (latest 2.1.59) | 2 d ago |
| Advanced Form Integration - Connect Forms to 300+ Apps 9,000+ installs | Privilege escalation CVE-2026-104797 | High 8.1 | Up to 2.9.0 | Fixed in a later version (latest 2.10.0) | 2 d ago |
| Online Scheduling and Appointment Booking System - Bookly 60,000+ installs | Privilege escalation CVE-2026-104898 | Medium 6.8 | Up to 28.4 | Fixed in a later version (latest 28.5) | 2 d ago |
| Advanced Classifieds & Directory Pro 2,000+ installs | Cross-site scripting (XSS) CVE-2026-93883 | Medium 6.4 | Up to 3.4.4 | Fixed in a later version (latest 3.5.0) | 2 d ago |
| Academy LMS - AI Course Builder, Quizzes, Certificates & eLearning 2,000+ installs | Privilege escalation CVE-2026-104022 | Medium 5.4 | Up to 4.0.3 | Fixed in a later version (latest 4.0.4) | 2 d ago |
| Academy LMS - AI Course Builder, Quizzes, Certificates & eLearning 2,000+ installs | Broken access control CVE-2026-104915 | Medium 6.5 | Up to 4.0.3 | Fixed in a later version (latest 4.0.4) | 2 d ago |
| FV Flowplayer Video Player 10,000+ installs | Cross-site scripting (XSS) CVE-2026-42695 | Medium 6.5 | Up to 7.5.54.7212 | Fixed in a later version (latest 7.5.55.7212) | 3 d ago |
| WP Post Author - Author Box, Multiple Authors, Guest Authors & Custom Avatars 10,000+ installs | SQL injection CVE-2026-108125 | High 7.1 | Before 4.1.0 | Fixed in 4.1.0 | 3 d ago |
| WP Post Author - Author Box, Multiple Authors, Guest Authors & Custom Avatars 10,000+ installs | SQL injection CVE-2026-108124 | Medium 4.9 | Before 4.1.0 | Fixed in 4.1.0 | 3 d ago |
| Fuelthemes The Voux thevoux-wp | File inclusion CVE-2026-94067 | High 8.1 | Up to 6.9.5 | Check for an update | 3 d ago |
| SpabRice Pond pond | Cross-site scripting (XSS) CVE-2026-94066 | High 7.1 | Up to 2.6.1 | Check for an update | 3 d ago |
| BuddhaThemes ColorFolio colorit | PHP object injection CVE-2026-94065 | High 8.8 | Up to 1.3 | Check for an update | 3 d ago |
| BuddhaThemes Neo | Barber Shop WordPress Theme neocut | PHP object injection CVE-2026-94064 | High 8.8 | Up to 3.5 | Check for an update | 3 d ago |
| ThemeREX Education Center education | Cross-site scripting (XSS) CVE-2026-94063 | High 7.1 | Up to 3.6.12 | Check for an update | 3 d ago |
| Dashboard Notes 500+ installs | Cross-site request forgery (CSRF) CVE-2026-62026 | High 7.1 | Up to 1.0.3 | No fixed version yet | 3 d ago |
| Fuelthemes Werkstatt werkstatt | File inclusion CVE-2026-94062 | High 8.1 | Up to 4.8.3 | Check for an update | 3 d ago |
| Designthemes Whistle - Sports Club whistle-sports-club | Cross-site scripting (XSS) CVE-2026-94061 | High 7.1 | Up to 4.2 | Check for an update | 3 d ago |
| Bracketweb Voldor voldor | Cross-site scripting (XSS) CVE-2026-94060 | High 7.1 | Up to 1.0.0 | Check for an update | 3 d ago |
| Bracketweb Ogency ogency | Cross-site scripting (XSS) CVE-2026-94059 | High 7.1 | Up to 1.0.0 | Check for an update | 3 d ago |
| Bracketweb Treck treck | Cross-site scripting (XSS) CVE-2026-94058 | High 7.1 | Up to 1.0.0 | Check for an update | 3 d ago |
| Before After Image Comparison - Visual Comparison for Two Images 3,000+ installs | Broken access control CVE-2026-62028 | Medium 5.4 | Up to 1.1.21 | No fixed version yet | 3 d ago |
| ThemeHunk Th Shop Mania th-shop-mania | Broken access control CVE-2026-105883 | High 7.1 | Up to 1.9.1 | Check for an update | 3 d ago |
| Jetpack - WP Security, Backup, Speed, & Growth 3m+ installs | Authentication bypass CVE-2026-106602 | Medium 4.8 | Up to 16.2 | No fixed version yet | 3 d ago |
| Jetpack - WP Security, Backup, Speed, & Growth 3m+ installs | Authentication bypass CVE-2026-106601 | Medium 5.4 | Up to 16.2 | No fixed version yet | 3 d ago |
| QA Assistants - Driven by data 2,000+ installs | Sensitive data exposure CVE-2026-105877 | Medium 6.9 | Up to 5.3.0.0 | No fixed version yet | 3 d ago |
| Product Configurator for WooCommerce 3,000+ installs | PHP object injection CVE-2026-105872 | High 7.2 | Up to 1.7.5 | No fixed version yet | 3 d ago |
| WP Associate Post R2 2,000+ installs | Cross-site scripting (XSS) CVE-2026-105870 | High 7.1 | Up to 5.0.1 | Fixed in a later version (latest 5.0.2) | 3 d ago |
| AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress 5,000+ installs | Cross-site scripting (XSS) CVE-2026-105318 | High 7.1 | Up to 11.1.0 | Fixed in a later version (latest 11.1.1) | 3 d ago |
| Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker 40,000+ installs | PHP object injection CVE-2026-104392 | High 8.8 | Up to 11.2.7 | No fixed version yet | 3 d ago |
| Envira Gallery - Image Photo Gallery, Albums, Video Gallery, Slideshows & More 100,000+ installs | Broken access control CVE-2026-104079 | Medium 5.3 | Before 1.16.2 | Fixed in 1.16.2 | 3 d ago |
| WPFunnels - Funnel Builder for WooCommerce with Checkout & One Click Upsell 5,000+ installs | Cross-site scripting (XSS) CVE-2026-62029 | Medium 6.5 | Up to 3.13.3 | No fixed version yet | 3 d ago |
| All Bootstrap Blocks | Broken access control CVE-2026-62036 | Medium 4.3 | Up to 1.3.31 | Check for an update | 3 d ago |
