Last week, there were 240 vulnerabilities disclosed in 184 WordPress Plugins and 17 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 105 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back. Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free. Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. New Firewall Rules Deployed Last Week The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection. The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week: WAF-RULE-952 – Data redacted while we work with the vendor on a patch. Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay. Total Unpatched & Patched Vulnerabilities Last Week Patch Status Number of Vulnerabilities Patched 166 Unpatched 74 Total Vulnerabilities by CVSS Severity Last Week Severity Rating Number of Vulnerabilities Medium Severity 111 High Severity 112 Critical Severity 17 Total Vulnerabilities by CWE Type Last Week Vulnerability Type by CWE Number of Vulnerabilities Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 73 Missing Authorization 42 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 27 Deserialization of Untrusted Data 14 Improper Privilege Management 12 Authorization Bypass Through User-Controlled Key 11 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 11 Exposure of Sensitive Information to an Unauthorized Actor 10 Unrestricted Upload of File with Dangerous Type 10 Improper Control of Generation of Code ('Code Injection') 8 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 5 Cross-Site Request Forgery (CSRF) 3 Improper Authentication 3 Client-Side Enforcement of Server-Side Security 2 Server-Side Request Forgery (SSRF) 2 Unverified Password Change 2 Improper Authorization 1 Improper Input Validation 1 Incorrect Authorization 1 Incorrect Privilege Assignment 1 Weak Password Recovery Mechanism for Forgotten Password 1 Researchers That Contributed to WordPress Security Last Week Researcher Name Number of Vulnerabilities daroo 19 Ananda Dhakal 17 dutafi 16 Tran Nguyen Bao Khanh 12 Jakub Herman 10 Asim Alshaya 9 Erwan LR 8 Nguyen Ba Khanh 6 Wordfence PRISM 6 Shikhali Jamalzade 5 Farid Narimanov 5 Nabil Irawan 5 Austin Ginder 4 Denver Jackson 4 Muni Nitish Kumar Yaddala 4 João Pedro S Alcântara (Kinorth) 3 V1T 3 20kilograma 3 Athiwat Tiprasaharn (Jitlada) 3 hivesec 2 Revanth Hari Narayana Matte 2 nh4tvd 2 Osvaldo Noe Gonzalez Del Rio (Os) 2 hackthesoul 2 Shivamani Vastrala 2 Meher Sudhakar Abbireddi 2 Trương Hữu Phúc 2 Van Phuc 2 moonge 2 Mohammed Abd Alrahman 2 sequence_X0 2 Bonds 2 João Pedro S Alcântara 2 Pedro Pinho 2 Abdullah Kareem "cyberkareem" 2 Mokksh Parekh 1 Mohamed Bassia 1 Ezekiel Victor 1 Tin Pham (TF1T) 1 Ronnachai Sretawat Na Ayutaya (Simonhaskelly) 1 Ruwantha Harshamal 1 João Ramos Maciel 1 timomangcut 1 Jorgson 1 Ahmed Hassan 1 stealthcopter 1 Deva Parekh 1 rootdirective.sec 1 Taylsec 1 0xd4rk5id3 1 Son Bach 1 Lan Vy 1 Supakiad S. (m3ez) 1 Charles Vosburgh 1 Noman Riffat 1 Khaled Alenazi 1 Andrés Cruciani 1 Mustafa Ahmed 1 dunvu0 1 Abi Wiranata 1 zickzick2 1 Yaswanth Reddy Sunkara 1 luc 1 Raihan Adi Arba 1 Evan NR 1 Xanlar Agamalizade 1 Décio Brandão 1 Khanh Nguyen 1 Peter Thaleikis 1 PPzzAArr 1 VanTastic 1 RIA Labs 1 arrester 1 João Ramos Maciel and Theo Antonio da Fonseca 1 doc4cash 1 Md. Minaruzzaman Shovon 1 Brian Willows 1 Tiago Ventura 1 Ayoub MOUHATTA 1 ParkHyunWoo 1 Suhayb Ahmed 1 Samdup Choephel 1 hhhai 1 Itthidej Aramsri (Boeing777) 1 tipsen 1 Webbernaut 1 Abdullah Kareem 1 Quốc Huy (jtwings) 1 Jarno Vos 1 Aydan Arabadzha 1 Sanjar Tulkinov 1 Christian Kold Jensen 1 Ian Ho Shim 1 testoun 1 Quentin Lamour 1 Thaer Assfour 1 Elijah Chia 1 Khuong Hai 1 Thanh Nam 1 UKO 1 Peng Zhou 1 Nir Yehoshua 1 Luka Zimonjic 1 babyhack 1 Pham Duc Anh 1 Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report. WordPress Plugins with Reported Vulnerabilities Last Week Software Name Software Slug 10Web Booster – Website speed optimization, Cache & Page Speed optimizer tenweb-speed-optimizer 12 Step Meeting List 12-step-meeting-list Abandoned Cart Pro for WooCommerce woocommerce-abandon-cart-pro Admin and Site Enhancements (ASE) admin-site-enhancements Advance Product Search- Voice & Ajax Search for WooCommerce th-advance-product-search Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution file-manager-advanced Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce Affiliates Manager affiliates-manager AI Agent by SiteGround sg-ai-studio All-in-One WP Migration and Backup all-in-one-wp-migration Appointment Hour Booking – Booking Calendar appointment-hour-booking Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback atarim-visual-collaboration Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code automation-web-platform AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress automatorwp Autopay platnosci-online-blue-media B2Bking b2bking B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More b2bking-wholesale-for-woocommerce BBQ Pro bbq-pro Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots bp-better-messages Booking calendar, Appointment Booking System booking-calendar BookingPress Appointment Booking Pro bookingpress-appointment-booking-pro Broken Link Checker broken-link-checker CatFolders Document Gallery & PDF Library catfolders-document-gallery Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) charitable Community by PeepSo – Download from PeepSo.com peepso-core Contact Form by Supsystic contact-form-by-supsystic Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery Depicter — Popup & Slider Builder depicter Digits: WordPress Mobile Number Signup and Login digits Dinatur dinatur Directory Pro directory-pro Draft List simple-draft-list Duitku Payment Gateway duitku-social-payment-gateway DynamicKit for Elementor dynamickit-elementor E-cab Taxi Booking Manager for Woocommerce ecab-taxi-booking-manager Easy Appointments easy-appointments Easy Elementor Addons – Addons Pack for Elementor Page Builder easy-elementor-addons Easy Media Replace easy-media-replace EasyTest – Simplify A/B Testing convertpro ECS – Ele Custom Skin for Elementor ele-custom-skin Elementor Website Builder Pro elementor-pro EPROLO-Dropshipping eprolo-dropshipping eShipper Commerce eshipper-commerce Estatik Real Estate Plugin estatik Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce wp-event-solution Events Made Easy events-made-easy EWWW Image Optimizer ewww-image-optimizer Extra Product Options Builder for WooCommerce additional-product-fields-for-woocommerce Featured Video Plus featured-video-plus Flatastic - Versatile MultiVendor WordPress Theme flatastic Flexible Subscriptions flexible-subscriptions Fluent Forms Pro Add On Pack fluentformpro Flutterwave WooCommerce rave-woocommerce-payment-gateway Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder form-maker Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator Frontend Admin by DynamiApps acf-frontend-form-element FundEngine – Donation and Crowdfunding Platform wp-fundraising-donation GEO Plugin by Squirrly SEO squirrly-seo GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory Global Gallery - WordPress Responsive Gallery global-gallery Golo Framework golo-framework GP Premium gp-premium Greenshift – animation and page builder blocks greenshift-animation-and-page-builder-blocks GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor gutenkit-blocks-addon HashBar – Announcement, Notification Bar & Popup Campaign hashbar-wp-notification-bar Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite InfiniteWP Client iwp-client Issues and Series for Newspapers, Magazines, Publishers, Writers organize-series JetAppointment jet-appointments-booking JetEngine jet-engine JSON Options json-options Kalles Addons kalles-addons Kirki – Freeform Page Builder, Website Builder & Customizer kirki KiviCare – Clinic & Patient Management System (EHR) kivicare-clinic-management-system kk Star Ratings – Rate Post & Collect User Feedbacks kk-star-ratings Leyka leyka License Manager for WooCommerce license-manager-for-woocommerce Locatoraid Store Locator locatoraid Login With Ajax – Fast Logins, 2FA, Redirects login-with-ajax Mailgun for WordPress mailgun Manual Image Crop manual-image-crop Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system MC4WP: Mailchimp for WordPress mailchimp-for-wp Media Library Assistant media-library-assistant Membership For WooCommerce membership-for-woocommerce miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon miniorange-login-openid Modal Survey - WordPress Poll, Survey & Quiz Plugin modal-survey MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics makewebbetter-hubspot-for-woocommerce New User Approve new-user-approve Newsletter – Send awesome emails from WordPress newsletter NGG Smart Image Search ngg-smart-image-search Nikstore Core nikstore-core Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More notification-master NotificationX Pro notificationx-pro Online Contact Widget-多合一在线客服插件 online-contact-widget OptionTree option-tree Outranking Plugin Options outranking Pay with Contact Form 7 pay-with-contact-form-7 Paymob for WooCommerce paymob-for-woocommerce PDF Smart Viewer for Elementor pdf-smart-viewer-for-elementor