Last week, there were 358 vulnerabilities disclosed in 243 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 184 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back. Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free. Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. New Firewall Rules Deployed Last Week The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection. The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week: WAF-RULE-957 – Data redacted while we work with the vendor on a patch. WordPress Core <= 7.1 – Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay. Total Unpatched & Patched Vulnerabilities Last Week Patch Status Number of Vulnerabilities Patched 311 Unpatched 47 Total Vulnerabilities by CVSS Severity Last Week Severity Rating Number of Vulnerabilities Low Severity 4 Medium Severity 262 High Severity 74 Critical Severity 18 Total Vulnerabilities by CWE Type Last Week Vulnerability Type by CWE Number of Vulnerabilities Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 94 Missing Authorization 68 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 35 Authorization Bypass Through User-Controlled Key 27 Exposure of Sensitive Information to an Unauthorized Actor 26 Improper Privilege Management 19 Improper Control of Generation of Code ('Code Injection') 13 Unrestricted Upload of File with Dangerous Type 12 Cross-Site Request Forgery (CSRF) 8 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 8 Client-Side Enforcement of Server-Side Security 7 Server-Side Request Forgery (SSRF) 6 Deserialization of Untrusted Data 4 Improper Authentication 4 Incorrect Authorization 3 Protection Mechanism Failure 3 URL Redirection to Untrusted Site ('Open Redirect') 3 Authentication Bypass Using an Alternate Path or Channel 2 Improper Input Validation 2 Insufficient Verification of Data Authenticity 2 Uncontrolled Resource Consumption 2 Authentication Bypass by Spoofing 1 Embedded Malicious Code 1 External Control of File Name or Path 1 Guessable CAPTCHA 1 Improper Authorization 1 Improper Encoding or Escaping of Output 1 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') 1 Improper Restriction of Rendered UI Layers or Frames 1 Improper Verification of Cryptographic Signature 1 Insufficiently Protected Credentials 1 Researchers That Contributed to WordPress Security Last Week Researcher Name Number of Vulnerabilities Wordfence PRISM 25 Karthik Ramakrishnan 17 Ananda Dhakal 13 Artus KG 12 Pablo González Pérez 11 Francisco José Ramírez Vicente 11 Iñigo Sánchez Enciso 11 mak3bread 8 Athiwat Tiprasaharn (Jitlada) 7 Revanth Hari Narayana Matte 6 Pedro Pinho 6 Jakub Herman 6 JunHee CHO 6 Naoki Kawahigashi 6 Itthidej Aramsri (Boeing777) 5 Charles Vosburgh 5 Erwan LR 5 Jonah Burgess (CryptoCat) 5 Enrico Marcolini 5 nh4tvd 5 Benedictus Jovan (aillesiM) 4 Supakiad S. (m3ez) 4 Theo Antônio Da Fonseca 4 Choriyev Qahramon 4 Usama Arshad 4 João Ramos Maciel 4 vuxvinh 4 Dmitrii Ignatyev 3 daroo 3 Farid Narimanov 3 Sai Praneeth Koti 3 VuxNx 2 Kyokito 2 Morato Antoine 2 Kuba 2 Luc Huynh from Noventiq RedTeam 2 Rafie Muhammad 2 Dthangws 2 Huynh Kien Minh 2 Legion Hunter 2 Osvaldo Noe Gonzalez Del Rio (Os) 2 Mitchell 2 Jeremy Felt 2 Spy0x7 2 Yuto Hyakumoto 2 pb>sec 2 Mike Gozdiskowski 2 Nixxies 2 0xd4rk5id3 2 Anthropic 2 Binesh Madharapu 2 Shirshak 2 Waris Damkham 2 Luca Jungnickel 2 Nicat Sultanov 2 Md. Moniruzzaman Prodhan (NomanProdhan) 2 h0xilo 2 anhdung1329 1 Yassin Mohamed 1 Quang 1 João Pedro Soares de Alcântara 1 Md. Moniruzzaman Prodhan 1 zickzick2 1 Valatty 1 yzx001 1 Sergey Mkrtchyan 1 Jaskaranjeet Singh 1 Hieus 1 Arthur Morgan 1 Jonathan Dersch 1 henise 1 Ben Bidner 1 Chi Trung Huynh 1 pradeep suvarna 1 reconnaissance 1 Hillary Mutai 1 Niv Kochan 1 Matan Bachar 1 Devlin Jenkins 1 Suredsi Ulpada (cyberdesu) 1 John Ryan Albon 1 skyv3il 1 Chirita Catalin-Andrei (CC99IE) 1 AmonRa 1 MrProperCTF 1 Adam Rayyan Aryasatya 1 Amity Gilmour 1 Brian Willows 1 Pham Duc Anh 1 san6051 1 sorawautsukushiii 1 Ángel PS 1 RIA Labs 1 adhikara13 1 Jakub Herman 1 benzdeus 1 rajivraj 1 Shhriyash 1 Kaan Özbek 1 suyoung kim(AhnLab) 1 Nguyen Ba Khanh 1 Murad Akhmedov 1 Ryoma Nishioka 1 Joost Grunwald 1 Saulo Rafael (miquinho) 1 Nabil Irawan 1 Michael Holmquist 1 msfire 1 Sakri Koskimies 1 Pablo González 1 Francisco José Ramírez 1 seongjun joo 1 Shivamani Vastrala 1 EUNHO KIM 1 Matheo Beuve 1 Ryan Fabella 1 Stefan Spasic 1 hermanhms 1 blast 1 Tharadol Suksamran (d3kc4rt_1) 1 Josh Bolding 1 viridis 1 Muni Nitish Kumar Yaddala 1 Ayukiab 1 Evan 1 Nguyen Huu Do 1 UKO 1 Hasyros 1 ricky morty 1 Rahul Yadav 1 Kenny 1 AlexHenry 1 WP Cloud Plugins 1 Furkan Arslan 1 Romain Deperne (ang3L) 1 Scc2 1 mad4cyber 1 Mohammed Abd Alrahman 1 Claudio Marchesini 1 HDWSec 1 PO-WEI TING 1 Open Information Security Inc 1 Powpy 1 jtb75 1 Tin Pham (TF1T) 1 Trong Pham (dtro) 1 Hao Ngo 1 TruongLV1 From FPT Night Wolf 1 lhking 1 s00me00ne 1 Paulos Yibelo 1 theviper17y 1 Nir Yehoshua 1 Nikhil Gavhane 1 Helder Gonçalves 1 Hassan Khan Yusufzai 1 Adrien Brunner 1 Sorra 1 crow 1 Muhan Luo 1 asdqgggg 1 Jesse McNeil 1 Filip Kowalski (Agentunio) 1 Ahmed Embaby 1 Ossacip Thanh 1 Meher Sudhakar Abbireddi 1 a0yark 1 WEI HSIANG WANG 1 Civitasmass 1 Naoya Takahashi (nakko) 1 Yaswanth Reddy Sunkara 1 Adem0n__ 1 cyberkareem 1 Animesh Gaurav 1 nism0 1 Austin Ginder 1 Alihan Şahin 1 Ayush Gangwar 1 Farhan Fawwaz Saputra 1 Seongwon Lee 1 Suhayb Ahmed 1 thevietronin 1 Nguyen Cong Quang 1 z3r0s 1 Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report. WordPress Plugins with Reported Vulnerabilities Last Week Software Name Software Slug 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery interactive-3d-flipbook-powered-physics-engine Active Woot Products Tables for WooCommerce. 100% FREE  profit-products-tables-for-woocommerce Ad Inserter – Ad Manager & AdSense Ads ad-inserter Add User Autocomplete add-user-autocomplete Admin Menu Editor Pro admin-menu-editor-pro Advanced Custom Fields: Extended PRO acf-extended-pro Advanced Popups advanced-popups AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing af-companion AI Engine – The Chatbot, AI Framework & MCP for WordPress ai-engine Album Cover Finder album-cover-finder All Bootstrap Blocks all-bootstrap-blocks All-in-One WP Migration and Backup all-in-one-wp-migration AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) appmysite Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint Appointment Hour Booking – Booking Calendar appointment-hour-booking Asset CleanUp: Page Speed Booster wp-asset-clean-up Auto Upload Images auto-upload-images Autopay platnosci-online-blue-media aVideo avideo BE REST Endpoints be-rest-endpoints BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript searchpro Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots bp-better-messages BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for News, Magazine & Blogs blockspare Blog2Social: Social Media Auto Post & Scheduler blog2social Bold Page Builder bold-page-builder Booking Calendar booking Booking for Appointments and Events Calendar – Amelia ameliabooking Bookit — Booking & Appointment Calendar bookit Botiga Pro botiga-pro Bread bread Breeze Cache breeze Brizy – Page Builder brizy Business Name Generator designbro-business-name-generator Checkout Field Manager (Checkout Manager) for WooCommerce woocommerce-checkout-manager Choose User Role at Registration for WooCommerce choose-user-role-at-registration Clean Login clean-login Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors publishpress-authors Comments Import & Export comments-import-export-woocommerce Complianz GDPR/CCPA Cookie Consent Banner complianz-gdpr Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery Cooked – Recipe Management cooked Create mediavine-create CSS & JavaScript Toolbox css-javascript-toolbox Custom Field Template custom-field-template Custom Twitter Feeds – A Tweets Widget or X Feed Widget custom-twitter-feeds Datalogics Ecommerce Delivery – Datalogics datalogics design-scuole-wordpress-theme design-scuole-wordpress-theme Dewa Kirim – WooCommerce Gojek / Gosend dewa-kirim-woocommerce-gojek Dictionary dictionary Divi Essentials divi-essential Download Manager download-manager DS Ad Rotator ds-adrotator Easy Appointments easy-appointments Easy Form Builder by WhiteStudio – Drag & Drop Form Builder easy-form-builder Easy Invoice – Invoice Generator, PDF Quotes & Payments easy-invoice EduAdmin Booking eduadmin-booking Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons bdthemes-element-pack-lite EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents embedpress Empik for Woocommerce empik-for-woocommerce Estatik Real Estate Plugin estatik Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar mage-eventpress Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce wp-event-solution EWWW Image Optimizer ewww-image-optimizer Export & Import WPBakery Page Builder vc-templates-import-export FileBird – WordPress Media Library Folders & File Manager filebird Filter Gallery filter-gallery Flex Import flex-import FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login fluent-security FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration fluent-boards Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More formidable Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator Foxtool All-in-One: Contact chat button, Custom login, Media optimize images foxtool Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 GenieWords geniewords Geo Mashup geo-mashup Getwid – Gutenberg Blocks getwid GiveWP – Donation Plugin and Fundraising Platform give GoPay for WooCommerce gopay-gateway GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI gptranslate Gravity Forms gravityforms Gum Addon for Elementor gum-elementor-addon Headless SSO Plugin for WP headless-single-sign-on Hide My WP Ghost – Security & Firewall hide-my-wp Hoo Companion hoo-companion HT Mega Addons for Elementor – Elementor Widgets & Template Builder ht-mega-for-elementor Hydra Booking — Appointment Scheduling & Booking Calendar hydra-booking Ibtana – Ecommerce Product Addons ibtana-ecommerce-product-addons IDB Ecommerce (wpStoreCart 5) wpstorecart iGMS Direct Booking igms-direct-booking Import and export users and customers import-users-from-csv-with-meta InfiniteWP Client iwp-client Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms gdpr-compliant-recaptcha-for-all-forms Issues and Series for Newspapers, Magazines, Publishers, Writers organize-series Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress jeg-elementor-kit JetBlocks for Elementor jet-blocks JetBlog jet-blog JetElements jet-elements JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder JetSearch jet-search JetTabs jet-tabs Job Postings job-postings JWT Authentication for WP REST APIs wp-rest-api-authentication kboard kboard King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder king-addons Kirki – Freeform Page Builder, Website Builder & Customizer kirki Kubio AI Page Builder kubio LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress LiteSpeed Cache litespeed-cache Location Manager geodir_location_manager Login with QR login-with-qr Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid magazine-blocks Mailchimp for WooCommerce mailchimp-for-woocommerce Mapster WP Maps mapster-wp-maps Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits master-addons Master Blocks – Ultimate Blocks for Marketers ultimate-blocks-for-gutenberg Master Slider – Responsive Touch Slider master-slider MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system MC4WP: Mailchimp for WordPress mailchimp-for-wp Meow Gallery meow-gallery MgoSync – European dropshipping and suppliers megamo Migratico Lite migratico-lite MoreConvert Wishlist for WooCommerce smart-wishlist-for-more-convert MotoPress Hotel Booking motopress-hotel-booking-lite Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings Multi Uploader for Gravity Forms gf-multi-uploader MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor Newsletter newsletter-email-mailing-list Newsletter – Send awesome emails from WordPress newsletter Newsletters newsletters-lite NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard ni-woocommerce-sales-report Nimble Page Builder nimble-builder Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp OTP Login & Register Woocommerce mobile-login-woocommerce Paid Downloads paid-downloads Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress wp-user-avatar Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions Partial Shipment for WooCommerce wc-partial-shipment Payment Gateway for PayPal on WooCommerce woo-paypal-gateway Payment Gateway of Stripe for WooCommerce payment-gateway-stripe-and-woocommerce-integration PDF Builder for WooCommerce. Create invoices,packing slips and more woo-pdf-invoice-builder Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery nextgen-gallery Pochipp