| Asgaros Forum 10,000+ installs | Broken access control CVE-2026-39779 | Medium 4.3 | Up to 3.4.0 | No fixed version yet | 3 d ago |
| HTML5 Audio Player - The Ultimate No-Code Podcast, MP3 & Audio Player 10,000+ installs | Cross-site scripting (XSS) CVE-2026-62039 | Medium 6.5 | Up to 2.8.8 | No fixed version yet | 3 d ago |
| Restrict User Access - Ultimate Membership & Content Protection 10,000+ installs | Broken access control CVE-2026-62040 | Medium 5.3 | Up to 2.8.1 | No fixed version yet | 3 d ago |
| WP Event Manager - Events Calendar, Registrations, Sell Tickets with WooCommerce 20,000+ installs | Broken access control CVE-2026-62041 | Medium 5.4 | Up to 3.4.1 | No fixed version yet | 3 d ago |
| Scripts n Styles 30,000+ installs | Broken access control CVE-2026-62042 | Medium 5.3 | Up to 3.5.8 | No fixed version yet | 3 d ago |
| AutoPoly - AI Translation For Polylang 5,000+ installs | Broken access control CVE-2026-107419 | Medium 5.4 | Up to 1.6.2 | Fixed in a later version (latest 1.6.3) | 3 d ago |
| Livees Checkout 100+ installs | Broken access control CVE-2026-86851 | Medium 6.5 | Up to 7.0.2 | Fixed in a later version (latest 7.0.3) | 3 d ago |
| Super Payments - WooCommerce Payment Gateway 200+ installs | Security weakness CVE-2026-103329 | Medium 5.3 | Before 1.43.1 | Fixed in 1.43.1 | 3 d ago |
| Shipping for Nova Poshta | Broken access control CVE-2026-87846 | Medium 5.3 | Up to 1.19.8 | Check for an update | 3 d ago |
| Testimonials by BestWebSoft | SQL injection CVE-2026-89235 | Medium 6.8 | Up to 1.0.8 | Check for an update | 3 d ago |
| GDPR Data Request Form | Cross-site request forgery (CSRF) CVE-2026-85348 | Medium 4.3 | Up to 1.7.1 | Check for an update | 3 d ago |
| bkninja Gloria Admin Panel gloria-admin-panel | Cross-site scripting (XSS) CVE-2026-94158 | High 7.1 | Up to 1.3 | Check for an update | 3 d ago |
| Shinetheme Traveler traveler | SQL injection CVE-2026-93947 | Critical 9.3 | Up to 3.2.9 | Check for an update | 3 d ago |
| User Registration & Membership - Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 50,000+ installs | Broken access control CVE-2026-96334 | Medium 5.6 | Up to 5.2.7 | Fixed in a later version (latest 5.2.8) | 3 d ago |
| PX-lab Zombify zombify | Arbitrary file upload CVE-2026-94503 | Critical 10.0 | Up to 1.7.7 | Check for an update | 3 d ago |
| Social Sharing Plugin - Sassy Social Share 100,000+ installs | Cross-site scripting (XSS) CVE-2026-94170 | High 7.1 | Up to 3.3.79 | No fixed version yet | 3 d ago |
| Kubio AI Page Builder 80,000+ installs | Cross-site scripting (XSS) CVE-2026-94167 | High 7.1 | Up to 2.9.3 | No fixed version yet | 3 d ago |
| ThemeGoods Grand Restaurant grandrestaurant | Cross-site scripting (XSS) CVE-2026-94161 | High 7.1 | Before 7.0.11 | Fixed in 7.0.11 | 3 d ago |
| KlbTheme Total Donations totaldonations | Cross-site scripting (XSS) CVE-2026-94159 | High 7.1 | Up to 2.0.5 | Check for an update | 3 d ago |
| NEX-Forms - Ultimate Forms Plugin for WordPress 6,000+ installs | Cross-site scripting (XSS) CVE-2026-96607 | High 7.1 | Up to 9.3.1 | Fixed in a later version (latest 9.3.2) | 3 d ago |
| Simple Payment 40+ installs | Cross-site scripting (XSS) CVE-2026-96332 | High 7.1 | Up to 2.5.4 | Fixed in a later version (latest 2.5.6) | 3 d ago |
| Generate PDF using Contact Form 7 4,000+ installs | Arbitrary file read CVE-2026-94666 | High 7.5 | Up to 4.2.1 | Fixed in a later version (latest 4.2.2) | 3 d ago |
| PDF for Contact Form 7 + Drag and Drop Template Builder 500+ installs | Arbitrary file read CVE-2026-94664 | High 7.5 | Up to 7.1.0 | Fixed in a later version (latest 7.2.0) | 3 d ago |
| Advanced Partial Payment or Deposit for WooCommerce 100+ installs | Broken access control CVE-2026-95589 | Medium 6.5 | Up to 4.0.1 | Fixed in a later version (latest 4.0.23) | 3 d ago |
| Salon Booking System - Appointment Booking for Salons, Barbershops & Spas 2,000+ installs | Cross-site scripting (XSS) CVE-2026-94668 | High 7.1 | Up to 10.31.5 | Fixed in a later version (latest 10.31.7) | 3 d ago |
| Crocoblock JetReviews jet-reviews | Cross-site scripting (XSS) CVE-2026-94667 | Medium 6.5 | Up to 3.1.2 | Check for an update | 3 d ago |
| Classified Listing - AI-Powered Classified ads & Business Directory 9,000+ installs | Cross-site scripting (XSS) CVE-2026-94665 | Medium 6.5 | Up to 6.1.2 | Fixed in a later version (latest 6.1.5) | 3 d ago |
| ProfileGrid - User Profiles, Groups and Communities 5,000+ installs | SQL injection CVE-2026-94663 | High 8.5 | Up to 6.0.0.2 | Fixed in a later version (latest 6.0.0.3) | 3 d ago |
| Crocoblock JetBlog jet-blog | Cross-site scripting (XSS) CVE-2026-94661 | High 7.1 | Up to 2.4.10 | Check for an update | 3 d ago |
| EduAdmin Booking 60+ installs | SQL injection CVE-2026-96809 | Critical 9.3 | Before 6.0.0 | Fixed in 6.0.0 | 3 d ago |
| UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP 20,000+ installs | Cross-site scripting (XSS) CVE-2026-94641 | High 7.1 | Up to 1.2.73 | Fixed in a later version (latest 1.2.76) | 3 d ago |
| BlockStrap Page Builder - Bootstrap Blocks 2,000+ installs | Cross-site scripting (XSS) CVE-2026-94632 | High 7.1 | Up to 0.1.58 | Fixed in a later version (latest 0.1.61) | 3 d ago |
| Muffingroup Betheme betheme | Cross-site scripting (XSS) CVE-2026-94415 | High 7.1 | Up to 28.5.8 | Check for an update | 3 d ago |
| Welcart e-Commerce 10,000+ installs | Cross-site scripting (XSS) CVE-2026-96761 | High 7.1 | Up to 2.12.3 | Fixed in a later version (latest 2.12.4) | 3 d ago |
| UpSolution UpSolution Core us-core | Cross-site scripting (XSS) CVE-2026-94166 | High 7.1 | Up to 8.44 | Check for an update | 3 d ago |
| Featured Image from URL (FIFU) 60,000+ installs | Cross-site request forgery (CSRF) CVE-2026-96671 | High 8.8 | Up to 6.0.7 | Fixed in a later version (latest 6.1.1) | 3 d ago |
| wpdreams Ajax Search Pro ajax-search-pro | SQL injection CVE-2026-96331 | Critical 9.3 | Up to 4.29.1 | Check for an update | 3 d ago |
| tagDiv tagDiv Opt-In Builder td-subscription | SQL injection CVE-2026-96330 | Critical 9.3 | Up to 1.7.6 | Check for an update | 3 d ago |
| tagDiv tagDiv Opt-In Builder td-subscription | SQL injection CVE-2026-96329 | High 8.5 | Up to 1.7.6 | Check for an update | 3 d ago |
| jegtheme JNews - Pay Writer jnews-pay-writer | SQL injection CVE-2026-96328 | Critical 9.3 | Up to 12.0.1 | Check for an update | 3 d ago |
| Media Library Assistant 70,000+ installs | Cross-site scripting (XSS) CVE-2026-95609 | High 7.1 | Up to 3.41 | Fixed in a later version (latest 3.42) | 3 d ago |
| Taskbuilder - Project Management & Task Management Tool With Kanban Board 700+ installs | SQL injection CVE-2026-95599 | High 8.5 | Up to 6.0.5 | Fixed in a later version (latest 6.0.6) | 3 d ago |
| Search in Place 3,000+ installs | Cross-site scripting (XSS) CVE-2026-95598 | High 7.1 | Up to 1.5.5 | Fixed in a later version (latest 1.5.7) | 3 d ago |
| 워드프레스 결제 심플페이 - 우커머스 결제 플러그인 1,000+ installs | Broken access control CVE-2026-95597 | Medium 6.5 | Up to 5.5.17 | Fixed in a later version (latest 5.5.20) | 3 d ago |
| ShopBuilder - WooCommerce Builder For Elementor 10,000+ installs | Cross-site scripting (XSS) CVE-2026-95596 | High 7.1 | Up to 3.4.1 | Fixed in a later version (latest 3.4.2) | 3 d ago |
| VikBooking Hotel Booking Engine & PMS 8,000+ installs | Cross-site scripting (XSS) CVE-2026-95591 | High 7.1 | Up to 1.8.14 | Fixed in a later version (latest 1.8.15) | 3 d ago |
| Pay with Vipps and MobilePay for WooCommerce 5,000+ installs | PHP object injection CVE-2026-94568 | High 7.2 | Up to 6.2.0 | Fixed in a later version (latest 6.3.1) | 3 d ago |
| VibeThemes WPLMS wplms_plugin | SQL injection CVE-2026-96327 | Critical 9.3 | Before 1.9.9.8.2 | Fixed in 1.9.9.8.2 | 3 d ago |
| HUSKY - Products Filter for WooCommerce Professional 80,000+ installs | Cross-site scripting (XSS) CVE-2026-95608 | High 7.1 | Up to 1.4.3.2 | Fixed in a later version (latest 1.4.5) | 3 d ago |
| VibeThemes WPLMS wplms | SQL injection CVE-2026-95607 | High 8.5 | Up to 4.973 | Check for an update | 3 d ago |
| Booking for Appointments and Events Calendar - Amelia 90,000+ installs | Broken access control CVE-2026-96461 | High 7.5 | Up to 2.4.10 | Fixed in a later version (latest 2.4.11) | 3 d ago |
| UpSolution UpSolution Core us-core | SQL injection CVE-2026-95610 | High 8.5 | Up to 9.3 | Check for an update | 3 d ago |
| FiboSearch - Ajax Search for WooCommerce 100,000+ installs | Cross-site scripting (XSS) CVE-2026-96553 | High 7.1 | Up to 1.34.1 | Fixed in a later version (latest 1.34.3) | 3 d ago |
| Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 200,000+ installs | Privilege escalation CVE-2026-96539 | Medium 5.6 | Up to 2.13.1 | Fixed in a later version (latest 2.14.0) | 3 d ago |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress 100,000+ installs | Broken access control CVE-2026-96518 | Medium 5.9 | Up to 4.17.3 | Fixed in a later version (latest 4.17.5) | 3 d ago |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress 100,000+ installs | Broken access control CVE-2026-96337 | Medium 6.5 | Up to 4.17.3 | Fixed in a later version (latest 4.17.5) | 3 d ago |
| GiveWP - Donation Plugin and Fundraising Platform 100,000+ installs | Authentication bypass CVE-2026-96333 | High 7.5 | Up to 4.16.8.1 | Fixed in a later version (latest 4.18.0.1) | 3 d ago |
| Forminator Forms - Contact Form, Payment Form & Custom Form Builder 600,000+ installs | Authentication bypass CVE-2026-96336 | High 7.5 | Up to 1.57.2 | Fixed in a later version (latest 1.58.0) | 3 d ago |
| Crocoblock JetBlocks For Elementor jet-blocks | Cross-site scripting (XSS) CVE-2026-62049 | Medium 6.5 | Up to 1.5.2.1 | Check for an update | 3 d ago |
| Kirki - Freeform Page Builder, Website Builder & Customizer 500,000+ installs | Server-side request forgery (SSRF) CVE-2026-84224 | Medium 4.1 | Before 6.3.2 | Fixed in 6.3.2 | 3 d ago |