Persistent Login wp-persistent-login Piraeus Bank WooCommerce Payment Gateway woo-payment-gateway-for-piraeus-bank Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress Post Duplicator post-duplicator PPWP – Password Protect Pages password-protect-page Premium Packages – Sell Digital Products Securely wpdm-premium-packages Product Shortlist product-shortlist Query Wrangler query-wrangler Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker quiz-master-next Readabler readabler Recipe Card Blocks Lite recipe-card-blocks-by-wpzoom RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login custom-registration-form-builder-with-submission-manager Restaurant Menu and Food Ordering mp-restaurant-menu Royal Addons for Elementor – Addons and Templates Kit for Elementor royal-elementor-addons rtMedia for WordPress, BuddyPress and bbPress buddypress-media SAML Single Sign On – SSO Login miniorange-saml-20-single-sign-on Security Hardener security-hardener Security Plugin, Firewall & Malware Scanner with Auto Removal security-malware-firewall ShopMonitor.io – Automated Checkout & Form Monitoring shopmonitorio Simple File List simple-file-list Simple JWT Login – Allows you to use JWT on REST endpoints. simple-jwt-login SimplyRETS Real Estate IDX simply-rets Slider by 10Web – Responsive Image Slider slider-wd Smart Popup by Supsystic popup-by-supsystic SmartCrawl SEO checker, analyzer & optimizer smartcrawl-seo SmartSMTP smart-smtp Social Media Share Buttons & Social Sharing Icons ultimate-social-media-icons Speed Optimizer – The All-In-One Performance-Boosting Plugin sg-cachepress Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons sticky-chat-widget Stitch Express stitch-express Super Store Finder superstorefinder-wp SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent supportcandy Swatchly – Product Variation Swatches for WooCommerce swatchly TabaPay Gateway tabapay-gateway Table Of Contents Block table-of-contents-block Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms simple-tags Tagembed: Social Media Feeds and Customer Reviews Widget tagembed-widget Templatiq templatiq Themify Builder themify-builder Tonda Core tonda-core Total Donations totaldonations Track Geolocation Of Users Using Contact Form 7 track-geolocation-of-users-using-contact-form-7 TranslatePress – Translate Multilingual sites with AI Translation translatepress-multilingual TrueBooker – Appointment Booking and Scheduler System truebooker-appointment-booking Typing Effect animated-typing-effect Ultimate Dashboard – Custom WordPress Dashboard ultimate-dashboard Ultimate Maps by Supsystic ultimate-maps-by-supsystic URL Shortify – Simple and Easy URL Shortener url-shortify User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin user-registration-pro User Verification by PickPlugins user-verification Verdure Core verdure-core Video Conferencing with Zoom video-conferencing-with-zoom-api Visualizer – Tables & Charts Manager with Built-in AI Generator visualizer W3 Total Cache w3-total-cache WCFM Marketplace – Multivendor Marketplace for WooCommerce wc-multivendor-marketplace WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels print-invoices-packing-slip-labels-for-woocommerce Wise Chat wise-chat WP BASE Booking of Appointments, Services and Events wp-base-booking-of-appointments-services-and-events WP Cafe Pro wpcafe-pro WP Compress – Instant Performance & Speed Optimization wp-compress-image-optimizer WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards wp-data-access WP Directory Kit wpdirectorykit WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters wp-google-map-plugin WP Multilang – Translation and Multilingual Plugin wp-multilang WP Project Manager Pro wedevs-project-manager-business WP Statistics – Simple, privacy-friendly Google Analytics alternative wp-statistics WP Tab Widget wp-tab-widget WP w3all phpBB wp-w3all-phpbb-integration WPAdverts – Classifieds Plugin wpadverts WPComplete wpcomplete wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin wpdatatables WPeMatico RSS Feed Fetcher wpematico WPForms Pro wpforms WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode gdpr-cookie-consent WPS Bidouille wps-bidouille WPvivid — Backup, Migration & Staging wpvivid-backuprestore WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress wpzoom-forms WS Form LITE – Drag & Drop Contact Form Builder ws-form Wufoo Shortcode wufoo-shortcode YayCurrency – WooCommerce Multi-Currency Switcher yaycurrency YITH WooCommerce Membership Premium yith-woocommerce-membership-premium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress youzify WordPress Themes with Reported Vulnerabilities Last Week Software Name Software Slug Altair altair Aora - Home & Lifestyle Elementor WooCommerce Theme aora Capella | Restaurant WordPress capella Chaplin chaplin FreightCo – Free Transportation & Logistics WordPress Theme freightco Homlisti homlisti IT Residence it-residence Jawn jawn Koji koji Mane mane Resido - Real Estate WordPress Theme resido Shuffle shuffle Smart Cleaning smart-cleaning TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme thegem-elementor Tonda - Elegant Shop WordPress Theme tonda Urna - All-in-one WooCommerce WordPress Theme urna Warehouse Cargo warehouse-cargo Vulnerability Details Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize. Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-77264 Patch Status Unpatched Published Aug 20, 2026 Affected Software Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code [automation-web-platform] Researcher RIA Labs More Details > Broken Link Checker < 2.4.12 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-18937 Patch Status Patched Published Aug 21, 2026 Affected Software Broken Link Checker [broken-link-checker] Researcher Jakub Herman More Details > DynamicKit for Elementor < 1.0.3 - Unauthenticated Privilege Escalation via Account Takeover 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-14596 Patch Status Patched Published Aug 18, 2026 Affected Software DynamicKit for Elementor [dynamickit-elementor] Researcher Pedro Pinho More Details > Elementor Pro <= 4.2.1 - Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-32475 Patch Status Patched Published Aug 19, 2026 Affected Software Elementor Website Builder Pro [elementor-pro] Researchers Tin Pham (TF1T)Austin Ginder More Details > Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-15748 Patch Status Patched Published Aug 17, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher daroo More Details > Jawn <= 1.4.2 - Unauthenticated Privilege Escalation 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-78477 Patch Status Unpatched Published Aug 20, 2026 Affected Software Jawn [jawn] Researcher Tran Nguyen Bao Khanh More Details > JetEngine <= 3.8.14 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-66613 Patch Status Patched Published Aug 19, 2026 Affected Software JetEngine [jet-engine] Researcher dutafi More Details > JSON Options <= 0.0.4 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-75860 Patch Status Unpatched Published Aug 21, 2026 Affected Software JSON Options [json-options] Researcher Khaled Alenazi More Details > Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-78003 Patch Status Patched Published Aug 21, 2026 Affected Software Mailgun for WordPress [mailgun] Researcher Osvaldo Noe Gonzalez Del Rio (Os) More Details > Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.2 - Unauthenticated Arbitrary File Upload 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-73996 Patch Status Patched Published Aug 18, 2026 Affected Software Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system] Researcher 20kilograma More Details > ShopMonitor.io – Automated Checkout & Form Monitoring < 1.2.0 - Unauthenticated Privilege Escalation via Account Takeover 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-14919 Patch Status Patched Published Aug 18, 2026 Affected Software ShopMonitor.io – Automated Checkout & Form Monitoring [shopmonitorio] Researcher Pedro Pinho More Details > Total Donations <= 2.0.5 - Unauthenticated Privilege Escalation 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-78570 Patch Status Unpatched Published Aug 19, 2026 Affected Software Total Donations [totaldonations] Researcher Tran Nguyen Bao Khanh More Details > Total Donations <= 2.0.5 - Unauthenticated SQL Injection 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-78568 Patch Status Unpatched Published Aug 19, 2026 Affected Software Total Donations [totaldonations] Researcher Tran Nguyen Bao Khanh More Details > TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-18315 Patch Status Patched Published Aug 18, 2026 Affected Software TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking] Researcher Décio Brandão More Details > User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 5.4.5 - Unauthenticated Privilege Escalation via Account Takeover 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-74001 Patch Status Patched Published Aug 19, 2026 Affected Software User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin [user-registration-pro] Researcher 0xd4rk5id3 More