pochipp Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder popup-maker Price Drop Alert for Woo Commerce woo-price-drop-alert Printcart Store – Web to Print Product Designer for WooCommerce printcart-integration Private Feed Key private-feed-key Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels best-woocommerce-feed Product Question and Answer product-question-and-answer Property Hive propertyhive PuppyFW puppyfw Qi Addons For Elementor qi-addons-for-elementor Quill Forms | Conversational Multi Step Forms, Surveys & quizzes quillforms Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder real3d-flipbook-lite Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) really-simple-ssl Realtyna Organic IDX plugin + WPL Real Estate real-estate-listing-realtyna-wpl Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit woo-rede Redux Framework redux-framework RestroPress – Online Food Ordering System restropress Robokassa payment gateway for Woocommerce robokassa Rox Appointment Booking – Appointment Booking Scheduling Solution rox-appointment-booking Royal Addons for Elementor – Addons and Templates Kit for Elementor royal-elementor-addons RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg rt-mega-menu SAML Single Sign On – SSO Login miniorange-saml-20-single-sign-on SAMO Forms samo-forms Save as PDF Plugin by PDFCrowd save-as-pdf-by-pdfcrowd Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp Search Atlas SEO – OTTO AI SEO Automation for WordPress metasync Secure Custom Fields secure-custom-fields SEO Booster seo-booster Seraphinite Accelerator seraphinite-accelerator Share-one-Drive | OneDrive & SharePoint plugin for WordPress shareonedrive-onedrive-plugin-for-wordpress ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets shopengine ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin woolentor-addons ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel-image-optimiser Sign-up Sheets sign-up-sheets Simple Membership simple-membership SKT Addons for Elementor skt-addons-for-elementor SSL Zen — SSL Certificate Installer & HTTPS Redirects ssl-zen Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers woocommerce-exporter Strong Testimonials strong-testimonials Subscriptions for WooCommerce subscriptions-for-woocommerce The Pressengine the-pressengine The Welcomizer the-welcomizer TikTok tiktok-for-business To Do List Member todo-lists-for-membership-sites Tripzzy – Travel Engine System tripzzy TrueBooker – Appointment Booking and Scheduler System truebooker-appointment-booking Tutor LMS – eLearning and online course solution tutor Tz Weekly Radio Schedule tz-wrs-core Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member Ultra Addons for Contact Form 7 ultimate-addons-for-contact-form-7 Unbounce Landing Pages unbounce Unlimited Elements For Elementor unlimited-elements-for-elementor UpsellWP – Upsell and Related Products Offers for WooCommerce checkout-upsell-and-order-bumps Use-your-Drive | Google Drive plugin for WordPress use-your-drive User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder user-registration UsersWP – Social Login userswp-social-login VikBooking Hotel Booking Engine & PMS vikbooking VikRentItems Flexible Rental Management System vikrentitems Visitor Traffic Real Time Statistics pro visitors-traffic-real-time-statistics-pro Visualizer – Tables & Charts Manager with Built-in AI Generator visualizer VK All in One Expansion Unit vk-all-in-one-expansion-unit WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors wc-vendors WCFM Marketplace – Multivendor Marketplace for WooCommerce wc-multivendor-marketplace Web to Print Online Designer web-to-print-online-designer WordLift – AI powered SEO – Schema wordlift Wow Elements Addons for Elementor wow-elements-addons-for-elementor WP Cloud Plugins - Box (Lets-Box) lets-box WP Cloud Plugins - Dropbox (Out-of-the-Box) out-of-the-box WP Component wpcomponent WP Composer – The Easiest Page Builder page-builder-wp WP Customer Reviews wp-customer-reviews WP Directory Kit wpdirectorykit WP Easy Pay – Payment and Donation Form Builder for Square wp-easy-pay WP images upload on piclect wp-images-upload-on-piclect WP Import Export Lite wp-import-export-lite WP Inventory Manager wp-inventory-manager WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings wp-google-map-plugin WP Mega Menu wp-megamenu WP Multi Store Locator Pro wp-multi-store-locator-pro WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals wp-optimizer WP Photo Album Plus wp-photo-album-plus WP Recipe Maker wp-recipe-maker wp shortcut link and advertisement baner wp-shortcut-link WP-Lister Lite for eBay wp-lister-for-ebay WP2Social Auto Publish facebook-auto-publish WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services chatbot WPComplete wpcomplete WPGraphQL Smart Cache wpgraphql-smart-cache WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode gdpr-cookie-consent WPMasterToolKit (WPMTK) – All in one plugin wpmastertoolkit wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility xagio-seo Xpro Addons — 150+ Widgets for Elementor xpro-elementor-addons YayPricing – WooCommerce Dynamic Pricing & Discounts yaypricing Yo yo Yogeta WP Cloud yogeta-wp-cloud YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin youram-youtube-embed YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress ysleadgen Zonify – Amazon Product Importer for WooCommerce zonify WordPress Themes with Reported Vulnerabilities Last Week Software Name Software Slug Bridge - Creative Multipurpose WordPress Theme bridge Consulting - Business, Finance WordPress Theme consulting Divi Divi VW Writer Blog vw-writer-blog Vulnerability Details Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize. Admin Menu Editor Pro 2.35 - 2.36 - Backdoored Software 9.8 CVSS Rating 9.8 (Critical) Patch Status Unpatched Published Sep 15, 2026 Affected Software Admin Menu Editor Pro [admin-menu-editor-pro] Researcher(s): Unknown More Details > Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type 9.8 CVSS Rating 9.8 (Critical) Patch Status Patched Published Sep 14, 2026 Affected Software Advanced Custom Fields: Extended PRO [acf-extended-pro] Researchers Tin Pham (TF1T)Trong Pham (dtro)Hao Ngo More Details > Choose User Role at Registration for WooCommerce <= 1.3.2 - Unauthenticated Privilege Escalation 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-85128 Patch Status Patched Published Sep 15, 2026 Affected Software Choose User Role at Registration for WooCommerce [choose-user-role-at-registration] Researcher Mike Gozdiskowski More Details > DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-81402 Patch Status Unpatched Published Sep 14, 2026 Affected Software DS Ad Rotator [ds-adrotator] Researcher Huynh Kien Minh More Details > Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-84434 Patch Status Patched Published Sep 18, 2026 Affected Software Gravity Forms [gravityforms] Researcher 0xd4rk5id3 More Details > JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-12793 Patch Status Patched Published Sep 15, 2026 Affected Software JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] Researcher daroo More Details > Login with QR <= 1.0.0 - Authentication Bypass 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-86710 Patch Status Unpatched Published Sep 15, 2026 Affected Software Login with QR [login-with-qr] Researcher Naoki Kawahigashi More Details > Migratico Lite <= 2.6.8 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-62104 Patch Status Patched Published Sep 15, 2026 Affected Software Migratico Lite [migratico-lite] Researcher Ananda Dhakal More Details > Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-87796 Patch Status Unpatched Published Sep 16, 2026 Affected Software Multi Uploader for Gravity Forms [gf-multi-uploader] Researcher Adam Rayyan Aryasatya More Details > Private Feed Key <= 0.1 - Authentication Bypass 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-86707 Patch Status Unpatched Published Sep 15, 2026 Affected Software Private Feed Key [private-feed-key] Researcher Naoki Kawahigashi More Details > The Pressengine <= 1.0 - Authentication Bypass 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-86709 Patch Status Unpatched Published Sep 15, 2026 Affected Software The Pressengine [the-pressengine] Researcher Naoki Kawahigashi More Details > TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-14349 Patch Status Patched Published Sep 15, 2026 Affected Software TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking] Researcher Devlin Jenkins More Details > Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-84750 Patch Status Patched Published Sep 17, 2026 Affected Software Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] Researcher Jakub Herman More Details > WooCommerce Online Product Designer <= 2.14.0 - Unauthenticated Arbitrary File Upload 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-82187 Patch Status Patched Published Sep 19, 2026 Affected Software Web to Print Online Designer [web-to-print-online-designer] Researcher Mike Gozdiskowski More Details > WP images upload on piclect <= 1.0 - Unauthenticated Arbitrary File Upload 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-84171 Patch Status Unpatched Published Sep 14, 2026 Affected Software WP images upload on piclect [wp-images-upload-on-piclect] Researcher João Ramos Maciel More Details > wpShopGermany IT-RECHT KANZLEI <= 2.3 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-88795 Patch Status Patched Published Sep 15, 2026 Affected Software wpShopGermany IT-RECHT KANZLEI [wpshopgermany-it-recht-kanzlei] Researcher Naoki Kawahigashi More Details > Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-92229 Patch Status Patched Published Sep 18, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher Kuba More Details > WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-89274 Patch Status Patched Published Sep 18, 2026 Affected Software WP Recipe Maker [wp-recipe-maker] Researcher Md. Moniruzzaman Prodhan (NomanProdhan) More Details > Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-14805 Patch Status Patched Published Sep 14, 2026 Affected Software Consulting - Business, Finance WordPress Theme [consulting] Researcher lhking More Details > Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-78088 Patch Status Patched Published Sep 15, 2026 Affected Software Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery] Researcher mad4cyber More Details > Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-12954 Patch Status Patched Published Sep 17, 2026 Affected Software Mapster WP Maps [mapster-wp-maps] Researcher Wordfence PRISM More Details > Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-92807 Patch Status Patched Published Sep 18, 2026 Affected Software Save as PDF Plugin by PDFCrowd [save-as-pdf-by-pdfcrowd] Researcher Wordfence PRISM More Details > ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-17086 Patch Status Patched Published Sep 17, 2026 Affected Software ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser] Researcher Josh Bolding More Details > The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-4327 Patch Status Patched Published Sep 18, 2026 Affected Software The Welcomizer [the-welcomizer] Researcher Nabil Irawan More Details > WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-93031 Patch Status Patched Published Sep 17, 2026 Affected Software Share-one-Drive | OneDrive & SharePoint plugin for WordPress [shareonedrive-onedrive-plugin-for-wordpress]Use-your-Drive | Google Drive plugin for WordPress [use-your-drive]WP Cloud Plugins - Box (Lets-Box) [lets-box]WP Cloud Plugins - Dropbox (Out-of-the-Box) [out-of-the-box] Researcher WP Cloud Plugins More Details > Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-89413 Patch Status Patched Published Sep 17, 2026 Affected Software Filter Gallery [filter-gallery] Researcher Supakiad S. (m3ez) More Details > IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-84099 Patch Status Unpatched Published Sep 14, 2026 Affected Software IDB Ecommerce (wpStoreCart 5) [wpstorecart] Researcher reconnaissance More Details > Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-85410 Patch Status Patched Published Sep 17, 2026 Affected Software Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits [master-addons] Researcher Dmitrii Ignatyev More Details > Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-87935 Patch Status Unpatched Published Sep 16, 2026 Affected Software Paid Downloads [paid-downloads] Researcher Spy0x7 More Details > Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-85658 Patch Status Patched Published Sep 18, 2026 Affected Software Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar] Researcher Md. Moniruzzaman Prodhan (NomanProdhan) More Details > Album Cover Finder <= 0.7.