| Kirki - Freeform Page Builder, Website Builder & Customizer 500,000+ installs | Security weakness CVE-2026-84220 | Medium 4.8 | Before 6.3.2 | Fixed in 6.3.2 | 3 d ago |
| WP Media WP Rocket wp-rocket | Broken access control CVE-2026-97075 | Medium 6.5 | Before 3.23.5 | Fixed in 3.23.5 | 3 d ago |
| Redux Framework 900,000+ installs | Privilege escalation CVE-2025-14123 | Medium 6.8 | Up to 4.5.11 | Fixed in a later version (latest 4.5.15) | 3 d ago |
| WP Media WP Rocket wp-rocket | Remote code execution CVE-2026-97076 | High 7.5 | Before 3.23.5 | Fixed in 3.23.5 | 3 d ago |
| Ocean Pro Demos | Cross-site scripting (XSS) CVE-2026-81929 | High 7.2 | Up to 1.5.4 | Check for an update | 3 d ago |
| FooSales - Point of Sale (POS) for WooCommerce 700+ installs | Privilege escalation CVE-2026-93548 | High 8.8 | Before 1.43.3 | Fixed in 1.43.3 | 3 d ago |
| Code Snippets 1m+ installs | SQL injection CVE-2026-106097 | Medium 6.8 | Before 3.10.0 | Fixed in 3.10.0 | 3 d ago |
| UnitechPay | Broken access control CVE-2026-87841 | Medium 5.3 | Up to 1.0.6.3 | Check for an update | 3 d ago |
| Code Snippets 1m+ installs | Broken access control CVE-2026-106095 | Low 3.3 | Before 3.10.0 | Fixed in 3.10.0 | 3 d ago |
| AWP Classifieds 3,000+ installs | Remote code execution CVE-2025-15700 | High 8.8 | Before 4.4.9 | Fixed in 4.4.9 | 3 d ago |
| SendPress Newsletters | Sensitive data exposure CVE-2026-92990 | Medium 5.3 | Up to 1.26.1.20 | Check for an update | 3 d ago |
| SendPress Newsletters | Broken access control CVE-2026-92989 | Medium 4.3 | Up to 1.26.1.20 | Check for an update | 3 d ago |
| Social Web Suite | Broken access control CVE-2026-88931 | Medium 5.3 | Up to 4.1.12 | Check for an update | 3 d ago |
| SKU Error Fixer for WooCommerce | Broken access control CVE-2026-86850 | Medium 6.5 | Up to 1.0 | Check for an update | 3 d ago |
| aBlocks - Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder 2,000+ installs | Cross-site scripting (XSS) CVE-2026-40804 | High 7.1 | Up to 2.16.0 | No fixed version yet | 4 d ago |
| MainWP Child - Securely Connects to the MainWP Dashboard to Manage Multiple Sites 700,000+ installs | PHP object injection CVE-2026-105436 | High 8.8 | Up to 6.2.1 | No fixed version yet | 4 d ago |
| Zotpress 2,000+ installs | Cross-site scripting (XSS) CVE-2026-27420 | Medium 6.5 | Up to 7.4.4 | No fixed version yet | 4 d ago |
| Tutor LMS - eLearning and online course solution 100,000+ installs | Security weakness CVE-2026-42698 | Medium 5.3 | Up to 4.1.1 | No fixed version yet | 4 d ago |
| WP Plugin Info Card 500+ installs | Cross-site scripting (XSS) CVE-2026-62127 | Medium 6.5 | Up to 6.3.5 | No fixed version yet | 4 d ago |
| Creator LMS - WordPress LMS Plugin for Coaches, Cohorts & Course Creators 90+ installs | Broken access control CVE-2026-62128 | Medium 5.3 | Up to 1.2.21 | Fixed in a later version (latest 1.2.22) | 4 d ago |
| Forminator Forms - Contact Form, Payment Form & Custom Form Builder 600,000+ installs | Cross-site request forgery (CSRF) CVE-2026-106611 | High 7.1 | Up to 1.57.3 | Fixed in a later version (latest 1.58.0) | 4 d ago |
| Event Tickets and Registration 90,000+ installs | Broken access control CVE-2026-105893 | Medium 5.3 | Up to 5.30.0.1 | Fixed in a later version (latest 5.30.0.2) | 4 d ago |
| MasterStudy LMS WordPress Plugin - for Online Courses and Education 10,000+ installs | Cross-site scripting (XSS) CVE-2026-105079 | Medium 6.5 | Up to 3.7.52 | No fixed version yet | 4 d ago |
| Event Tickets and Registration 90,000+ installs | Broken access control CVE-2026-105891 | Medium 4.3 | Up to 5.30.0.1 | Fixed in a later version (latest 5.30.0.2) | 4 d ago |
| VillaTheme Core 50+ installs | Broken access control CVE-2026-103072 | Medium 4.3 | Up to 1.0.5 | Fixed in a later version (latest 1.0.6) | 4 d ago |
| Kadence Blocks - Page Builder Toolkit for Gutenberg Editor 600,000+ installs | Cross-site scripting (XSS) CVE-2026-105890 | Medium 6.5 | Up to 3.7.12 | No fixed version yet | 4 d ago |
| Event Tickets and Registration 90,000+ installs | Broken access control CVE-2026-105888 | Medium 5.4 | Up to 5.30.0.1 | Fixed in a later version (latest 5.30.0.2) | 4 d ago |
| WP Store Locator 50,000+ installs | Cross-site scripting (XSS) CVE-2026-105078 | Medium 6.5 | Up to 3.0.3 | No fixed version yet | 4 d ago |
| Visual Composer Website Builder 40,000+ installs | Broken access control CVE-2026-106596 | Medium 5.3 | Up to 45.16.3 | No fixed version yet | 4 d ago |
| Robo Gallery - Photo & Image Slider 40,000+ installs | Cross-site scripting (XSS) CVE-2026-105887 | Medium 6.5 | Up to 5.1.6 | No fixed version yet | 4 d ago |
| ShortPixel Image Optimizer - Optimize Images, Convert WebP & AVIF 300,000+ installs | Cross-site scripting (XSS) CVE-2026-103070 | Medium 6.5 | Up to 6.5.6 | No fixed version yet | 4 d ago |
| Ultimate Post Kit - Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets 30,000+ installs | Broken access control CVE-2026-105886 | Medium 6.5 | Up to 4.5.5 | No fixed version yet | 4 d ago |