Details > WP Compress – Instant Performance & Speed Optimization < 7.20.01 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-73343 Patch Status Patched Published Aug 18, 2026 Affected Software WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer] Researcher Charles Vosburgh More Details > WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-4703 Patch Status Patched Published Aug 21, 2026 Affected Software WS Form LITE – Drag & Drop Contact Form Builder [ws-form] Researcher Athiwat Tiprasaharn (Jitlada) More Details > GP Premium <= 2.5.5 - Authenticated (Contributor+) Arbitrary File Upload 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-66627 Patch Status Patched Published Aug 18, 2026 Affected Software GP Premium [gp-premium] Researcher Austin Ginder More Details > IT Residence <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-74014 Patch Status Unpatched Published Aug 20, 2026 Affected Software IT Residence [it-residence] Researcher Denver Jackson More Details > Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-66600 Patch Status Patched Published Aug 19, 2026 Affected Software Media Library Assistant [media-library-assistant] Researcher nh4tvd More Details > PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-0551 Patch Status Patched Published Aug 22, 2026 Affected Software PPWP – Password Protect Pages [password-protect-page] Researcher Webbernaut More Details > Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-73992 Patch Status Patched Published Aug 19, 2026 Affected Software Query Wrangler [query-wrangler] Researcher hhhai More Details > Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-16149 Patch Status Patched Published Aug 22, 2026 Affected Software Security Hardener [security-hardener] Researcher zickzick2 More Details > Smart Cleaning <= 4.8.6 - Authenticated (Subscriber+) Arbitrary File Upload 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-74016 Patch Status Unpatched Published Aug 20, 2026 Affected Software Smart Cleaning [smart-cleaning] Researcher Denver Jackson More Details > Templatiq <= 0.2.5 - Authenticated (Contributor+) Arbitrary File Upload 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-32474 Patch Status Unpatched Published Aug 18, 2026 Affected Software Templatiq [templatiq] Researcher daroo More Details > Warehouse Cargo <= 2.7.0 - Authenticated (Subscriber+) Arbitrary File Upload 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-74018 Patch Status Unpatched Published Aug 20, 2026 Affected Software Warehouse Cargo [warehouse-cargo] Researcher Denver Jackson More Details > WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-19883 Patch Status Patched Published Aug 21, 2026 Affected Software WPeMatico RSS Feed Fetcher [wpematico] Researcher Supakiad S. (m3ez) More Details > Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-19942 Patch Status Patched Published Aug 18, 2026 Affected Software Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback [atarim-visual-collaboration] Researcher Wordfence PRISM More Details > Flatastic <= 2.0 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-66672 Patch Status Unpatched Published Aug 20, 2026 Affected Software Flatastic - Versatile MultiVendor WordPress Theme [flatastic] Researcher João Pedro S Alcântara (Kinorth) More Details > Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-66583 Patch Status Patched Published Aug 19, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher Ahmed Hassan More Details > FreightCo – Free Transportation & Logistics WordPress Theme <= 1.1.15 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-66650 Patch Status Unpatched Published Aug 20, 2026 Affected Software FreightCo – Free Transportation & Logistics WordPress Theme [freightco] Researcher daroo More Details > FundEngine – Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-73993 Patch Status Patched Published Aug 19, 2026 Affected Software FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation] Researcher Taylsec More Details > Golo Framework < 1.7.5 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-28150 Patch Status Patched Published Aug 19, 2026 Affected Software Golo Framework [golo-framework] Researcher João Pedro S Alcântara More Details > Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-78572 Patch Status Unpatched Published Aug 19, 2026 Affected Software Kalles Addons [kalles-addons] Researcher João Pedro S Alcântara (Kinorth) More Details > Måne <= 1.7 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-78478 Patch Status Unpatched Published Aug 20, 2026 Affected Software Mane [mane] Researcher Tran Nguyen Bao Khanh More Details > RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.7 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-73341 Patch Status Patched Published Aug 18, 2026 Affected Software RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager] Researcher dutafi More Details > Resido - Real Estate WordPress Theme <= 1.5 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-73387 Patch Status Unpatched Published Aug 19, 2026 Affected Software Resido - Real Estate WordPress Theme [resido] Researcher João Pedro S Alcântara More Details > Restaurant Menu and Food Ordering <= 2.4.11 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-73400 Patch Status Unpatched Published Aug 18, 2026 Affected Software Restaurant Menu and Food Ordering [mp-restaurant-menu] Researcher Jakub Herman More Details > Shuffle <= 1.8 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-78566 Patch Status Patched Published Aug 19, 2026 Affected Software Shuffle [shuffle] Researcher Bonds More Details > Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-73380 Patch Status Patched Published Aug 18, 2026 Affected Software Smart Popup by Supsystic [popup-by-supsystic] Researcher Asim Alshaya More Details > Tonda - Elegant Shop WordPress Theme < 2.6 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-28151 Patch Status Patched Published Aug 20, 2026 Affected Software Tonda - Elegant Shop WordPress Theme [tonda] Researcher Tran Nguyen Bao Khanh More Details > Tonda Core < 2.6 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-28152 Patch Status Patched Published Aug 20, 2026 Affected Software Tonda Core [tonda-core] Researcher Tran Nguyen Bao Khanh More Details > Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-73376 Patch Status Patched Published Aug 18, 2026 Affected Software Ultimate Maps by Supsystic [ultimate-maps-by-supsystic] Researcher Asim Alshaya More Details > Verdure Core <= 1.2 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-78562 Patch Status Unpatched Published Aug 20, 2026 Affected Software Verdure Core [verdure-core] Researcher Tran Nguyen Bao Khanh More Details > WP Cafe Pro <= 3.0.14 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-66587 Patch Status Patched Published Aug 20, 2026 Affected Software WP Cafe Pro [wpcafe-pro] Researcher Ananda Dhakal More Details > Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-73397 Patch Status Unpatched Published Aug 18, 2026 Affected Software Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress [youzify] Researcher Peter Thaleikis More Details > Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-2996 Patch Status Patched Published Aug 21, 2026 Affected Software Advanced Product Fields (Product Addons) for WooCommerce [advanced-product-fields-for-woocommerce] Researcher Andrés Cruciani More Details > Affiliates Manager <= 2.9.53 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-73355 Patch Status Patched Published Aug 18, 2026 Affected Software Affiliates Manager [affiliates-manager] Researcher 20kilograma More Details > BookingPress Appointment Booking Pro <= 6.0.6 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-68566 Patch Status Patched Published Aug 20, 2026 Affected Software BookingPress Appointment Booking Pro [bookingpress-appointment-booking-pro] Researcher dutafi More Details > Capella | Restaurant WordPress <= 2.5.5 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2025-15688 Patch Status Unpatched Published Aug 20, 2026 Affected Software Capella | Restaurant WordPress [capella] Researcher Tran Nguyen Bao Khanh More Details > Depicter — Popup & Slider Builder <= 4.8.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-66622 Patch Status Unpatched Published Aug 18, 2026 Affected Software Depicter — Popup & Slider Builder [depicter] Researcher Peng Zhou More Details > Dinatur <= 1.18 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-12983 Patch Status Unpatched Published Aug 17, 2026 Affected Software Dinatur [dinatur] Researcher João Ramos Maciel and Theo Antonio da Fonseca More Details > Directory Pro <= 2.5.8 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-66649 Patch Status Unpatched Published Aug 20, 2026 Affected Software Directory Pro [directory-pro] Researcher daroo More Details > Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-75963 Patch Status Patched Published Aug 19, 2026 Affected Software Events Made Easy [events-made-easy] Researcher Wordfence PRISM More Details > Flexible Subscriptions <= 1.8.1 - Authenticated (Customer+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-73364 Patch Status Patched Published Aug 19, 2026 Affected Software Flexible Subscriptions [flexible-subscriptions] Researcher Van Phuc More Details > JetAppointment <= 2.5.2 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-73365 Patch Status Patched Published Aug 18, 2026 Affected Software JetAppointment [jet-appointments-booking] Researcher dutafi More Details > Locatoraid Store Locator <= 3.9.72 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-66680 Patch Status Patched Published Aug 20, 2026 Affected Software Locatoraid Store Locator [locatoraid] Researcher arrester More Details > NGG Smart Image Search < 4.0.