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-84047 Patch Status Unpatched Published Sep 14, 2026 Affected Software Album Cover Finder [album-cover-finder] Researcher João Ramos Maciel More Details > All Bootstrap Blocks 1.3.20 - 1.3.31 - Authenticated (Contributor+) Local File Inclusion 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-88994 Patch Status Unpatched Published Sep 16, 2026 Affected Software All Bootstrap Blocks [all-bootstrap-blocks] Researcher Revanth Hari Narayana Matte More Details > Design Scuole Italia <= 2.18.1 - Unauthenticated Arbitrary File Donwload 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-87791 Patch Status Unpatched Published Sep 15, 2026 Affected Software design-scuole-wordpress-theme [design-scuole-wordpress-theme] Researcher(s): Unknown More Details > Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-75983 Patch Status Patched Published Sep 14, 2026 Affected Software Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Wordfence PRISM More Details > Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-85705 Patch Status Patched Published Sep 17, 2026 Affected Software Location Manager [geodir_location_manager] Researcher Austin Ginder More Details > Ni WooCommerce Sales Report <= 4.1.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-78472 Patch Status Patched Published Sep 14, 2026 Affected Software Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard [ni-woocommerce-sales-report] Researcher Erwan LR More Details > Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-89063 Patch Status Patched Published Sep 15, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher jtb75 More Details > Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-87770 Patch Status Unpatched Published Sep 16, 2026 Affected Software Price Drop Alert for Woo Commerce [woo-price-drop-alert] Researcher Theo Antônio Da Fonseca More Details > Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-14323 Patch Status Patched Published Sep 17, 2026 Affected Software Printcart Store – Web to Print Product Designer for WooCommerce [printcart-integration] Researcher Spy0x7 More Details > Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-87771 Patch Status Unpatched Published Sep 16, 2026 Affected Software Product Question and Answer [product-question-and-answer] Researcher Theo Antônio Da Fonseca More Details > SAMO Forms <= 1.0.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-80491 Patch Status Unpatched Published Sep 14, 2026 Affected Software SAMO Forms [samo-forms] Researcher João Ramos Maciel More Details > Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-87767 Patch Status Unpatched Published Sep 16, 2026 Affected Software wp shortcut link and advertisement baner [wp-shortcut-link] Researcher Theo Antônio Da Fonseca More Details > Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-87775 Patch Status Unpatched Published Sep 16, 2026 Affected Software Tz Weekly Radio Schedule [tz-wrs-core] Researcher Enrico Marcolini More Details > Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-87774 Patch Status Unpatched Published Sep 16, 2026 Affected Software Tz Weekly Radio Schedule [tz-wrs-core] Researcher Theo Antônio Da Fonseca More Details > Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-85017 Patch Status Patched Published Sep 18, 2026 Affected Software Unlimited Elements For Elementor [unlimited-elements-for-elementor] Researcher Jakub Herman More Details > VikRentItems Flexible Rental Management System <= 1.2.3 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-88926 Patch Status Patched Published Sep 17, 2026 Affected Software VikRentItems Flexible Rental Management System [vikrentitems] Researchers Artus KGShhriyash More Details > WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-18442 Patch Status Patched Published Sep 17, 2026 Affected Software WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace] Researcher Jonah Burgess (CryptoCat) More Details > WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-15275 Patch Status Patched Published Sep 17, 2026 Affected Software WP Multi Store Locator Pro [wp-multi-store-locator-pro] Researcher Rafie Muhammad More Details > WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-87909 Patch Status Patched Published Sep 18, 2026 Affected Software WP Photo Album Plus [wp-photo-album-plus] Researcher daroo More Details > Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-87963 Patch Status Unpatched Published Sep 15, 2026 Affected Software Yo [yo] Researcher João Ramos Maciel More Details > Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Read 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-80494 Patch Status Unpatched Published Sep 14, 2026 Affected Software Yogeta WP Cloud [yogeta-wp-cloud] Researcher Huynh Kien Minh More Details > YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-1255 Patch Status Patched Published Sep 18, 2026 Affected Software YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress [ysleadgen] Researcher Athiwat Tiprasaharn (Jitlada) More Details > GiveWP <= 4.16.8.0 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-85530 Patch Status Patched Published Sep 14, 2026 Affected Software GiveWP – Donation Plugin and Fundraising Platform [give] Researcher Jakub Herman More Details > Headless SSO Plugin for WP <= 1.7.0 - Unauthenticated Arbitrary Account Takeover 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-62108 Patch Status Patched Published Sep 15, 2026 Affected Software Headless SSO Plugin for WP [headless-single-sign-on] Researcher Joost Grunwald More Details > SAML Single Sign On <= 5.0.0 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-82842 Patch Status Patched Published Sep 18, 2026 Affected Software SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on] Researcher Karthik Ramakrishnan More Details > UsersWP - Social Login <= 1.5.9 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-86814 Patch Status Patched Published Sep 17, 2026 Affected Software UsersWP – Social Login [userswp-social-login] Researcher Pedro Pinho More Details > WP Component <= 2.2.4 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-85681 Patch Status Unpatched Published Sep 14, 2026 Affected Software WP Component [wpcomponent] Researcher Enrico Marcolini More Details > AF Companion <= 2.1.0 - Authenticated (Shop Manager+) Remote Code Execution 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-84738 Patch Status Patched Published Sep 16, 2026 Affected Software AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing [af-companion] Researcher Farhan Fawwaz Saputra More Details > Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-13354 Patch Status Patched Published Sep 18, 2026 Affected Software Asset CleanUp: Page Speed Booster [wp-asset-clean-up] Researcher Pham Duc Anh More Details > BE REST Endpoints <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-81742 Patch Status Unpatched Published Sep 14, 2026 Affected Software BE REST Endpoints [be-rest-endpoints] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-92619 Patch Status Patched Published Sep 17, 2026 Affected Software Booking Calendar [booking] Researcher Wordfence PRISM More Details > Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-83561 Patch Status Patched Published Sep 17, 2026 Affected Software Complianz GDPR/CCPA Cookie Consent Banner [complianz-gdpr] Researcher theviper17y More Details > Dewa Kirim <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-87786 Patch Status Unpatched Published Sep 15, 2026 Affected Software Dewa Kirim – WooCommerce Gojek / Gosend [dewa-kirim-woocommerce-gojek] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Dictionary <= 1.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-88792 Patch Status Unpatched Published Sep 15, 2026 Affected Software Dictionary [dictionary] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-85122 Patch Status Patched Published Sep 16, 2026 Affected Software Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder] Researcher Civitasmass More Details > Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-87068 Patch Status Patched Published Sep 18, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher Karthik Ramakrishnan More Details > Generate PDF using Contact Form 7 <= 4.2.1 - Unauthenticated Server-Side Request Forgery 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-90984 Patch Status Patched Published Sep 16, 2026 Affected Software Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7] Researcher Artus KG More Details > GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-74933 Patch Status Unpatched Published Sep 14, 2026 Affected Software GenieWords [geniewords] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Hoo Companion 1.0.2 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-85129 Patch Status Unpatched Published Sep 14, 2026 Affected Software Hoo Companion [hoo-companion] Researchers Enrico MarcoliniClaudio Marchesini More Details > iGMS Direct Booking <= 1.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-88825 Patch Status Patched Published Sep 16, 2026 Affected Software iGMS Direct Booking [igms-direct-booking] Researcher Enrico Marcolini More Details > Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-92540 Patch Status Patched Published Sep 18, 2026 Affected Software Import and export users and customers [import-users-from-csv-with-meta] Researcher yzx001 More Details > Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-92541 Patch Status Patched Published Sep 18, 2026 Affected Software Import and export users and customers [import-users-from-csv-with-meta] Researcher Binesh Madharapu More Details > Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Upload 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-76552 Patch Status Patched Published Sep 14, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher mak3bread More Details > Import Export Lite <= 3.9.32 - Authenticated (Admin+) Remote Code Execution 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-76551 Patch Status Patched Published Sep 14, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher Erwan LR More Details > Import Export Lite <= 3.9.33 - Authenticated (Admin+) Remote Code Execution 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-76550 Patch Status Patched Published Sep 14, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher mak3bread More Details > Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-18405 Patch Status Patched Published Sep 17, 2026 Affected Software Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit] Researcher daroo More Details > Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-88824 Patch Status Patched Published Sep 16, 2026 Affected Software Master Blocks – Ultimate Blocks for Marketers [ultimate-blocks-for-gutenberg] Researcher Enrico Marcolini More Details > MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-90650 Patch Status Patched Published Sep 15, 2026 Affected Software MotoPress Hotel Booking [motopress-hotel-booking-lite] Researcher h0xilo More Details > NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-81650 Patch Status Patched Published Sep 18, 2026 Affected Software Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] Researcher Alihan Şahin More Details > Optimole <= 4.2.11 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-84829 Patch Status Patched Published Sep 14, 2026 Affected Software Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp] Researcher Jakub Herman More Details > Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-87915 Patch Status Patched Published Sep 17, 2026 Affected Software Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder [popup-maker] Researcher Naoya Takahashi (nakko) More Details > Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-15664 Patch Status Patched Published Sep 18, 2026 Affected Software Quill Forms | Conversational Multi Step Forms, Surveys & quizzes [quillforms] Researcher zickzick2 More Details > Royal Elementor Addons <= 1.7.1066 - Unauthenticated Arbitrary HTML Injection in Notification Emails 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-13407 Patch Status Patched Published Sep 14, 2026 Affected Software Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] Researcher Brian Willows More Details > To Do List Member 1.4 - 1.6 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-86801 Patch Status Unpatched Published Sep 15, 2026 Affected Software To Do List Member [todo-lists-for-membership-sites] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-85680 Patch Status Patched Published Sep 17, 2026 Affected Software Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] Researcher Karthik Ramakrishnan More Details > VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored Cross-Site Scripting via SVG Upload 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-85127 Patch Status Patched Published Sep 16, 2026 Affected Software VikBooking Hotel Booking Engine & PMS [vikbooking] Researcher anhdung1329 More Details > Visitor Traffic Real Time Statistics pro <= 11.21 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-90986 Patch Status Patched Published Sep 14, 2026 Affected Software Visitor Traffic Real Time Statistics pro [visitors-traffic-real-time-statistics-pro] Researcher Nguyen Ba Khanh More Details > WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93485 Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher Rafie Muhammad More Details > WP Inventory Manager <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-90887 Patch Status Unpatched Published Sep 14, 2026 Affected Software WP Inventory Manager [wp-inventory-manager] Researcher sorawautsukushiii More Details > WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-18595 Patch Status Patched Published Sep 15, 2026 Affected Software WP-Lister Lite for eBay [wp-lister-for-ebay] Researcher thevietronin More Details > WPLP Cookie Consent <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-85130 Patch Status Patched Published Sep 15, 2026 Affected Software WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent] Researcher Karthik Ramakrishnan More Details > YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin 10.0 - 10.