| Vitepos - Point of Sale (POS) for WooCommerce 1,000+ installs | SQL injection CVE-2026-105076 | High 7.6 | Up to 3.6.1 | No fixed version yet | 4 d ago |
| WP 2FA - Two-factor authentication for WordPress 100,000+ installs | Cross-site request forgery (CSRF) CVE-2026-62142 | High 8.8 | Up to 4.1.0 | No fixed version yet | 4 d ago |
| YITH WooCommerce Product Bundles 3,000+ installs | Broken access control CVE-2026-105878 | Medium 5.3 | Up to 2.29.0 | Fixed in a later version (latest 2.30.0) | 4 d ago |
| HollerBox - Fast & Effective Popups & Lead-Generation 2,000+ installs | Broken access control CVE-2026-106603 | Medium 6.5 | Up to 2.3.14 | Fixed in a later version (latest 2.3.15) | 4 d ago |
| WPComplete 1,000+ installs | Cross-site scripting (XSS) CVE-2026-66479 | High 7.1 | Up to 2.9.5.6 | Fixed in a later version (latest 2.9.5.7) | 4 d ago |
| GiveWP - Donation Plugin and Fundraising Platform 100,000+ installs | Broken access control CVE-2026-106600 | Medium 5.3 | Up to 4.18.0 | Fixed in a later version (latest 4.18.0.1) | 4 d ago |
| Wallet System for WooCommerce - Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments 2,000+ installs | Security weakness CVE-2026-93509 | Medium 6.5 | Before 2.8.0 | Fixed in 2.8.0 | 4 d ago |
| Easy Digital Downloads - eCommerce Payments and Subscriptions made easy 40,000+ installs | Broken access control CVE-2026-105190 | Medium 5.3 | Before 3.7.1 | Fixed in 3.7.1 | 4 d ago |
| TutorStarter 10,000+ installs | Broken access control CVE-2026-104671 | Medium 5.3 | Before 4.0.4 | Fixed in 4.0.4 | 4 d ago |
| Airwallex Online Payments Gateway 6,000+ installs | Security weakness CVE-2026-103517 | Medium 5.3 | Before 1.36.0 | Fixed in 1.36.0 | 4 d ago |
| Bricksforge | Arbitrary file upload CVE-2026-85097 | Critical 9.8 | Up to 3.1.8.9 | Check for an update | 4 d ago |
| Track Orders for WooCommerce - Multi Carrier WooCommerce Shipping 200+ installs | Sensitive data exposure CVE-2026-94275 | Medium 5.3 | Before 1.2.7 | Fixed in 1.2.7 | 4 d ago |
| SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery 3,000+ installs | Sensitive data exposure CVE-2026-94258 | Low 2.7 | Before 4.0.1 | Fixed in 4.0.1 | 4 d ago |
| Wallet System for WooCommerce - Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments 2,000+ installs | Broken access control CVE-2026-94246 | Medium 6.3 | Before 2.8.0 | Fixed in 2.8.0 | 4 d ago |
| Wallet System for WooCommerce - Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments 2,000+ installs | Broken access control CVE-2026-94245 | Medium 6.5 | Before 2.8.0 | Fixed in 2.8.0 | 4 d ago |
| Wallet System for WooCommerce - Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments 2,000+ installs | Sensitive data exposure CVE-2026-94244 | Medium 4.3 | Before 2.8.0 | Fixed in 2.8.0 | 4 d ago |
| BackWPup - WordPress Backup & Restore Plugin 400,000+ installs | Remote code execution CVE-2026-86828 | Medium 6.6 | Before 5.7.7 | Fixed in 5.7.7 | 4 d ago |
| BackWPup - WordPress Backup & Restore Plugin 400,000+ installs | Broken access control CVE-2026-86827 | Medium 5.3 | Before 5.7.7 | Fixed in 5.7.7 | 4 d ago |
| BackWPup - WordPress Backup & Restore Plugin 400,000+ installs | Sensitive data exposure CVE-2026-86826 | Medium 5.9 | Before 5.7.7 | Fixed in 5.7.7 | 4 d ago |
| Database Addon For WPForms ( wpforms entries ) - WPFormsDB 20,000+ installs | Cross-site request forgery (CSRF) CVE-2026-105260 | Medium 4.3 | Before 1.1.1 | Fixed in 1.1.1 | 4 d ago |
| Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress 100,000+ installs | Broken access control CVE-2026-105198 | Medium 5.3 | Before 5.7.3 | Fixed in 5.7.3 | 4 d ago |
| Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress 100,000+ installs | Broken access control CVE-2026-105197 | Low 2.7 | Before 5.6.5 | Fixed in 5.6.5 | 4 d ago |
| Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress 100,000+ installs | Broken access control CVE-2026-105196 | Low 3.3 | Before 5.6.9 | Fixed in 5.6.9 | 4 d ago |
| Booking Calendar 40,000+ installs | Sensitive data exposure CVE-2026-105195 | Low 2.7 | Before 11.8.3 | Fixed in 11.8.3 | 4 d ago |
| Easy Digital Downloads - eCommerce Payments and Subscriptions made easy 40,000+ installs | Sensitive data exposure CVE-2026-105194 | Medium 4.3 | Before 3.7.1 | Fixed in 3.7.1 | 4 d ago |
| Booking Calendar 40,000+ installs | Sensitive data exposure CVE-2026-105193 | Medium 4.8 | Before 11.8 | Fixed in 11.8 | 4 d ago |
| Image Photo Gallery Final Tiles Grid 20,000+ installs | Cross-site scripting (XSS) CVE-2026-104646 | Medium 6.8 | Before 3.6.14 | Fixed in 3.6.14 | 4 d ago |
| Image Photo Gallery Final Tiles Grid 20,000+ installs | Broken access control CVE-2026-104645 | Low 2.7 | Before 3.6.14 | Fixed in 3.6.14 | 4 d ago |
| Frontend Dashboard 500+ installs | Privilege escalation CVE-2026-103692 | Critical 9.8 | Before 3.0.5 | Fixed in 3.0.5 | 4 d ago |
| Ultimate Multisite - WordPress Multisite SaaS & WaaS Platform 70+ installs | Authentication bypass CVE-2026-103646 | Critical 9.8 | Before 2.17.0 | Fixed in 2.17.0 | 4 d ago |