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-73185 Patch Status Patched Published Aug 19, 2026 Affected Software NGG Smart Image Search [ngg-smart-image-search] Researcher Jarno Vos More Details > Nikstore Core <= 1.5 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-73388 Patch Status Unpatched Published Aug 19, 2026 Affected Software Nikstore Core [nikstore-core] Researcher Tran Nguyen Bao Khanh More Details > Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-16950 Patch Status Unpatched Published Aug 21, 2026 Affected Software Product Shortlist [product-shortlist] Researcher João Ramos Maciel More Details > Readabler < 2.0.18 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-78576 Patch Status Patched Published Aug 18, 2026 Affected Software Readabler [readabler] Researcher dutafi More Details > rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-66592 Patch Status Patched Published Aug 19, 2026 Affected Software rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] Researcher Aydan Arabadzha More Details > Security Plugin, Firewall & Malware Scanner with Auto Removal <= 2.184 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-66593 Patch Status Patched Published Aug 19, 2026 Affected Software Security Plugin, Firewall & Malware Scanner with Auto Removal [security-malware-firewall] Researcher Noman Riffat More Details > Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-16616 Patch Status Unpatched Published Aug 21, 2026 Affected Software Simple File List [simple-file-list] Researcher Sanjar Tulkinov More Details > Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons <= 1.4.2 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-73187 Patch Status Patched Published Aug 18, 2026 Affected Software Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons [sticky-chat-widget] Researcher Nguyen Ba Khanh More Details > Super Store Finder <= 7.8 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-73392 Patch Status Unpatched Published Aug 18, 2026 Affected Software Super Store Finder [superstorefinder-wp] Researcher Denver Jackson More Details > TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme <= 5.12.3 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-66609 Patch Status Patched Published Aug 19, 2026 Affected Software TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme [thegem-elementor] Researcher dutafi More Details > W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-18051 Patch Status Patched Published Aug 21, 2026 Affected Software W3 Total Cache [w3-total-cache] Researcher Jakub Herman More Details > WP Cafe Pro <= 3.0.14 - Authenticated (Author+) Local File Inclusion 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-66586 Patch Status Patched Published Aug 20, 2026 Affected Software WP Cafe Pro [wpcafe-pro] Researcher Ananda Dhakal More Details > WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-11801 Patch Status Patched Published Aug 17, 2026 Affected Software WPAdverts – Classifieds Plugin [wpadverts] Researcher Deva Parekh More Details > WPvivid — Backup, Migration & Staging < 0.9.131 - Unauthenticated Path Traversal 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-19725 Patch Status Patched Published Aug 20, 2026 Affected Software WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] Researcher Nir Yehoshua More Details > Abandoned Cart Pro for WooCommerce <= 10.4.0 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-66682 Patch Status Unpatched Published Aug 20, 2026 Affected Software Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro] Researcher Austin Ginder More Details > Capella | Restaurant WordPress <= 2.5.5 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2025-15689 Patch Status Unpatched Published Aug 20, 2026 Affected Software Capella | Restaurant WordPress [capella] Researcher Tran Nguyen Bao Khanh More Details > Digits: WordPress Mobile Number Signup and Login <= 9.2 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-28165 Patch Status Unpatched Published Aug 20, 2026 Affected Software Digits: WordPress Mobile Number Signup and Login [digits] Researcher VanTastic More Details > SAML Single Sign On – SSO Login 4.8.85-5.4.6 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-19842 Patch Status Patched Published Aug 19, 2026 Affected Software SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on] Researcher Suhayb Ahmed More Details > Simple JWT Login – Allows you to use JWT on REST endpoints. < 3.6.8 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-19714 Patch Status Patched Published Aug 20, 2026 Affected Software Simple JWT Login – Allows you to use JWT on REST endpoints. [simple-jwt-login] Researcher Farid Narimanov More Details > TabaPay Gateway <= 1.4.0 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-18031 Patch Status Unpatched Published Aug 21, 2026 Affected Software TabaPay Gateway [tabapay-gateway] Researcher moonge More Details > TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-18776 Patch Status Patched Published Aug 21, 2026 Affected Software TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking] Researcher Abdullah Kareem More Details > TrueBooker – Appointment Booking and Scheduler System <= 1.2.6 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-73347 Patch Status Patched Published Aug 19, 2026 Affected Software TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking] Researcher Abdullah Kareem "cyberkareem" More Details > 12 Step Meeting List <= 3.19.16 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66584 Patch Status Patched Published Aug 20, 2026 Affected Software 12 Step Meeting List [12-step-meeting-list] Researcher V1T More Details > Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66607 Patch Status Patched Published Aug 19, 2026 Affected Software Advance Product Search- Voice & Ajax Search for WooCommerce [th-advance-product-search] Researcher sequence_X0 More Details > Affiliates Manager <= 2.9.53 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73358 Patch Status Patched Published Aug 18, 2026 Affected Software Affiliates Manager [affiliates-manager] Researcher 20kilograma More Details > All-in-One WP Migration and Backup < 7.108 - Authenticated (Administrator+) Remote Code Execution 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-17533 Patch Status Patched Published Aug 20, 2026 Affected Software All-in-One WP Migration and Backup [all-in-one-wp-migration] Researcher Mohamed Bassia More Details > Aora - Home & Lifestyle Elementor WooCommerce Theme <= 1.3.19 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66612 Patch Status Patched Published Aug 20, 2026 Affected Software Aora - Home & Lifestyle Elementor WooCommerce Theme [aora] Researchers Son BachLan Vy More Details > Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73338 Patch Status Patched Published Aug 18, 2026 Affected Software Autopay [platnosci-online-blue-media] Researcher ParkHyunWoo More Details > B2Bking <= 5.6.07 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66598 Patch Status Patched Published Aug 19, 2026 Affected Software B2Bking [b2bking] Researcher dutafi More Details > BBQ Pro <= 3.9 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73182 Patch Status Patched Published Aug 19, 2026 Affected Software BBQ Pro [bbq-pro] Researcher dutafi More Details > Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.22 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-32547 Patch Status Patched Published Aug 18, 2026 Affected Software Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] Researcher daroo More Details > Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-14334 Patch Status Unpatched Published Aug 17, 2026 Affected Software Booking calendar, Appointment Booking System [booking-calendar] Researcher Samdup Choephel More Details > Contact Form by Supsystic < 1.10.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73378 Patch Status Patched Published Aug 18, 2026 Affected Software Contact Form by Supsystic [contact-form-by-supsystic] Researcher Asim Alshaya More Details > Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.5 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-61986 Patch Status Patched Published Aug 19, 2026 Affected Software Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery] Researcher Thaer Assfour More Details > Depicter — Popup & Slider Builder < 4.8.0 - Authenticated (Editor+) Arbitrary File Upload 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-15049 Patch Status Patched Published Aug 21, 2026 Affected Software Depicter — Popup & Slider Builder [depicter] Researcher Md. Minaruzzaman Shovon More Details > EasyTest – Simplify A/B Testing <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-68567 Patch Status Patched Published Aug 18, 2026 Affected Software EasyTest – Simplify A/B Testing [convertpro] Researcher timomangcut More Details > Events Made Easy <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-28162 Patch Status Patched Published Aug 20, 2026 Affected Software Events Made Easy [events-made-easy] Researcher sequence_X0 More Details > Flatastic - Versatile MultiVendor WordPress Theme <= 2.