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-88793 Patch Status Unpatched Published Sep 14, 2026 Affected Software YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin [youram-youtube-embed] Researcher Adem0n__ More Details > Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-87067 Patch Status Patched Published Sep 18, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher Karthik Ramakrishnan More Details > AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-89141 Patch Status Patched Published Sep 14, 2026 Affected Software AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine] Researcher Chi Trung Huynh More Details > Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/' REST Endpoint 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-89334 Patch Status Patched Published Sep 18, 2026 Affected Software Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] Researcher Supakiad S. (m3ez) More Details > Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-13191 Patch Status Patched Published Sep 18, 2026 Affected Software Create [mediavine-create] Researcher Wordfence PRISM More Details > Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-13200 Patch Status Patched Published Sep 18, 2026 Affected Software Create [mediavine-create] Researcher Wordfence PRISM More Details > Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-9855 Patch Status Patched Published Sep 18, 2026 Affected Software Custom Field Template [custom-field-template] Researcher Luc Huynh from Noventiq RedTeam More Details > Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-15760 Patch Status Patched Published Sep 18, 2026 Affected Software Divi Essentials [divi-essential] Researcher 0xd4rk5id3 More Details > Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-92714 Patch Status Patched Published Sep 17, 2026 Affected Software Download Manager [download-manager] Researcher pb>sec More Details > Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-9232 Patch Status Patched Published Sep 18, 2026 Affected Software Easy Appointments [easy-appointments] Researcher Ryoma Nishioka More Details > Formidable Forms <= 6.34 - Unauthenticated Arbitrary Shortcode Execution 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-19857 Patch Status Patched Published Sep 14, 2026 Affected Software Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] Researcher Jakub Herman More Details > GiveWP <= 4.16.8 - Unauthenticated Arbitrary Shortcode Execution 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-85113 Patch Status Patched Published Sep 18, 2026 Affected Software GiveWP – Donation Plugin and Fundraising Platform [give] Researcher Jakub Herman More Details > InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-17576 Patch Status Patched Published Sep 17, 2026 Affected Software InfiniteWP Client [iwp-client] Researcher Wordfence PRISM More Details > JetFormBuilder <= 3.6.5.2 - Authenticated (Administrator+) Arbitrary File Deletion 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-19860 Patch Status Patched Published Sep 17, 2026 Affected Software JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] Researcher Sai Praneeth Koti More Details > Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-85652 Patch Status Patched Published Sep 17, 2026 Affected Software Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery] Researcher VuxNx More Details > Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels <= 7.12.0 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-66580 Patch Status Patched Published Sep 17, 2026 Affected Software Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels [best-woocommerce-feed] Researcher John Ryan Albon More Details > Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-89333 Patch Status Patched Published Sep 18, 2026 Affected Software Tutor LMS – eLearning and online course solution [tutor] Researcher Dthangws More Details > Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-1641 Patch Status Patched Published Sep 18, 2026 Affected Software Wow Elements Addons for Elementor [wow-elements-addons-for-elementor] Researchers Athiwat Tiprasaharn (Jitlada)Itthidej Aramsri (Boeing777)Waris Damkham More Details > WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-16588 Patch Status Patched Published Sep 15, 2026 Affected Software WP Directory Kit [wpdirectorykit] Researcher adhikara13 More Details > WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-17607 Patch Status Patched Published Sep 17, 2026 Affected Software WP Inventory Manager [wp-inventory-manager] Researcher Wordfence PRISM More Details > Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-11996 Patch Status Patched Published Sep 15, 2026 Affected Software Advanced Popups [advanced-popups] Researcher Nguyen Cong Quang More Details > All Bootstrap Blocks <= 1.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-88993 Patch Status Unpatched Published Sep 16, 2026 Affected Software All Bootstrap Blocks [all-bootstrap-blocks] Researcher Revanth Hari Narayana Matte More Details > AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-13770 Patch Status Patched Published Sep 18, 2026 Affected Software AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) [appmysite] Researcher Mitchell More Details > Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of Tags 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-12106 Patch Status Patched Published Sep 17, 2026 Affected Software Auto Upload Images [auto-upload-images] Researcher Scc2 More Details > Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-5920 Patch Status Patched Published Sep 15, 2026 Affected Software Bold Page Builder [bold-page-builder] Researcher suyoung kim(AhnLab) More Details > Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15609 Patch Status Patched Published Sep 14, 2026 Affected Software Bridge - Creative Multipurpose WordPress Theme [bridge] Researcher João Pedro Soares de Alcântara More Details > Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-2585 Patch Status Patched Published Sep 17, 2026 Affected Software Brizy – Page Builder [brizy] Researchers Athiwat Tiprasaharn (Jitlada)Itthidej Aramsri (Boeing777)Tharadol Suksamran (d3kc4rt_1) More Details > Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-84909 Patch Status Patched Published Sep 17, 2026 Affected Software Custom Twitter Feeds – A Tweets Widget or X Feed Widget [custom-twitter-feeds] Researcher Wordfence PRISM More Details > Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66574 Patch Status Patched Published Sep 17, 2026 Affected Software Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite] Researcher Dthangws More Details > Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15402 Patch Status Patched Published Sep 14, 2026 Affected Software Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Wordfence PRISM More Details > EWWW Image Optimizer <= 8.7.6 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-91011 Patch Status Patched Published Sep 15, 2026 Affected Software EWWW Image Optimizer [ewww-image-optimizer] Researcher Artus KG More Details > Geo Mashup <= 1.13.21 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-78294 Patch Status Patched Published Sep 16, 2026 Affected Software Geo Mashup [geo-mashup] Researcher JunHee CHO More Details > Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle' 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-5924 Patch Status Patched Published Sep 15, 2026 Affected Software Getwid – Gutenberg Blocks [getwid] Researcher AlexHenry More Details > Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-8354 Patch Status Patched Published Sep 18, 2026 Affected Software Gum Addon for Elementor [gum-elementor-addon] Researcher Valatty More Details > HT Mega 3.2.0 - 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-86788 Patch Status Patched Published Sep 15, 2026 Affected Software HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor] Researcher Revanth Hari Narayana Matte More Details > Import Export Lite <= 3.9.32 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-76558 Patch Status Patched Published Sep 14, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher mak3bread More Details > Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66617 Patch Status Patched Published Sep 17, 2026 Affected Software Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series] Researcher Nixxies More Details > JetBlocks for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66576 Patch Status Patched Published Sep 17, 2026 Affected Software JetBlocks for Elementor [jet-blocks] Researcher nh4tvd More Details > JetBlog <= 2.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66572 Patch Status Patched Published Sep 17, 2026 Affected Software JetBlog [jet-blog] Researcher nh4tvd More Details > JetElements <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66579 Patch Status Patched Published Sep 17, 2026 Affected Software JetElements [jet-elements] Researcher nh4tvd More Details > JetSearch <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66577 Patch Status Patched Published Sep 17, 2026 Affected Software JetSearch [jet-search] Researcher nh4tvd More Details > JetTabs <= 2.3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66573 Patch Status Patched Published Sep 17, 2026 Affected Software JetTabs [jet-tabs] Researcher nh4tvd More Details > Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-18063 Patch Status Patched Published Sep 14, 2026 Affected Software Job Postings [job-postings] Researcher Jonah Burgess (CryptoCat) More Details > King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-84902 Patch Status Patched Published Sep 16, 2026 Affected Software King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons] Researcher Sai Praneeth Koti More Details > Kirki 6.0.0 - 6.3.0 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-84223 Patch Status Patched Published Sep 18, 2026 Affected Software Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] Researcher Mohammed Abd Alrahman More Details > Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-14472 Patch Status Patched Published Sep 17, 2026 Affected Software Kubio AI Page Builder [kubio] Researcher Wordfence PRISM More Details > Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-75016 Patch Status Patched Published Sep 17, 2026 Affected Software Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid [magazine-blocks] Researcher Wordfence PRISM More Details > Master Slider <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-14844 Patch Status Unpatched Published Sep 18, 2026 Affected Software Master Slider – Responsive Touch Slider [master-slider] Researcher WEI HSIANG WANG More Details > Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-86311 Patch Status Patched Published Sep 16, 2026 Affected Software Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery] Researcher VuxNx More Details > Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15797 Patch Status Patched Published Sep 17, 2026 Affected Software Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder [popup-maker] Researcher UKO More Details > Property Hive <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66578 Patch Status Patched Published Sep 17, 2026 Affected Software Property Hive [propertyhive] Researcher Ananda Dhakal More Details > Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15098 Patch Status Patched Published Sep 18, 2026 Affected Software Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite] Researcher Wordfence PRISM More Details > Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-5400 Patch Status Patched Published Sep 18, 2026 Affected Software Redux Framework [redux-framework] Researcher h0xilo More Details > Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-5410 Patch Status Patched Published Sep 18, 2026 Affected Software Redux Framework [redux-framework] Researcher Luc Huynh from Noventiq RedTeam More Details > RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-14855 Patch Status Unpatched Published Sep 17, 2026 Affected Software RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu] Researcher Mitchell More Details > RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15650 Patch Status Unpatched Published Sep 17, 2026 Affected Software RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu] Researcher Wordfence PRISM More Details > Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-92622 Patch Status Patched Published Sep 17, 2026 Affected Software Strong Testimonials [strong-testimonials] Researcher pb>sec More Details > The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-85575 Patch Status Patched Published Sep 14, 2026 Affected Software ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets [shopengine] Researcher Romain Deperne (ang3L) More Details > Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Contributor+) Server-Side Request Forgery 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-66608 Patch Status Patched Published Sep 17, 2026 Affected Software Unlimited Elements For Elementor [unlimited-elements-for-elementor] Researcher Ayukiab More Details > Visualizer <= 4.