| GPTranslate - Multilingual AI Translation Agent for WordPress: Translate Your Site with AI 500+ installs | Cross-site scripting (XSS) CVE-2026-103309 | High 7.5 | Before 2.34.14 | Fixed in 2.34.14 | 4 d ago |
| Super Forms - Drag & Drop Form Builder | Arbitrary file upload CVE-2026-17609 | Critical 9.1 | Up to 6.3.316 | Check for an update | 4 d ago |
| Super Forms - Drag & Drop Form Builder | Remote code execution CVE-2026-17196 | High 8.8 | Up to 6.3.316 | Check for an update | 4 d ago |
| Uncanny Automator - AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included 40,000+ installs | Arbitrary file deletion CVE-2026-82627 | High 7.5 | Up to 7.6.1.1 | Fixed in a later version (latest 7.7.0) | 4 d ago |
| LatePoint - Appointment Booking & Reservation | Broken access control CVE-2026-17538 | Medium 5.4 | Up to 5.6.9 | Check for an update | 5 d ago |
| Aurora Heatmap 10,000+ installs | Cross-site scripting (XSS) CVE-2026-94154 | Medium 6.1 | Up to 1.7.2 | Fixed in a later version (latest 1.7.3) | 5 d ago |
| Forminator Forms - Contact Form, Payment Form & Custom Form Builder 600,000+ installs | Broken access control CVE-2026-96335 | High 7.5 | Up to 1.57.2 | Fixed in a later version (latest 1.58.0) | 5 d ago |
| The Events Calendar 600,000+ installs | PHP object injection CVE-2026-95606 | Critical 9.8 | Up to 6.17.4 | Fixed in a later version (latest 6.18.0) | 5 d ago |
| WP Data Access - App Builder for Tables, Forms, Charts, Maps & Dashboards 10,000+ installs | SQL injection CVE-2026-95605 | Critical 9.3 | Up to 5.5.82 | Fixed in a later version (latest 5.5.85) | 5 d ago |
| Disable and Remove Google Fonts | GDPR & DSGVO friendly 100,000+ installs | Cross-site scripting (XSS) CVE-2026-95595 | High 7.1 | Up to 2.0.2 | Fixed in a later version (latest 2.0.3) | 5 d ago |
| Unlimited Elements for Elementor 300,000+ installs | PHP object injection CVE-2026-95534 | High 8.8 | Up to 2.0.19 | Fixed in a later version (latest 2.0.21) | 5 d ago |
| Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 90,000+ installs | Cross-site scripting (XSS) CVE-2026-94670 | High 7.1 | Up to 3.6.1 | Fixed in a later version (latest 3.6.2) | 5 d ago |
| Unlimited Elements for Elementor 300,000+ installs | Cross-site scripting (XSS) CVE-2026-94662 | High 7.1 | Up to 2.0.19 | Fixed in a later version (latest 2.0.21) | 5 d ago |
| WP Post Author - Author Box, Multiple Authors, Guest Authors & Custom Avatars 10,000+ installs | SQL injection CVE-2026-42708 | High 7.6 | Up to 4.0.0 | No fixed version yet | 5 d ago |
| Slider by 10Web - Responsive Image Slider 10,000+ installs | SQL injection CVE-2026-42710 | High 7.6 | Up to 1.2.63 | No fixed version yet | 5 d ago |
| Post title marquee scroll | SQL injection CVE-2026-42713 | High 7.6 | Up to 9.9 | Check for an update | 5 d ago |
| Pix por Piggly (para Woocommerce) 4,000+ installs | SQL injection CVE-2026-42714 | High 7.6 | Up to 2.1.2 | No fixed version yet | 5 d ago |
| Dynamic User Directory 1,000+ installs | SQL injection CVE-2026-42720 | High 7.6 | Up to 2.4 | No fixed version yet | 5 d ago |
| affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display 2,000+ installs | SQL injection CVE-2026-42721 | High 7.6 | Up to 3.9.1 | No fixed version yet | 5 d ago |
| sc Internet Vivoo WP Rentals wprentals | Broken access control CVE-2026-27434 | Medium 5.3 | Up to 3.14.2 | Check for an update | 5 d ago |
| Booktics - Appointment Booking Calendar for Service Businesses 800+ installs | Broken access control CVE-2026-104390 | Medium 4.3 | Up to 1.0.27 | Fixed in a later version (latest 1.0.28) | 5 d ago |
| Modula Image Gallery - Photo Grid & Video Gallery 100,000+ installs | Broken access control CVE-2026-105876 | Medium 5.3 | Up to 3.0.11 | No fixed version yet | 5 d ago |
| HappyAddons for Elementor - 160 Elementor Widgets, GSAP Animations & Templates 400,000+ installs | Cross-site scripting (XSS) CVE-2026-104393 | Medium 6.5 | Up to 3.50.0 | Fixed in a later version (latest 3.50.1) | 5 d ago |
| Prime Slider - Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons 100,000+ installs | Cross-site scripting (XSS) CVE-2026-105875 | Medium 6.5 | Up to 4.6.2 | Fixed in a later version (latest 4.7.0) | 5 d ago |
| Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker 40,000+ installs | Cross-site scripting (XSS) CVE-2026-104391 | Medium 6.5 | Up to 11.2.7 | No fixed version yet | 5 d ago |
| Hustle - Email Marketing, Lead Generation, Optins, Popups 90,000+ installs | Broken access control CVE-2026-103075 | Medium 4.3 | Up to 7.8.14.2 | No fixed version yet | 5 d ago |
| LazyLoad Plugin - Lazy Load Images, Videos, and Iframes 100,000+ installs | Cross-site scripting (XSS) CVE-2026-105884 | Medium 6.5 | Up to 2.4.0 | Fixed in a later version (latest 2.4.1) | 5 d ago |
| Element Pack Addons for Elementor - Elementor Widgets, Elementor Templates, Elementor Addons 100,000+ installs | Cross-site scripting (XSS) CVE-2026-105873 | Medium 6.5 | Up to 8.8.6 | Fixed in a later version (latest 8.8.7) | 5 d ago |