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66673 Patch Status Unpatched Published Aug 20, 2026 Affected Software Flatastic - Versatile MultiVendor WordPress Theme [flatastic] Researcher João Pedro S Alcântara (Kinorth) More Details > Fluent Forms Pro Add On Pack < 6.2.12 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66633 Patch Status Patched Published Aug 18, 2026 Affected Software Fluent Forms Pro Add On Pack [fluentformpro] Researcher daroo More Details > Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66616 Patch Status Unpatched Published Aug 19, 2026 Affected Software Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker] Researcher Elijah Chia More Details > GEO Plugin by Squirrly SEO <= 14.2.2 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66614 Patch Status Patched Published Aug 19, 2026 Affected Software GEO Plugin by Squirrly SEO [squirrly-seo] Researcher daroo More Details > GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.173 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66604 Patch Status Patched Published Aug 19, 2026 Affected Software GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] Researcher dunvu0 More Details > Global Gallery - WordPress Responsive Gallery <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73184 Patch Status Unpatched Published Aug 19, 2026 Affected Software Global Gallery - WordPress Responsive Gallery [global-gallery] Researcher Nguyen Ba Khanh More Details > JetEngine <= 3.8.14.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66581 Patch Status Patched Published Aug 19, 2026 Affected Software JetEngine [jet-engine] Researcher dutafi More Details > Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66629 Patch Status Unpatched Published Aug 18, 2026 Affected Software Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] Researcher daroo More Details > miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73351 Patch Status Patched Published Aug 18, 2026 Affected Software miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon [miniorange-login-openid] Researcher hackthesoul More Details > Newsletter – Send awesome emails from WordPress <= 9.3.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66596 Patch Status Patched Published Aug 19, 2026 Affected Software Newsletter – Send awesome emails from WordPress [newsletter] Researcher daroo More Details > NotificationX Pro <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-78563 Patch Status Unpatched Published Aug 20, 2026 Affected Software NotificationX Pro [notificationx-pro] Researcher Nguyen Ba Khanh More Details > Paymob for WooCommerce <= 4.1.10 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66611 Patch Status Patched Published Aug 19, 2026 Affected Software Paymob for WooCommerce [paymob-for-woocommerce] Researcher dutafi More Details > PDF Smart Viewer for Elementor <= 1.0.4 - Unauthenticated Server-Side Request Forgery 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-32473 Patch Status Unpatched Published Aug 18, 2026 Affected Software PDF Smart Viewer for Elementor [pdf-smart-viewer-for-elementor] Researcher Nabil Irawan More Details > Podlove Podcast Publisher <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66615 Patch Status Patched Published Aug 19, 2026 Affected Software Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress] Researcher daroo More Details > Premium Packages – Sell Digital Products Securely <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73190 Patch Status Patched Published Aug 18, 2026 Affected Software Premium Packages – Sell Digital Products Securely [wpdm-premium-packages] Researcher Evan NR More Details > Recipe Card Blocks Lite <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73361 Patch Status Patched Published Aug 18, 2026 Affected Software Recipe Card Blocks Lite [recipe-card-blocks-by-wpzoom] Researcher daroo More Details > Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Administrator+) Remote Code Execution 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-13405 Patch Status Patched Published Aug 21, 2026 Affected Software Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] Researcher Muni Nitish Kumar Yaddala More Details > Simple File List <= 6.3.11 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-16617 Patch Status Unpatched Published Aug 21, 2026 Affected Software Simple File List [simple-file-list] Researcher Ruwantha Harshamal More Details > SimplyRETS Real Estate IDX <= 3.2.8 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73354 Patch Status Patched Published Aug 19, 2026 Affected Software SimplyRETS Real Estate IDX [simply-rets] Researcher V1T More Details > SmartSMTP <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66606 Patch Status Patched Published Aug 19, 2026 Affected Software SmartSMTP [smart-smtp] Researcher Jorgson More Details > Social Media Share Buttons & Social Sharing Icons <= 2.9.9 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66623 Patch Status Patched Published Aug 20, 2026 Affected Software Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] Researcher Bonds More Details > Swatchly – Product Variation Swatches for WooCommerce <= 1.4.13 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66605 Patch Status Patched Published Aug 19, 2026 Affected Software Swatchly – Product Variation Swatches for WooCommerce [swatchly] Researcher daroo More Details > Tagembed: Social Media Feeds and Customer Reviews Widget <= 7.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66590 Patch Status Patched Published Aug 19, 2026 Affected Software Tagembed: Social Media Feeds and Customer Reviews Widget [tagembed-widget] Researcher Nguyen Ba Khanh More Details > TenWeb Speed Optimizer <= 2.33.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-14287 Patch Status Patched Published Aug 17, 2026 Affected Software 10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer] Researcher Jakub Herman More Details > TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-75981 Patch Status Patched Published Aug 18, 2026 Affected Software TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] Researcher Pham Duc Anh More Details > TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66582 Patch Status Patched Published Aug 19, 2026 Affected Software TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] Researcher Quentin Lamour More Details > Ultimate Dashboard – Custom WordPress Dashboard <= 3.11.2 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66621 Patch Status Unpatched Published Aug 18, 2026 Affected Software Ultimate Dashboard – Custom WordPress Dashboard [ultimate-dashboard] Researcher dutafi More Details > Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73375 Patch Status Patched Published Aug 18, 2026 Affected Software Ultimate Maps by Supsystic [ultimate-maps-by-supsystic] Researcher Asim Alshaya More Details > URL Shortify – Simple and Easy URL Shortener <= 2.5.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73362 Patch Status Patched Published Aug 18, 2026 Affected Software URL Shortify – Simple and Easy URL Shortener [url-shortify] Researcher daroo More Details > Urna - All-in-one WooCommerce WordPress Theme <= 2.6.2 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66610 Patch Status Patched Published Aug 20, 2026 Affected Software Urna - All-in-one WooCommerce WordPress Theme [urna] Researchers Khuong HaiThanh Nam More Details > WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-73342 Patch Status Patched Published Aug 18, 2026 Affected Software WP Multilang – Translation and Multilingual Plugin [wp-multilang] Researcher daroo More Details > WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-15780 Patch Status Patched Published Aug 18, 2026 Affected Software WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] Researcher tipsen More Details > WPComplete <= 2.9.5.6 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66599 Patch Status Patched Published Aug 20, 2026 Affected Software WPComplete [wpcomplete] Researcher Asim Alshaya More Details > wpDataTables (Premium) <= 6.5.1.