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-86784 Patch Status Patched Published Sep 14, 2026 Affected Software Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer] Researcher Yaswanth Reddy Sunkara More Details > VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-17586 Patch Status Patched Published Sep 17, 2026 Affected Software VK All in One Expansion Unit [vk-all-in-one-expansion-unit] Researchers KyokitoAthiwat Tiprasaharn (Jitlada)Itthidej Aramsri (Boeing777) More Details > WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-2422 Patch Status Patched Published Sep 18, 2026 Affected Software WP Composer – The Easiest Page Builder [page-builder-wp] Researcher Athiwat Tiprasaharn (Jitlada) More Details > WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-77820 Patch Status Patched Published Sep 18, 2026 Affected Software WPComplete [wpcomplete] Researcher Wordfence PRISM More Details > Xpro Elementor Addons <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-84088 Patch Status Patched Published Sep 14, 2026 Affected Software Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons] Researcher Dmitrii Ignatyev More Details > YayPricing – WooCommerce Dynamic Pricing & Discounts < 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-87888 Patch Status Patched Published Sep 14, 2026 Affected Software YayPricing – WooCommerce Dynamic Pricing & Discounts [yaypricing] Researcher Artus KG More Details > YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-1256 Patch Status Patched Published Sep 18, 2026 Affected Software YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress [ysleadgen] Researchers Athiwat Tiprasaharn (Jitlada)Itthidej Aramsri (Boeing777)PowpyWaris Damkham More Details > Add User Autocomplete < 1.2 - Authenticated (Subscriber+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-87759 Patch Status Patched Published Sep 14, 2026 Affected Software Add User Autocomplete [add-user-autocomplete] Researcher Nguyen Huu Do More Details > Booking for Appointments and Events Calendar – Amelia < 2.4.10 - Authenticated (Custom Role+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-77705 Patch Status Patched Published Sep 14, 2026 Affected Software Booking for Appointments and Events Calendar – Amelia [ameliabooking] Researcher Karthik Ramakrishnan More Details > PuppyFW <= 0.4.4 - Authenticated (Subscriber+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-88904 Patch Status Unpatched Published Sep 15, 2026 Affected Software PuppyFW [puppyfw] Researcher Naoki Kawahigashi More Details > User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Authenticated (Author+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-80071 Patch Status Patched Published Sep 14, 2026 Affected Software User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration] Researcher Jonathan Dersch More Details > User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 4.4.6 - 5.2.7 - Authenticated (Subscriber+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-86406 Patch Status Patched Published Sep 14, 2026 Affected Software User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration] Researcher Karthik Ramakrishnan More Details > Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-18555 Patch Status Patched Published Sep 15, 2026 Affected Software Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] Researcher Jonah Burgess (CryptoCat) More Details > Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92561 Patch Status Patched Published Sep 17, 2026 Affected Software Booking Calendar [booking] Researcher Yuto Hyakumoto More Details > Design Scuole Italia <= 2.18.2 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-87793 Patch Status Unpatched Published Sep 15, 2026 Affected Software design-scuole-wordpress-theme [design-scuole-wordpress-theme] Researcher(s): Unknown More Details > Dictionary <= 1.0 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2025-15697 Patch Status Unpatched Published Sep 15, 2026 Affected Software Dictionary [dictionary] Researcher Hassan Khan Yusufzai More Details > EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-89330 Patch Status Patched Published Sep 17, 2026 Affected Software EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress] Researcher crow More Details > Estatik <= 4.3.4 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-76790 Patch Status Patched Published Sep 17, 2026 Affected Software Estatik Real Estate Plugin [estatik] Researcher Morato Antoine More Details > LearnPress <= 4.4.6 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-86444 Patch Status Patched Published Sep 14, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher Karthik Ramakrishnan More Details > MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-87917 Patch Status Patched Published Sep 18, 2026 Affected Software MC4WP: Mailchimp for WordPress [mailchimp-for-wp] Researcher nism0 More Details > Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-90981 Patch Status Patched Published Sep 17, 2026 Affected Software Newsletter – Send awesome emails from WordPress [newsletter] Researcher Yuto Hyakumoto More Details > Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92967 Patch Status Patched Published Sep 18, 2026 Affected Software Pochipp [pochipp] Researcher Dmitrii Ignatyev More Details > Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92249 Patch Status Patched Published Sep 17, 2026 Affected Software Qi Addons For Elementor [qi-addons-for-elementor] Researcher Adrien Brunner More Details > Realtyna Organic IDX plugin + WPL Real Estate <= 5.4.1 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-91014 Patch Status Patched Published Sep 15, 2026 Affected Software Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl] Researcher Artus KG More Details > ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92554 Patch Status Patched Published Sep 17, 2026 Affected Software ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons] Researcher Kuba More Details > SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-15463 Patch Status Patched Published Sep 18, 2026 Affected Software SSL Zen — SSL Certificate Installer & HTTPS Redirects [ssl-zen] Researcher Wordfence PRISM More Details > Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-89081 Patch Status Patched Published Sep 18, 2026 Affected Software Tutor LMS – eLearning and online course solution [tutor] Researcher Filip Kowalski (Agentunio) More Details > WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-11608 Patch Status Patched Published Sep 18, 2026 Affected Software WP Customer Reviews [wp-customer-reviews] Researcher Quang More Details > Import and export users and customers <= 2.4.4 - Authenticated (Administrator+) Server-Side Request Forgery 5.5 CVSS Rating 5.5 (Medium) CVE-ID CVE-2026-16542 Patch Status Patched Published Sep 18, 2026 Affected Software Import and export users and customers [import-users-from-csv-with-meta] Researcher Binesh Madharapu More Details > Import Export Lite <= 3.9.32 - Authenticated (Administrator+) Server-Side Request Forgery 5.5 CVSS Rating 5.5 (Medium) CVE-ID CVE-2026-76559 Patch Status Patched Published Sep 14, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher Yassin Mohamed More Details > WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass) 5.5 CVSS Rating 5.5 (Medium) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher Ben Bidner More Details > Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-14311 Patch Status Patched Published Sep 17, 2026 Affected Software Booking for Appointments and Events Calendar – Amelia [ameliabooking] Researcher Jonah Burgess (CryptoCat) More Details > Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-85657 Patch Status Patched Published Sep 14, 2026 Affected Software Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors [publishpress-authors] Researcher Athiwat Tiprasaharn (Jitlada) More Details > FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-15004 Patch Status Patched Published Sep 17, 2026 Affected Software FileBird – WordPress Media Library Folders & File Manager [filebird] Researcher TruongLV1 From FPT Night Wolf More Details > Newsletter <= 9.3.6 - Unauthenticated Open Redirect 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-86823 Patch Status Patched Published Sep 14, 2026 Affected Software Newsletter [newsletter-email-mailing-list] Researcher Artus KG More Details > WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-90884 Patch Status Patched Published Sep 17, 2026 Affected Software WP Recipe Maker [wp-recipe-maker] Researcher Saulo Rafael (miquinho) More Details > 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-15758 Patch Status Patched Published Sep 14, 2026 Affected Software 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery [interactive-3d-flipbook-powered-physics-engine] Researcher Suredsi Ulpada (cyberdesu) More Details > Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-11984 Patch Status Patched Published Sep 15, 2026 Affected Software Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] Researcher Evan More Details > All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-89064 Patch Status Patched Published Sep 16, 2026 Affected Software All-in-One WP Migration and Backup [all-in-one-wp-migration] Researcher Jakub Herman More Details > Appointment Hour Booking <= 1.5.94 - Unauthenticated Appointment Slot Capacity Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86475 Patch Status Patched Published Sep 14, 2026 Affected Software Appointment Hour Booking – Booking Calendar [appointment-hour-booking] Researcher Nicat Sultanov More Details > Autopay <= 5.0.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90923 Patch Status Patched Published Sep 15, 2026 Affected Software Autopay [platnosci-online-blue-media] Researcher Artus KG More Details > BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript <= 4.1.15 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-78528 Patch Status Patched Published Sep 16, 2026 Affected Software BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript [searchpro] Researcher z3r0s More Details > Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-89093 Patch Status Patched Published Sep 18, 2026 Affected Software Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] Researcher Jonah Burgess (CryptoCat) More Details > Booking Calendar <= 11.7 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-74002 Patch Status Patched Published Sep 16, 2026 Affected Software Booking Calendar [booking] Researcher Ananda Dhakal More Details > Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-16582 Patch Status Patched Published Sep 17, 2026 Affected Software Booking for Appointments and Events Calendar – Amelia [ameliabooking] Researcher ricky morty More Details > Bookly <= 28.1 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-91847 Patch Status Patched Published Sep 17, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher vuxvinh More Details > Botiga Pro <= 1.6.4 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86591 Patch Status Patched Published Sep 17, 2026 Affected Software Botiga Pro [botiga-pro] Researcher Erwan LR More Details > Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-4792 Patch Status Patched Published Sep 18, 2026 Affected Software Bread [bread] Researcher Itthidej Aramsri (Boeing777) More Details > Breeze Cache <= 2.5.14 - Unauthenticated Cache Poisoning 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-79713 Patch Status Patched Published Sep 16, 2026 Affected Software Breeze Cache [breeze] Researcher Amity Gilmour More Details > Clean Login <= 1.18 - Unauthenticated Account Registration 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90976 Patch Status Patched Published Sep 16, 2026 Affected Software Clean Login [clean-login] Researcher Artus KG More Details > Clean Login <= 1.18 - Unauthenticated CAPTCHA Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90977 Patch Status Patched Published Sep 16, 2026 Affected Software Clean Login [clean-login] Researcher Arthur Morgan More Details > Design Scuole Italia <= 2.17.3 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87792 Patch Status Unpatched Published Sep 15, 2026 Affected Software design-scuole-wordpress-theme [design-scuole-wordpress-theme] Researcher(s): Unknown More Details > Divi 5.0 - 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-91707 Patch Status Patched Published Sep 17, 2026 Affected Software Divi [Divi] Researcher Osvaldo Noe Gonzalez Del Rio (Os) More Details > Easy Appointments <= 4.0.2.