| Media Library Assistant 70,000+ installs | Cross-site scripting (XSS) CVE-2026-97294 | Medium 6.5 | Up to 3.41 | Fixed in a later version (latest 3.42) | 5 d ago |
| Element Pack Addons for Elementor - Elementor Widgets, Elementor Templates, Elementor Addons 100,000+ installs | Cross-site scripting (XSS) CVE-2026-105871 | Medium 6.5 | Up to 8.8.6 | Fixed in a later version (latest 8.8.7) | 5 d ago |
| OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. 300,000+ installs | Cross-site scripting (XSS) CVE-2026-89417 | High 7.2 | Up to 6.3.10 | Fixed in a later version (latest 6.3.12) | 5 d ago |
| Nexi XPay Build | Security weakness CVE-2026-82212 | High 7.5 | Up to 7.6.2 | Check for an update | 5 d ago |
| Nexi XPay Build | Broken access control CVE-2026-82211 | High 8.2 | Up to 7.6.2 | Check for an update | 5 d ago |
| Magee Shortcodes | Security weakness CVE-2026-105322 | Medium 5.3 | Up to 2.1.1 | Check for an update | 5 d ago |
| MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor 600,000+ installs | Content injection CVE-2026-86833 | Medium 5.4 | Before 4.3.1 | Fixed in 4.3.1 | 5 d ago |
| PowerPress Podcasting plugin by Blubrry 20,000+ installs | Server-side request forgery (SSRF) CVE-2026-97354 | Medium 4.1 | Before 11.17.11 | Fixed in 11.17.11 | 5 d ago |
| User Private Files - Secure File Sharing and Client Portal Plugin 1,000+ installs | Sensitive data exposure CVE-2026-97331 | Medium 4.3 | Before 2.1.9 | Fixed in 2.1.9 | 5 d ago |
| String locator 100,000+ installs | Remote code execution CVE-2026-97188 | High 8.8 | Before 2.6.8 | Fixed in 2.6.8 | 5 d ago |
| Optimole - Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization 200,000+ installs | Sensitive data exposure CVE-2026-96530 | Medium 6.5 | Before 4.2.15 | Fixed in 4.2.15 | 5 d ago |
| If-So Dynamic Content - Elementor & All Page Builders Personalization 7,000+ installs | Cross-site scripting (XSS) CVE-2026-87971 | High 7.1 | Before 1.10.2 | Fixed in 1.10.2 | 5 d ago |
| Koinonia Link 10+ installs | Privilege escalation CVE-2026-87782 | High 8.8 | Before 1.1.5 | Fixed in 1.1.5 | 5 d ago |
| WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System 5,000+ installs | Sensitive data exposure CVE-2026-86816 | Medium 5.3 | Before 3.0.21 | Fixed in 3.0.21 | 5 d ago |
| Magee Shortcodes | Cross-site scripting (XSS) CVE-2026-105316 | High 7.1 | Up to 2.1.1 | Check for an update | 5 d ago |
| MPG - Multiple Page Generator, Bulk Landing Pages & Programmatic SEO 2,000+ installs | SQL injection CVE-2026-104953 | Medium 6.8 | Before 4.2.3 | Fixed in 4.2.3 | 5 d ago |
| CP Media Player - Audio Player and Video Player 3,000+ installs | Broken access control CVE-2026-104678 | Low 2.7 | Before 1.3.4 | Fixed in 1.3.4 | 5 d ago |
| WP Coder - Insert & Manage Code Snippets 10,000+ installs | Remote code execution CVE-2026-104677 | High 7.2 | Before 4.5.2 | Fixed in 4.5.2 | 5 d ago |
| Animated Number Counters 2,000+ installs | SQL injection CVE-2026-104667 | Medium 6.8 | Before 3.1 | Fixed in 3.1 | 5 d ago |
| Envira Gallery - Image Photo Gallery, Albums, Video Gallery, Slideshows & More 100,000+ installs | Cross-site scripting (XSS) CVE-2026-104653 | Medium 6.8 | Before 1.16.1 | Fixed in 1.16.1 | 5 d ago |
| Envira Gallery - Image Photo Gallery, Albums, Video Gallery, Slideshows & More 100,000+ installs | Cross-site scripting (XSS) CVE-2026-104652 | Medium 6.8 | Before 1.16.1 | Fixed in 1.16.1 | 5 d ago |
| Yaad Sarig Payment Gateway For WC 2,000+ installs | Broken access control CVE-2026-104651 | Medium 4.3 | Before 2.2.13 | Fixed in 2.2.13 | 5 d ago |
| Academy LMS - AI Course Builder, Quizzes, Certificates & eLearning 2,000+ installs | Broken access control CVE-2026-104050 | Medium 4.3 | Before 4.0.0 | Fixed in 4.0.0 | 5 d ago |
| Academy LMS - AI Course Builder, Quizzes, Certificates & eLearning 2,000+ installs | Broken access control CVE-2026-104049 | Medium 4.3 | Before 4.0.0 | Fixed in 4.0.0 | 5 d ago |
| Frontend Dashboard 500+ installs | Broken access control CVE-2026-103681 | Medium 4.3 | Before 3.0.0 | Fixed in 3.0.0 | 5 d ago |
| Geliver Akıllı Kargo Pazaryeri 400+ installs | Sensitive data exposure CVE-2026-103378 | Medium 6.5 | Before 3.1.1 | Fixed in 3.1.1 | 5 d ago |
| Integration for Epos Now and WooCommerce 300+ installs | Broken access control CVE-2026-103323 | Medium 5.9 | Before 4.11.2 | Fixed in 4.11.2 | 5 d ago |
| Kirki - Freeform Page Builder, Website Builder & Customizer 500,000+ installs | Cross-site scripting (XSS) CVE-2026-102173 | High 7.2 | Up to 6.3.1 | Fixed in a later version (latest 6.3.2) | 5 d ago |
| WordPress core | Sensitive data exposure CVE-2026-66666 | Medium 6.9 | Up to 6.6.9 | Check for an update | 6 d ago |
| Motors - Car Dealership & Classified Listings Plugin 9,000+ installs | Sensitive data exposure CVE-2026-104399 | Medium 6.9 | Up to 1.4.124 | No fixed version yet | 6 d ago |