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-66597 Patch Status Patched Published Aug 19, 2026 Affected Software wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] Researcher daroo More Details > WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-18409 Patch Status Patched Published Aug 20, 2026 Affected Software WPForms Pro [wpforms] Researcher daroo More Details > OptionTree <= 2.7.3 - Authenticated (Editor+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-66620 Patch Status Unpatched Published Aug 18, 2026 Affected Software OptionTree [option-tree] Researcher Ananda Dhakal More Details > Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms <= 3.51.0 - Authenticated (Editor+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-74012 Patch Status Patched Published Aug 19, 2026 Affected Software Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] Researcher daroo More Details > Community by PeepSo – Download from PeepSo.com <= 9.0.5.2 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-66668 Patch Status Patched Published Aug 19, 2026 Affected Software Community by PeepSo – Download from PeepSo.com [peepso-core] Researcher Ayoub MOUHATTA More Details > eShipper Commerce <= 2.16.13 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-74013 Patch Status Unpatched Published Aug 20, 2026 Affected Software eShipper Commerce [eshipper-commerce] Researcher hivesec More Details > License Manager for WooCommerce <= 3.0.18 - Authenticated (Customer+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-73345 Patch Status Patched Published Aug 18, 2026 Affected Software License Manager for WooCommerce [license-manager-for-woocommerce] Researcher rootdirective.sec More Details > Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-66594 Patch Status Patched Published Aug 19, 2026 Affected Software Persistent Login [wp-persistent-login] Researcher dutafi More Details > WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-18027 Patch Status Patched Published Aug 22, 2026 Affected Software WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce] Researcher daroo More Details > WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-78470 Patch Status Unpatched Published Aug 21, 2026 Affected Software WP Project Manager Pro [wedevs-project-manager-business] Researcher dutafi More Details > WP w3all phpBB <= 3.0.5 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-73998 Patch Status Patched Published Aug 19, 2026 Affected Software WP w3all phpBB [wp-w3all-phpbb-integration] Researcher Khanh Nguyen More Details > YITH WooCommerce Membership Premium <= 2.33.0 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-32552 Patch Status Patched Published Aug 18, 2026 Affected Software YITH WooCommerce Membership Premium [yith-woocommerce-membership-premium] Researcher dutafi More Details > Admin and Site Enhancements (ASE) < 9.0.1 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-19615 Patch Status Patched Published Aug 21, 2026 Affected Software Admin and Site Enhancements (ASE) [admin-site-enhancements] Researcher Mohammed Abd Alrahman More Details > Draft List <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66603 Patch Status Patched Published Aug 18, 2026 Affected Software Draft List [simple-draft-list] Researcher V1T More Details > Easy Media Replace <= 0.2.0 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15253 Patch Status Unpatched Published Aug 17, 2026 Affected Software Easy Media Replace [easy-media-replace] Researcher testoun More Details > EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15446 Patch Status Patched Published Aug 18, 2026 Affected Software EWWW Image Optimizer [ewww-image-optimizer] Researcher UKO More Details > Featured Video Plus <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66637 Patch Status Unpatched Published Aug 18, 2026 Affected Software Featured Video Plus [featured-video-plus] Researcher Ananda Dhakal More Details > Frontend Admin by DynamiApps <= 3.29.10 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66638 Patch Status Patched Published Aug 18, 2026 Affected Software Frontend Admin by DynamiApps [acf-frontend-form-element] Researcher Ananda Dhakal More Details > GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.177 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-68565 Patch Status Unpatched Published Aug 18, 2026 Affected Software GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] Researcher Ananda Dhakal More Details > GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor < 2.5.0 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-19697 Patch Status Patched Published Aug 21, 2026 Affected Software GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon] Researcher Yaswanth Reddy Sunkara More Details > Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-4559 Patch Status Patched Published Aug 22, 2026 Affected Software Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite] Researchers Athiwat Tiprasaharn (Jitlada)Itthidej Aramsri (Boeing777) More Details > JetEngine < 3.8.14 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-18202 Patch Status Patched Published Aug 21, 2026 Affected Software JetEngine [jet-engine] Researcher Erwan LR More Details > Login With Ajax – Fast Logins, 2FA, Redirects <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66640 Patch Status Unpatched Published Aug 18, 2026 Affected Software Login With Ajax – Fast Logins, 2FA, Redirects [login-with-ajax] Researcher Ananda Dhakal More Details > Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-19712 Patch Status Patched Published Aug 20, 2026 Affected Software Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system] Researcher Farid Narimanov More Details > MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-4561 Patch Status Patched Published Aug 21, 2026 Affected Software MC4WP: Mailchimp for WordPress [mailchimp-for-wp] Researcher Osvaldo Noe Gonzalez Del Rio (Os) More Details > Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66591 Patch Status Patched Published Aug 18, 2026 Affected Software Media Library Assistant [media-library-assistant] Researcher Abdullah Kareem "cyberkareem" More Details > Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66601 Patch Status Patched Published Aug 19, 2026 Affected Software Media Library Assistant [media-library-assistant] Researcher nh4tvd More Details > Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15421 Patch Status Patched Published Aug 18, 2026 Affected Software Speed Optimizer – The All-In-One Performance-Boosting Plugin [sg-cachepress] Researcher stealthcopter More Details > Table Of Contents Block <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66645 Patch Status Unpatched Published Aug 18, 2026 Affected Software Table Of Contents Block [table-of-contents-block] Researcher Ananda Dhakal More Details > Typing Effect <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66644 Patch Status Unpatched Published Aug 18, 2026 Affected Software Typing Effect [animated-typing-effect] Researcher Ananda Dhakal More Details > Video Conferencing with Zoom <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66641 Patch Status Unpatched Published Aug 18, 2026 Affected Software Video Conferencing with Zoom [video-conferencing-with-zoom-api] Researcher Ananda Dhakal More Details > Wise Chat <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66636 Patch Status Unpatched Published Aug 18, 2026 Affected Software Wise Chat [wise-chat] Researcher Ananda Dhakal More Details > WP BASE Booking of Appointments, Services and Events <= 6.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-73402 Patch Status Patched Published Aug 20, 2026 Affected Software WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events] Researcher moonge More Details > WP Tab Widget <= 1.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66646 Patch Status Unpatched Published Aug 18, 2026 Affected Software WP Tab Widget [wp-tab-widget] Researcher Ananda Dhakal More Details > WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.3.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-73359 Patch Status Patched Published Aug 18, 2026 Affected Software WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent] Researcher Nguyen Ba Khanh More Details > WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66639 Patch Status Unpatched Published Aug 18, 2026 Affected Software WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress [wpzoom-forms] Researcher Ananda Dhakal More Details > Wufoo Shortcode <= 1.55 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66643 Patch Status Unpatched Published Aug 18, 2026 Affected Software Wufoo Shortcode [wufoo-shortcode] Researcher Ananda Dhakal More Details > Eventin <= 4.1.