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87965 Patch Status Patched Published Sep 16, 2026 Affected Software Easy Appointments [easy-appointments] Researcher Morato Antoine More Details > Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87966 Patch Status Patched Published Sep 16, 2026 Affected Software Easy Appointments [easy-appointments] Researcher blast More Details > Easy Form Builder 4.0.0 - 4.1.3 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-85123 Patch Status Patched Published Sep 16, 2026 Affected Software Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder] Researcher Artus KG More Details > Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.3.8 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-66676 Patch Status Patched Published Sep 16, 2026 Affected Software Easy Invoice – Invoice Generator, PDF Quotes & Payments [easy-invoice] Researcher Rahul Yadav More Details > EduAdmin Booking <= 5.4.2 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-62101 Patch Status Patched Published Sep 15, 2026 Affected Software EduAdmin Booking [eduadmin-booking] Researcher henise More Details > Event Booking Manager for WooCommerce <= 5.3.7 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-91008 Patch Status Patched Published Sep 15, 2026 Affected Software Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress] Researcher Usama Arshad More Details > Eventin <= 4.1.23 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-84907 Patch Status Patched Published Sep 14, 2026 Affected Software Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Karthik Ramakrishnan More Details > Eventin <= 4.1.23 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-77702 Patch Status Patched Published Sep 14, 2026 Affected Software Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Nir Yehoshua More Details > Eventin <= 4.1.23 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-84906 Patch Status Patched Published Sep 14, 2026 Affected Software Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher cyberkareem More Details > FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login <= 2.1.2 - Unauthenticated Email Verification Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-78296 Patch Status Patched Published Sep 17, 2026 Affected Software FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login [fluent-security] Researcher Ahmed Embaby More Details > Formidable Forms <= 6.34 - Unauthenticated Content Injection 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-85641 Patch Status Patched Published Sep 14, 2026 Affected Software Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] Researcher Karthik Ramakrishnan More Details > Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Login Protection Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86800 Patch Status Patched Published Sep 16, 2026 Affected Software Hide My WP Ghost – Security & Firewall [hide-my-wp] Researcher Animesh Gaurav More Details > Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Protection Mechanism Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86796 Patch Status Patched Published Sep 16, 2026 Affected Software Hide My WP Ghost – Security & Firewall [hide-my-wp] Researcher Kenny More Details > GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-89278 Patch Status Patched Published Sep 17, 2026 Affected Software GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI [gptranslate] Researcher Supakiad S. (m3ez) More Details > Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-1984 Patch Status Patched Published Sep 18, 2026 Affected Software Ibtana – Ecommerce Product Addons [ibtana-ecommerce-product-addons] Researcher Legion Hunter More Details > JWT Authentication for WP REST APIs <= 4.7.0 - Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-89027 Patch Status Patched Published Sep 14, 2026 Affected Software JWT Authentication for WP REST APIs [wp-rest-api-authentication] Researcher Choriyev Qahramon More Details > KBoard <= 6.6 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-88910 Patch Status Patched Published Sep 14, 2026 Affected Software kboard [kboard] Researcher seongjun joo More Details > King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.81 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-66575 Patch Status Patched Published Sep 17, 2026 Affected Software King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons] Researcher Sakri Koskimies More Details > LearnPress <= 4.4.6 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86445 Patch Status Patched Published Sep 14, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher Karthik Ramakrishnan More Details > LearnPress <= 4.4.6 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86447 Patch Status Patched Published Sep 14, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher vuxvinh More Details > LearnPress <= 4.4.6 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86449 Patch Status Patched Published Sep 14, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher Sai Praneeth Koti More Details > LearnPress <= 4.4.6 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86448 Patch Status Patched Published Sep 14, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher Artus KG More Details > LearnPress 4.4.3 - 4.4.6 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86446 Patch Status Patched Published Sep 15, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher Nicat Sultanov More Details > Mailchimp for WooCommerce <= 6.1.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92435 Patch Status Patched Published Sep 17, 2026 Affected Software Mailchimp for WooCommerce [mailchimp-for-woocommerce] Researchers Pablo GonzálezFrancisco José Ramírez More Details > Master Addons for Elementor <= 3.1.8 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-91015 Patch Status Patched Published Sep 15, 2026 Affected Software Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits [master-addons] Researcher JunHee CHO More Details > Meow Gallery <= 5.5.4 - Unauthenticated Arbitrary Shortcode Execution 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92422 Patch Status Patched Published Sep 18, 2026 Affected Software Meow Gallery [meow-gallery] Researcher JunHee CHO More Details > MgoSync 2.1.5 - 2.1.6 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92404 Patch Status Patched Published Sep 17, 2026 Affected Software MgoSync – European dropshipping and suppliers [megamo] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-16750 Patch Status Patched Published Sep 17, 2026 Affected Software Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings] Researchers Niv KochanMatan Bachar More Details > Motors <= 1.4.120 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-91016 Patch Status Patched Published Sep 15, 2026 Affected Software Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings] Researcher Pedro Pinho More Details > Newsletter <= 9.3.7 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86824 Patch Status Patched Published Sep 15, 2026 Affected Software Newsletter [newsletter-email-mailing-list] Researcher Karthik Ramakrishnan More Details > Ni WooCommerce Sales Report <= 4.1.0 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-78474 Patch Status Patched Published Sep 14, 2026 Affected Software Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard [ni-woocommerce-sales-report] Researcher Ryan Fabella More Details > Paid Member Subscriptions <= 3.0.8 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90922 Patch Status Patched Published Sep 15, 2026 Affected Software Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions] Researcher Charles Vosburgh More Details > Payment Gateway for PayPal on WooCommerce <= 9.2.0 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92400 Patch Status Patched Published Sep 17, 2026 Affected Software Payment Gateway for PayPal on WooCommerce [woo-paypal-gateway] Researcher Charles Vosburgh More Details > Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-9832 Patch Status Patched Published Sep 18, 2026 Affected Software Payment Gateway of Stripe for WooCommerce [payment-gateway-stripe-and-woocommerce-integration] Researcher pradeep suvarna More Details > Really Simple Security (Free) <= 9.8.2 - Unauthenticated Unbounded Option Growth 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-88798 Patch Status Patched Published Sep 16, 2026 Affected Software Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl] Researcher Naoki Kawahigashi More Details > Rede Itaú for WooCommerce <= 5.4.6 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92430 Patch Status Patched Published Sep 17, 2026 Affected Software Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit [woo-rede] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > RestroPress <= 3.4.5 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-85010 Patch Status Patched Published Sep 16, 2026 Affected Software RestroPress – Online Food Ordering System [restropress] Researcher Usama Arshad More Details > RestroPress <= 3.4.7 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-85009 Patch Status Unpatched Published Sep 16, 2026 Affected Software RestroPress – Online Food Ordering System [restropress] Researcher Usama Arshad More Details > Robokassa payment gateway for Woocommerce <= 1.8.8 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-91017 Patch Status Patched Published Sep 15, 2026 Affected Software Robokassa payment gateway for Woocommerce [robokassa] Researcher Pedro Pinho More Details > Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87891 Patch Status Patched Published Sep 14, 2026 Affected Software Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking] Researcher Pedro Pinho More Details > Rox Appointment Booking <= 1.2.7 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87896 Patch Status Patched Published Sep 14, 2026 Affected Software Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking] Researcher Pedro Pinho More Details > Rox Appointment Booking <= 1.2.7 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87907 Patch Status Patched Published Sep 14, 2026 Affected Software Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking] Researcher Farid Narimanov More Details > Schema & Structured Data for WP & AMP <= 1.65 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-82124 Patch Status Patched Published Sep 14, 2026 Affected Software Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] Researcher Revanth Hari Narayana Matte More Details > Schema & Structured Data for WP & AMP <= 1.65 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-82125 Patch Status Patched Published Sep 14, 2026 Affected Software Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] Researcher Revanth Hari Narayana Matte More Details > Secure Custom Fields <= 6.9.3 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92403 Patch Status Patched Published Sep 17, 2026 Affected Software Secure Custom Fields [secure-custom-fields] Researcher Charles Vosburgh More Details > Subscriptions for WooCommerce <= 2.0.2 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87854 Patch Status Patched Published Sep 14, 2026 Affected Software Subscriptions for WooCommerce [subscriptions-for-woocommerce] Researcher Karthik Ramakrishnan More Details > TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-18346 Patch Status Patched Published Sep 18, 2026 Affected Software TikTok [tiktok-for-business] Researcher Hillary Mutai More Details > TikTok 1.2.0 - 1.4.