| Paid Membership Subscriptions - Effortless Memberships, Recurring Payments & Content Restriction 10,000+ installs | SQL injection CVE-2026-105317 | High 8.5 | Up to 3.1.1 | No fixed version yet | 6 d ago |
| SiteVault - Backup, Restore, Migration & Cloning 30+ installs | Sensitive data exposure CVE-2026-105071 | High 7.5 | Up to 1.5.17 | Fixed in a later version (latest 1.5.18) | 6 d ago |
| Salon Booking System - Appointment Booking for Salons, Barbershops & Spas 2,000+ installs | Privilege escalation CVE-2026-105070 | High 8.8 | Up to 10.31.7 | No fixed version yet | 6 d ago |
| WP Mailster 300+ installs | Cross-site scripting (XSS) CVE-2026-105061 | High 7.1 | Up to 1.9.0.0 | No fixed version yet | 6 d ago |
| WP Comment Cleaner - Delete All Comments, Disable Comments, Bulk Delete & Remove Comments 20,000+ installs | Broken access control CVE-2026-105059 | Medium 6.5 | Up to 7.1 | Fixed in a later version (latest 7.2) | 6 d ago |
| WP User Profiles 200+ installs | Privilege escalation CVE-2026-105058 | High 8.8 | Up to 2.7.3 | Fixed in a later version (latest 2.7.4) | 6 d ago |
| Zero Spam for WordPress 20,000+ installs | Security weakness CVE-2026-105057 | Medium 5.3 | Up to 5.7.11 | No fixed version yet | 6 d ago |
| Form Block 200+ installs | Cross-site scripting (XSS) CVE-2026-104814 | High 7.1 | Up to 1.8.1 | Fixed in a later version (latest 1.8.2) | 6 d ago |
| Import and export users and customers 70,000+ installs | Privilege escalation CVE-2026-104757 | High 7.2 | Up to 2.5.5 | No fixed version yet | 6 d ago |
| Haaken | PHP object injection CVE-2026-104747 | High 8.1 | Up to 1.5 | Check for an update | 6 d ago |
| GiveWP - Donation Plugin and Fundraising Platform 100,000+ installs | Cross-site scripting (XSS) CVE-2026-104672 | High 7.1 | Up to 4.17.0 | Fixed in a later version (latest 4.18.0.1) | 6 d ago |
| LearnPress - WordPress LMS Plugin for Create and Sell Online Courses 70,000+ installs | Cross-site scripting (XSS) CVE-2026-104670 | High 7.1 | Up to 4.4.9 | Fixed in a later version (latest 4.4.9.1) | 6 d ago |
| picu - Online Photo Proofing Gallery 2,000+ installs | Broken access control CVE-2026-104406 | High 7.3 | Up to 3.10.1 | Fixed in a later version (latest 3.10.2) | 6 d ago |
| GiveWP - Donation Plugin and Fundraising Platform 100,000+ installs | Privilege escalation CVE-2026-104405 | High 8.1 | Up to 4.17.0 | Fixed in a later version (latest 4.18.0.1) | 6 d ago |
| picu - Online Photo Proofing Gallery 2,000+ installs | Cross-site scripting (XSS) CVE-2026-104395 | High 7.1 | Up to 3.10.1 | Fixed in a later version (latest 3.10.2) | 6 d ago |
| Charitable - Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) 10,000+ installs | Cross-site scripting (XSS) CVE-2026-104394 | High 7.1 | Up to 1.8.12.3 | Fixed in a later version (latest 1.8.13) | 6 d ago |
| PowerPress Podcasting plugin by Blubrry 20,000+ installs | Broken access control CVE-2026-104387 | High 7.2 | Up to 11.17.9 | No fixed version yet | 6 d ago |
How to triage new WordPress vulnerabilities
Start with relevance, not the headline severity alone. Check whether the affected plugin, theme or WordPress core version is actually installed on your site, then compare your installed version with the vulnerable range in the record.
Among relevant disclosures, unauthenticated vulnerabilities usually deserve faster attention because an attacker may not need a valid account. High and critical severity issues also merit prompt review, especially where the affected component is public facing. CVSS is useful for severity, but it is not a complete measure of your site's risk, so read the access conditions and affected versions as well.
If a fixed version exists, take a current backup and update promptly. If there is no fix, decide whether the component can be disabled, removed or replaced until a safe release is available. On an important production site, test disruptive changes on staging where possible.
After patching, do not treat the update itself as proof that nothing happened beforehand. If the issue was serious or had been public for some time, review administrator accounts, unexpected file changes, redirects, new pages and security logs. For broader maintenance advice, see our WordPress maintenance guidance.
Sources and further reading
Common questions
Answers to the questions we hear most about this.
How recent are the vulnerabilities on this page?
The table shows WordPress vulnerability records published in the last 7 days, with the newest records first.
Which new WordPress vulnerabilities should I act on first?
Prioritise vulnerabilities that affect software you actually run. Give particular attention to unauthenticated issues, high or critical severity records and disclosures where a fixed version is already available.
What if a vulnerability has no fix yet?
Consider disabling, removing or replacing the affected component until a safe version is available, while accounting for any business function the plugin or theme provides.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.