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-13175 Patch Status Patched Published Aug 17, 2026 Affected Software Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Muni Nitish Kumar Yaddala More Details > MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Authenticated (Subscriber+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-68568 Patch Status Patched Published Aug 18, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher dutafi More Details > WCFM Marketplace <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Store vendor+) Cross-Vendor Review Deletion and Status Update 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-14196 Patch Status Patched Published Aug 17, 2026 Affected Software WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace] Researcher Mustafa Ahmed More Details > AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-17153 Patch Status Patched Published Aug 19, 2026 Affected Software AI Agent by SiteGround [sg-ai-studio] Researcher Wordfence PRISM More Details > Altair <= 5.2.2 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2025-53999 Patch Status Unpatched Published Aug 19, 2026 Affected Software Altair [altair] Researcher Tran Nguyen Bao Khanh More Details > Appointment Hour Booking – Booking Calendar <= 1.5.91 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-66679 Patch Status Unpatched Published Aug 18, 2026 Affected Software Appointment Hour Booking – Booking Calendar [appointment-hour-booking] Researcher Tiago Ventura More Details > Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73395 Patch Status Unpatched Published Aug 18, 2026 Affected Software Booking calendar, Appointment Booking System [booking-calendar] Researcher Jakub Herman More Details > CatFolders Document Gallery & PDF Library < 2.0.7 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-19717 Patch Status Patched Published Aug 20, 2026 Affected Software CatFolders Document Gallery & PDF Library [catfolders-document-gallery] Researcher Shikhali Jamalzade More Details > Chaplin <= 2.6.8 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-74021 Patch Status Unpatched Published Aug 19, 2026 Affected Software Chaplin [chaplin] Researcher Trương Hữu Phúc More Details > Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.11.3 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73994 Patch Status Patched Published Aug 18, 2026 Affected Software Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) [charitable] Researcher Ananda Dhakal More Details > Contact Form by Supsystic < 1.10.0 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73379 Patch Status Patched Published Aug 18, 2026 Affected Software Contact Form by Supsystic [contact-form-by-supsystic] Researcher Asim Alshaya More Details > Duitku Payment Gateway <= 2.11.14 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-32468 Patch Status Unpatched Published Aug 18, 2026 Affected Software Duitku Payment Gateway [duitku-social-payment-gateway] Researcher daroo More Details > E-cab Taxi Booking Manager for Woocommerce < 2.0.8 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73363 Patch Status Patched Published Aug 19, 2026 Affected Software E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager] Researcher Van Phuc More Details > EPROLO-Dropshipping <= 2.4.2 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-74019 Patch Status Unpatched Published Aug 20, 2026 Affected Software EPROLO-Dropshipping [eprolo-dropshipping] Researcher hivesec More Details > Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Mail Relay 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-18044 Patch Status Patched Published Aug 20, 2026 Affected Software Estatik Real Estate Plugin [estatik] Researcher Erwan LR More Details > Extra Product Options Builder for WooCommerce < 1.2.176 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-19728 Patch Status Patched Published Aug 20, 2026 Affected Software Extra Product Options Builder for WooCommerce [additional-product-fields-for-woocommerce] Researcher Farid Narimanov More Details > Flutterwave WooCommerce <= 3.3.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73399 Patch Status Unpatched Published Aug 18, 2026 Affected Software Flutterwave WooCommerce [rave-woocommerce-payment-gateway] Researcher Jakub Herman More Details > kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-3424 Patch Status Patched Published Aug 21, 2026 Affected Software kk Star Ratings – Rate Post & Collect User Feedbacks [kk-star-ratings] Researcher Ronnachai Sretawat Na Ayutaya (Simonhaskelly) More Details > Koji <= 2.2.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-74020 Patch Status Unpatched Published Aug 19, 2026 Affected Software Koji [koji] Researcher Trương Hữu Phúc More Details > Membership For WooCommerce < 3.1.2 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-19709 Patch Status Patched Published Aug 21, 2026 Affected Software Membership For WooCommerce [membership-for-woocommerce] Researcher Shikhali Jamalzade More Details > MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.14 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-66651 Patch Status Unpatched Published Aug 18, 2026 Affected Software MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor] Researcher Jakub Herman More Details > New User Approve <= 3.2.8 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-28163 Patch Status Patched Published Aug 20, 2026 Affected Software New User Approve [new-user-approve] Researcher Austin Ginder More Details > Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-28153 Patch Status Unpatched Published Aug 20, 2026 Affected Software Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More [notification-master] Researcher Ian Ho Shim More Details > Online Contact Widget-多合一在线客服插件 <= 1.3.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-32472 Patch Status Unpatched Published Aug 18, 2026 Affected Software Online Contact Widget-多合一在线客服插件 [online-contact-widget] Researcher Nabil Irawan More Details > Outranking Plugin Options <= 1.1.3 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73385 Patch Status Unpatched Published Aug 19, 2026 Affected Software Outranking Plugin Options [outranking] Researcher Nabil Irawan More Details > Pay with Contact Form 7 <= 1.0.4 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73384 Patch Status Unpatched Published Aug 19, 2026 Affected Software Pay with Contact Form 7 [pay-with-contact-form-7] Researcher Nabil Irawan More Details > Piraeus Bank WooCommerce Payment Gateway 3.2.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73398 Patch Status Unpatched Published Aug 18, 2026 Affected Software Piraeus Bank WooCommerce Payment Gateway [woo-payment-gateway-for-piraeus-bank] Researcher Jakub Herman More Details > Smart Popup by Supsystic <= 1.13.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73381 Patch Status Patched Published Aug 18, 2026 Affected Software Smart Popup by Supsystic [popup-by-supsystic] Researcher Asim Alshaya More Details > Stitch Express <= 1.9.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73394 Patch Status Unpatched Published Aug 19, 2026 Affected Software Stitch Express [stitch-express] Researcher babyhack More Details > SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73350 Patch Status Patched Published Aug 18, 2026 Affected Software SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent [supportcandy] Researcher hackthesoul More Details > Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-75027 Patch Status Patched Published Aug 21, 2026 Affected Software Themify Builder [themify-builder] Researcher Wordfence PRISM More Details > Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73386 Patch Status Unpatched Published Aug 19, 2026 Affected Software Track Geolocation Of Users Using Contact Form 7 [track-geolocation-of-users-using-contact-form-7] Researcher Nabil Irawan More Details > TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-18779 Patch Status Patched Published Aug 21, 2026 Affected Software TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking] Researcher Erwan LR More Details > TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-18777 Patch Status Patched Published Aug 21, 2026 Affected Software TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking] Researcher Mokksh Parekh More Details > TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-18778 Patch Status Patched Published Aug 21, 2026 Affected Software TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking] Researcher Luka Zimonjic More Details > Ultimate Maps by Supsystic < 1.5.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-73377 Patch Status Patched Published Aug 18, 2026 Affected Software Ultimate Maps by Supsystic [ultimate-maps-by-supsystic] Researcher Asim Alshaya More Details > User Verification <= 2.0.47 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-14861 Patch Status Unpatched Published Aug 17, 2026 Affected Software User Verification by PickPlugins [user-verification] Researcher Muni Nitish Kumar Yaddala More Details > WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.80 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-66595 Patch Status Patched Published Aug 19, 2026 Affected Software WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards [wp-data-access] Researcher doc4cash More Details > WP Directory Kit < 1.5.7 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-18231 Patch Status Patched Published Aug 21, 2026 Affected Software WP Directory Kit [wpdirectorykit] Researcher Erwan LR More Details > YayCurrency – WooCommerce Multi-Currency Switcher < 3.3.5 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-16058 Patch Status Patched Published Aug 21, 2026 Affected Software YayCurrency – WooCommerce Multi-Currency Switcher [yaycurrency] Researcher Shivamani Vastrala More Details > InfiniteWP Client <= 1.13.9 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-74011 Patch Status Patched Published