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92965 Patch Status Patched Published Sep 18, 2026 Affected Software TikTok [tiktok-for-business] Researcher RIA Labs More Details > To Do List Member <= 1.6 - Unauthenticated Content Injection 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86802 Patch Status Unpatched Published Sep 18, 2026 Affected Software To Do List Member [todo-lists-for-membership-sites] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Tripzzy <= 1.5.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87840 Patch Status Patched Published Sep 18, 2026 Affected Software Tripzzy – Travel Engine System [tripzzy] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Tripzzy <= 1.5.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87839 Patch Status Patched Published Sep 18, 2026 Affected Software Tripzzy – Travel Engine System [tripzzy] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > UpsellWP <= 2.2.9 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-85350 Patch Status Patched Published Sep 16, 2026 Affected Software UpsellWP – Upsell and Related Products Offers for WooCommerce [checkout-upsell-and-order-bumps] Researcher Pedro Pinho More Details > User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-74017 Patch Status Patched Published Sep 16, 2026 Affected Software User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration] Researcher asdqgggg More Details > WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-9289 Patch Status Patched Published Sep 18, 2026 Affected Software WordLift – AI powered SEO – Schema [wordlift] Researcher Benedictus Jovan (aillesiM) More Details > WPGraphQL Smart Cache <= 2.3.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92099 Patch Status Patched Published Sep 17, 2026 Affected Software WPGraphQL Smart Cache [wpgraphql-smart-cache] Researcher msfire More Details > Zonify – Amazon Product Importer for WooCommerce < 1.0.5 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87842 Patch Status Patched Published Sep 14, 2026 Affected Software Zonify – Amazon Product Importer for WooCommerce [zonify] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-75959 Patch Status Unpatched Published Sep 18, 2026 Affected Software GoPay for WooCommerce [gopay-gateway] Researcher Wordfence PRISM More Details > Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Read 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-76555 Patch Status Patched Published Sep 14, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher Hasyros More Details > Import Export Lite <= 3.9.32 - Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-76553 Patch Status Patched Published Sep 14, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher mak3bread More Details > Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-76557 Patch Status Patched Published Sep 14, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher mak3bread More Details > Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-76556 Patch Status Patched Published Sep 14, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher mak3bread More Details > Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-66630 Patch Status Patched Published Sep 17, 2026 Affected Software Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series] Researcher Ananda Dhakal More Details > MoreConvert Wishlist for WooCommerce <= 1.9.21 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-66631 Patch Status Patched Published Sep 17, 2026 Affected Software MoreConvert Wishlist for WooCommerce [smart-wishlist-for-more-convert] Researcher Ananda Dhakal More Details > Newsletters <= 4.18 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-66619 Patch Status Patched Published Sep 17, 2026 Affected Software Newsletters [newsletters-lite] Researcher Ananda Dhakal More Details > NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-75961 Patch Status Patched Published Sep 17, 2026 Affected Software NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder] Researcher Wordfence PRISM More Details > SKT Addons for Elementor <= 4.0 - Authenticated (Editor+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-66626 Patch Status Patched Published Sep 17, 2026 Affected Software SKT Addons for Elementor [skt-addons-for-elementor] Researcher Ananda Dhakal More Details > Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-16777 Patch Status Patched Published Sep 17, 2026 Affected Software Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers [woocommerce-exporter] Researcher Wordfence PRISM More Details > WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.1 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-66625 Patch Status Patched Published Sep 17, 2026 Affected Software WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors [wc-vendors] Researcher Ananda Dhakal More Details > WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.9 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-66618 Patch Status Patched Published Sep 17, 2026 Affected Software WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin] Researcher Ananda Dhakal More Details > WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-92465 Patch Status Unpatched Published Sep 16, 2026 Affected Software WP Mega Menu [wp-megamenu] Researcher Ananda Dhakal More Details > WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-6295 Patch Status Patched Published Sep 18, 2026 Affected Software WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals [wp-optimizer] Researcher san6051 More Details > WP-Lister Lite for eBay <= 3.8.11 - Authenticated (Shop Manager+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-66628 Patch Status Patched Published Sep 17, 2026 Affected Software WP-Lister Lite for eBay [wp-lister-for-ebay] Researcher Ananda Dhakal More Details > WPMasterToolKit (WPMTK) – All in one plugin <= 2.22.0 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-66624 Patch Status Patched Published Sep 17, 2026 Affected Software WPMasterToolKit (WPMTK) – All in one plugin [wpmastertoolkit] Researcher Ananda Dhakal More Details > All-in-One WP Migration and Backup <= 7.110 - Authenticated (Admin+) Privilege Escalation 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-81810 Patch Status Patched Published Sep 16, 2026 Affected Software All-in-One WP Migration and Backup [all-in-one-wp-migration] Researcher Charles Vosburgh More Details > Design Scuole Italia <= 2.17.3 - Open Redirect 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-89307 Patch Status Unpatched Published Sep 15, 2026 Affected Software design-scuole-wordpress-theme [design-scuole-wordpress-theme] Researcher(s): Unknown More Details > Import Export Lite <= 3.9.34 - Authenticated (Admin+) Privilege Escalation 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-76554 Patch Status Patched Published Sep 17, 2026 Affected Software WP Import Export Lite [wp-import-export-lite] Researcher mak3bread More Details > LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-76579 Patch Status Patched Published Sep 18, 2026 Affected Software LiteSpeed Cache [litespeed-cache] Researcher mak3bread More Details > WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-7527 Patch Status Patched Published Sep 18, 2026 Affected Software Hide My WP Ghost – Security & Firewall [hide-my-wp] Researcher s00me00ne More Details > Business Name Generator <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2025-15698 Patch Status Unpatched Published Sep 17, 2026 Affected Software Business Name Generator [designbro-business-name-generator] Researcher Nikhil Gavhane More Details > CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2025-13533 Patch Status Patched Published Sep 17, 2026 Affected Software CSS & JavaScript Toolbox [css-javascript-toolbox] Researcher Kyokito More Details > OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-12402 Patch Status Patched Published Sep 18, 2026 Affected Software OTP Login & Register Woocommerce [mobile-login-woocommerce] Researcher Luca Jungnickel More Details > WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data 4.4 CVSS Rating 4.4 (Medium) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher Jeremy Felt More Details > WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-12042 Patch Status Patched Published Sep 18, 2026 Affected Software WP2Social Auto Publish [facebook-auto-publish] Researcher Luca Jungnickel More Details > Active Products Tables for WooCommerce <= 2.1.2 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-91009 Patch Status Patched Published Sep 15, 2026 Affected Software Active Woot Products Tables for WooCommerce. 100% FREE  [profit-products-tables-for-woocommerce] Researcher JunHee CHO More Details > Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-66571 Patch Status Patched Published Sep 17, 2026 Affected Software Asset CleanUp: Page Speed Booster [wp-asset-clean-up] Researcher Helder Gonçalves More Details > AVideo <= 29.0 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-92579 Patch Status Unpatched Published Sep 16, 2026 Affected Software aVideo [avideo] Researcher rajivraj More Details > BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-1242 Patch Status Unpatched Published Sep 18, 2026 Affected Software BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for News, Magazine & Blogs [blockspare] Researcher Osvaldo Noe Gonzalez Del Rio (Os) More Details > Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Authenticated (Subscriber+) Username Enumeration 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89029 Patch Status Patched Published Sep 16, 2026 Affected Software Blog2Social: Social Media Auto Post & Scheduler [blog2social] Researcher Choriyev Qahramon More Details > Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89031 Patch Status Patched Published Sep 16, 2026 Affected Software Blog2Social: Social Media Auto Post & Scheduler [blog2social] Researcher Choriyev Qahramon More Details > Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89030 Patch Status Patched Published Sep 16, 2026 Affected Software Blog2Social: Social Media Auto Post & Scheduler [blog2social] Researcher Choriyev Qahramon More Details > Bookit <= 2.6.0.4 - Authenticated (Bookit Staff+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89008 Patch Status Patched Published Sep 16, 2026 Affected Software Bookit — Booking & Appointment Calendar [bookit] Researcher Farid Narimanov More Details > Bookit <= 2.6.0.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89007 Patch Status Patched Published Sep 16, 2026 Affected Software Bookit — Booking & Appointment Calendar [bookit] Researcher Hieus More Details > Checkout Field Manager <= 7.9.6 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-87829 Patch Status Patched Published Sep 17, 2026 Affected Software Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] Researchers PO-WEI TINGOpen Information Security Inc More Details > Checkout Field Manager <= 7.9.6 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-87831 Patch Status Patched Published Sep 17, 2026 Affected Software Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] Researcher Md. Moniruzzaman Prodhan More Details > Comments Import & Export 2.1.11 - 2.5.3 - Authenticated (Author+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-87836 Patch Status Patched Published Sep 15, 2026 Affected Software Comments Import & Export [comments-import-export-woocommerce] Researcher a0yark More Details > Cooked – Recipe Management <= 1.16.0 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-73999 Patch Status Patched Published Sep 16, 2026 Affected Software Cooked – Recipe Management [cooked] Researcher Nixxies More Details > Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping) 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-9613 Patch Status Patched Published Sep 18, 2026 Affected Software Datalogics Ecommerce Delivery – Datalogics [datalogics] Researcher Benedictus Jovan (aillesiM) More Details > Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-9766 Patch Status Patched Published Sep 18, 2026 Affected Software Empik for Woocommerce [empik-for-woocommerce] Researcher Benedictus Jovan (aillesiM) More Details > Event Booking Manager for WooCommerce <= 5.5.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-91019 Patch Status Patched Published Sep 15, 2026 Affected Software Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress] Researcher Artus KG More Details > Eventin <= 4.1.23 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-84905 Patch Status Patched Published Sep 14, 2026 Affected Software Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution] Researcher Karthik Ramakrishnan More Details > Export & Import WPBakery Page Builder <= 1.0.2 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-81429 Patch Status Unpatched Published Sep 14, 2026 Affected Software Export & Import WPBakery Page Builder [vc-templates-import-export] Researcher Suhayb Ahmed More Details > Filter Gallery <= 1.1.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-90978 Patch Status Patched Published Sep 16, 2026 Affected Software Filter Gallery [filter-gallery] Researcher Seongwon Lee More Details > Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89138 Patch Status Patched Published Sep 17, 2026 Affected Software Filter Gallery [filter-gallery] Researcher Supakiad S. (m3ez) More Details > Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-9615 Patch Status Patched Published Sep 18, 2026 Affected Software Flex Import [flex-import] Researcher Benedictus Jovan (aillesiM) More Details > FluentBoards <= 2.0.14 - Authenticated (Board Member+) Comment Author Spoofing 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89327 Patch Status Patched Published Sep 14, 2026 Affected Software FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards] Researcher vuxvinh More Details > FluentBoards <= 2.0.14 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-85349 Patch Status Patched Published Sep 14, 2026 Affected Software FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards] Researcher Usama Arshad More Details > FluentBoards <= 2.0.14 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89328 Patch Status Patched Published Sep 14, 2026 Affected Software FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards] Researcher vuxvinh More Details > Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-18317 Patch Status Patched Published Sep 17, 2026 Affected Software Foxtool All-in-One: Contact chat button, Custom login, Media optimize images [foxtool] Researcher Wordfence PRISM More Details > Hydra Booking <= 1.2.1 - Authenticated (Hydra Host+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-92420 Patch Status Patched Published Sep 17, 2026 Affected Software Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking] Researcher Muni Nitish Kumar Yaddala More Details > Hydra Booking <= 1.2.2 - Authenticated (Hydra Host+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-92421 Patch Status Patched Published Sep 17, 2026 Affected Software Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking] Researcher Ossacip Thanh More Details > Hydra Booking <= 1.2.3 - Authenticated (Hydra Host+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-92425 Patch Status Patched Published Sep 17, 2026 Affected Software Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking] Researcher Stefan Spasic More Details > Invisible Anti-Spam & CAPTCHA <= 5.1.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-91010 Patch Status Patched Published Sep 15, 2026 Affected Software Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms [gdpr-compliant-recaptcha-for-all-forms] Researcher JunHee CHO More Details > Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-74005 Patch Status Patched Published Sep 16, 2026 Affected Software Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series] Researcher benzdeus More Details > King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-84903 Patch Status Patched Published Sep 16, 2026 Affected Software King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons] Researcher Revanth Hari Narayana Matte More Details > King Addons for Elementor 51.1.56 - 51.1.80 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-84904 Patch Status Patched Published Sep 16, 2026 Affected Software King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons] Researcher Artus KG More Details > LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-18441 Patch Status Patched Published Sep 17, 2026 Affected Software Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] Researcher Sorra More Details > LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-13471 Patch Status Patched Published Sep 17, 2026 Affected Software Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] Researchers skyv3ilChirita Catalin-Andrei (CC99IE)AmonRaMrProperCTF More Details > Magazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-75017 Patch Status Patched Published Sep 17, 2026 Affected Software Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid [magazine-blocks] Researcher Wordfence PRISM More Details > MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-88844 Patch Status Patched Published Sep 16, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher Karthik Ramakrishnan More Details > MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-81340 Patch Status Patched Published Sep 16, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher Shivamani Vastrala More Details > Meow Gallery <= 5.5.4 - Authenticated (Author+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-92423 Patch Status Patched Published Sep 18, 2026 Affected Software Meow Gallery [meow-gallery] Researcher Kaan Özbek More Details > MultiVendorX <= 5.0.15 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-74926 Patch Status Patched Published Sep 14, 2026 Affected Software MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor] Researcher Farid Narimanov More Details > NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-81654 Patch Status Patched Published Sep 18, 2026 Affected Software Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] Researcher Erwan LR More Details > NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-81652 Patch Status Patched Published Sep 18, 2026 Affected Software Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] Researcher Meher Sudhakar Abbireddi More Details > Nimble Builder <= 3.3.8 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-16557 Patch Status Unpatched Published Sep 16, 2026 Affected Software Nimble Page Builder [nimble-builder] Researcher Ayush Gangwar More Details > Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-9858 Patch Status Patched Published Sep 18, 2026 Affected Software Partial Shipment for WooCommerce [wc-partial-shipment] Researcher Muhan Luo More Details > PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-11899 Patch Status Patched Published Sep 18, 2026 Affected Software PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder] Researcher Jaskaranjeet Singh More Details > Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.1 - Missing Authorization to 2FA Bypass 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-82519 Patch Status Patched Published Sep 14, 2026 Affected Software Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl] Researcher Michael Holmquist More Details > Schema & Structured Data for WP & AMP <= 1.65 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-82126 Patch Status Patched Published Sep 14, 2026 Affected Software Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] Researcher Shirshak More Details > Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-15947 Patch Status Patched Published Sep 18, 2026 Affected Software Search Atlas SEO – OTTO AI SEO Automation for WordPress [metasync] Researcher Wordfence PRISM More Details > Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-15946 Patch Status Patched Published Sep 18, 2026 Affected Software Search Atlas SEO – OTTO AI SEO Automation for WordPress [metasync] Researcher Wordfence PRISM More Details > SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback() 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-15660 Patch Status Patched Published Sep 18, 2026 Affected Software SEO Booster [seo-booster] Researcher Wordfence PRISM More Details > Seraphinite Accelerator <= 2.29.23 - Authenticated (Subscriber+) Full Admin Area Denial of Service 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-87828 Patch Status Patched Published Sep 14, 2026 Affected Software Seraphinite Accelerator [seraphinite-accelerator] Researcher Ángel PS More Details > Sign-up Sheets <= 2.3.0 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-92410 Patch Status Patched Published Sep 18, 2026 Affected Software Sign-up Sheets [sign-up-sheets] Researcher JunHee CHO More Details > Simple Membership <= 4.8.2 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-74000 Patch Status Patched Published Sep 16, 2026 Affected Software Simple Membership [simple-membership] Researcher Ananda Dhakal More Details > Subscriptions for WooCommerce <= 2.0.2 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-87860 Patch Status Patched Published Sep 14, 2026 Affected Software Subscriptions for WooCommerce [subscriptions-for-woocommerce] Researcher Karthik Ramakrishnan More Details > Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-85572 Patch Status Patched Published Sep 14, 2026 Affected Software Tutor LMS – eLearning and online course solution [tutor] Researcher Shirshak More Details > Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-88944 Patch Status Patched Published Sep 18, 2026 Affected Software Tutor LMS – eLearning and online course solution [tutor] Researcher EUNHO KIM More Details > Tutor LMS 2.7.1 - 4.0.7 - REST API Authentication Confusion 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-85569 Patch Status Patched Published Sep 14, 2026 Affected Software Tutor LMS – eLearning and online course solution [tutor] Researcher Charles Vosburgh More Details > Unbounce Landing Pages <= 1.1.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-85574 Patch Status Patched Published Sep 17, 2026 Affected Software Unbounce Landing Pages [unbounce] Researcher Furkan Arslan More Details > VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-2278 Patch Status Patched Published Sep 18, 2026 Affected Software VW Writer Blog [vw-writer-blog] Researcher Legion Hunter More Details > WordPress Core <= 7.1 - Authenticated (Author+) Information Exposure via attachment_submitbox_metadata() 4.3 CVSS Rating 4.3 (Medium) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher HDWSec More Details > WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API 4.3 CVSS Rating 4.3 (Medium) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher viridis More Details > WordPress Core <= 7.1 - Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions 4.3 CVSS Rating 4.3 (Medium) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher hermanhms More Details > WordPress Core <= 7.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite 4.3 CVSS Rating 4.3 (Medium) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher Anthropic More Details > WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller 4.3 CVSS Rating 4.3 (Medium) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher Anthropic More Details > WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route 4.3 CVSS Rating 4.3 (Medium) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher Paulos Yibelo More Details > WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-12739 Patch Status Patched Published Sep 17, 2026 Affected Software WP Easy Pay – Payment and Donation Form Builder for Square [wp-easy-pay] Researcher Wordfence PRISM More Details > WPBot 8.7.2 - 8.7.5 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-87959 Patch Status Patched Published Sep 14, 2026 Affected Software WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services [chatbot] Researcher Sergey Mkrtchyan More Details > WPLP Cookie Consent <= 4.4.3 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-85131 Patch Status Patched Published Sep 14, 2026 Affected Software WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent] Researcher Karthik Ramakrishnan More Details > Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility <= 7.1.0.43 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-78295 Patch Status Patched Published Sep 16, 2026 Affected Software Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility [xagio-seo] Researcher Matheo Beuve More Details > WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break 3.7 CVSS Rating 3.7 (Low) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher Jeremy Felt More Details > NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference 2.7 CVSS Rating 2.7 (Low) CVE-ID CVE-2026-81653 Patch Status Patched Published Sep 18, 2026 Affected Software Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] Researcher Erwan LR More Details > NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference 2.7 CVSS Rating 2.7 (Low) CVE-ID CVE-2026-81651 Patch Status Patched Published Sep 18, 2026 Affected Software Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] Researcher Murad Akhmedov More Details > WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite) 2.7 CVSS Rating 2.7 (Low) Patch Status Patched Published Sep 17, 2026 Affected Software WordPress [wordpress] Researcher Jesse McNeil More Details > As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence. This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can. Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026) appeared first on Wordfence.