Aug 20, 2026 Affected Software InfiniteWP Client [iwp-client] Researcher Ananda Dhakal More Details > WP Directory Kit < 1.5.7 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-18653 Patch Status Patched Published Aug 20, 2026 Affected Software WP Directory Kit [wpdirectorykit] Researcher Erwan LR More Details > Issues and Series for Newspapers, Magazines, Publishers, Writers <= 2.17.0 - Authenticated (Administrator+) Stored Cross-Site Scripting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-27365 Patch Status Patched Published Aug 18, 2026 Affected Software Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series] Researcher PPzzAArr More Details > Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-74992 Patch Status Patched Published Aug 21, 2026 Affected Software Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] Researcher Mohammed Abd Alrahman More Details > Advanced File Manager <= 5.4.12 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-11565 Patch Status Patched Published Aug 17, 2026 Affected Software Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced] Researcher Christian Kold Jensen More Details > AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-76074 Patch Status Patched Published Aug 21, 2026 Affected Software AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress [automatorwp] Researcher Wordfence PRISM More Details > AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-76057 Patch Status Patched Published Aug 21, 2026 Affected Software AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress [automatorwp] Researcher Wordfence PRISM More Details > B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More <= 5.2.30 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-66589 Patch Status Patched Published Aug 18, 2026 Affected Software B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More [b2bking-wholesale-for-woocommerce] Researcher Nguyen Ba Khanh More Details > Easy Appointments < 4.0.1 - Authenticated (Contributor+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-19406 Patch Status Patched Published Aug 21, 2026 Affected Software Easy Appointments [easy-appointments] Researcher Shikhali Jamalzade More Details > Easy Elementor Addons – Addons Pack for Elementor Page Builder <= 2.3.7 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-28164 Patch Status Patched Published Aug 20, 2026 Affected Software Easy Elementor Addons – Addons Pack for Elementor Page Builder [easy-elementor-addons] Researcher Asim Alshaya More Details > ECS – Ele Custom Skin for Elementor < 4.3.10 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-19613 Patch Status Patched Published Aug 20, 2026 Affected Software ECS – Ele Custom Skin for Elementor [ele-custom-skin] Researcher Erwan LR More Details > Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-13169 Patch Status Patched Published Aug 17, 2026 Affected Software Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Meher Sudhakar Abbireddi More Details > Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-13174 Patch Status Patched Published Aug 17, 2026 Affected Software Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Muni Nitish Kumar Yaddala More Details > Eventin <= 4.1.20 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-13173 Patch Status Patched Published Aug 17, 2026 Affected Software Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Meher Sudhakar Abbireddi More Details > Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings' 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-5093 Patch Status Patched Published Aug 21, 2026 Affected Software Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks] Researcher Raihan Adi Arba More Details > GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.15 - Authenticated (Contributor+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-19699 Patch Status Patched Published Aug 21, 2026 Affected Software GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon] Researcher Shikhali Jamalzade More Details > HashBar – Announcement, Notification Bar & Popup Campaign <= 2.0.0 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-66602 Patch Status Patched Published Aug 18, 2026 Affected Software HashBar – Announcement, Notification Bar & Popup Campaign [hashbar-wp-notification-bar] Researcher Brian Willows More Details > Homlisti <= 3.1.2 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-66647 Patch Status Unpatched Published Aug 20, 2026 Affected Software Homlisti [homlisti] Researcher Tran Nguyen Bao Khanh More Details > KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-19416 Patch Status Patched Published Aug 21, 2026 Affected Software KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system] Researcher Erwan LR More Details > KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-19417 Patch Status Patched Published Aug 21, 2026 Affected Software KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system] Researcher Erwan LR More Details > Leyka <= 3.32.3 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-66677 Patch Status Unpatched Published Aug 19, 2026 Affected Software Leyka [leyka] Researcher Jakub Herman More Details > Manual Image Crop < 1.15 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-15384 Patch Status Patched Published Aug 20, 2026 Affected Software Manual Image Crop [manual-image-crop] Researcher Shivamani Vastrala More Details > MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-73404 Patch Status Patched Published Aug 18, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher dutafi More Details > Modal Survey - WordPress Poll, Survey & Quiz Plugin <= 2.0.2.2.3 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-66634 Patch Status Unpatched Published Aug 18, 2026 Affected Software Modal Survey - WordPress Poll, Survey & Quiz Plugin [modal-survey] Researcher luc More Details > MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.6.7 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-73396 Patch Status Unpatched Published Aug 18, 2026 Affected Software MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics [makewebbetter-hubspot-for-woocommerce] Researcher Jakub Herman More Details > Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-4245 Patch Status Patched Published Aug 21, 2026 Affected Software Post Duplicator [post-duplicator] Researcher Quốc Huy (jtwings) More Details > Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-4244 Patch Status Patched Published Aug 21, 2026 Affected Software Post Duplicator [post-duplicator] Researcher Abi Wiranata More Details > PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2025-11729 Patch Status Patched Published Aug 18, 2026 Affected Software PPWP – Password Protect Pages [password-protect-page] Researcher Athiwat Tiprasaharn (Jitlada) More Details > Premium Packages – Sell Digital Products Securely < 7.0.7 - Authenticated (Subscriber+) Payment Bypass 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-19711 Patch Status Patched Published Aug 20, 2026 Affected Software Premium Packages – Sell Digital Products Securely [wpdm-premium-packages] Researcher Farid Narimanov More Details > Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-14826 Patch Status Patched Published Aug 17, 2026 Affected Software Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next] Researcher Revanth Hari Narayana Matte More Details > Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-14825 Patch Status Patched Published Aug 17, 2026 Affected Software Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next] Researcher Revanth Hari Narayana Matte More Details > Slider by 10Web – Responsive Image Slider <= 1.2.62 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-66635 Patch Status Unpatched Published Aug 18, 2026 Affected Software Slider by 10Web – Responsive Image Slider [slider-wd] Researcher Ananda Dhakal More Details > SmartCrawl SEO checker, analyzer & optimizer < 3.16.3 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-16979 Patch Status Patched Published Aug 21, 2026 Affected Software SmartCrawl SEO checker, analyzer & optimizer [smartcrawl-seo] Researcher Ezekiel Victor More Details > Visualizer – Tables & Charts Manager with Built-in AI Generator < 4.0.7 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-19726 Patch Status Patched Published Aug 20, 2026 Affected Software Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer] Researcher Farid Narimanov More Details > WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.8 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-18466 Patch Status Patched Published Aug 21, 2026 Affected Software WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin] Researcher Xanlar Agamalizade More Details > WPS Bidouille < 1.33.5 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-19782 Patch Status Patched Published Aug 21, 2026 Affected Software WPS Bidouille [wps-bidouille] Researcher Shikhali Jamalzade More Details > As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence. This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can. Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026) appeared first on Wordfence.