Last week, there were 319 vulnerabilities disclosed in 222 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 156 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back. Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free. Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. New Firewall Rules Deployed Last Week The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection. The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week: WAF-RULE-959 – Data redacted while we work with the vendor on a patch. WAF-RULE-960 – Data redacted while we work with the vendor on a patch. WAF-RULE-961 – Data redacted while we work with the vendor on a patch. WordPress Core <= 7.1.1 – Unauthenticated Local File Inclusion via locate_template() Path Traversal Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay. Total Unpatched & Patched Vulnerabilities Last Week Patch Status Number of Vulnerabilities Patched 305 Unpatched 14 Total Vulnerabilities by CVSS Severity Last Week Severity Rating Number of Vulnerabilities Medium Severity 226 High Severity 79 Critical Severity 14 Total Vulnerabilities by CWE Type Last Week Vulnerability Type by CWE Number of Vulnerabilities Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 96 Missing Authorization 59 Authorization Bypass Through User-Controlled Key 26 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 24 Exposure of Sensitive Information to an Unauthorized Actor 22 Improper Privilege Management 14 Deserialization of Untrusted Data 11 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 11 Improper Control of Generation of Code ('Code Injection') 8 Client-Side Enforcement of Server-Side Security 7 Server-Side Request Forgery (SSRF) 7 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 5 Incorrect Authorization 5 Cross-Site Request Forgery (CSRF) 4 Improper Authentication 4 Improper Authorization 3 Protection Mechanism Failure 3 Uncontrolled Resource Consumption 3 Guessable CAPTCHA 2 Unrestricted Upload of File with Dangerous Type 2 Improper Input Validation 1 Incorrect Privilege Assignment 1 Origin Validation Error 1 Researchers That Contributed to WordPress Security Last Week Researcher Name Number of Vulnerabilities Ananda Dhakal 34 Karthik Ramakrishnan 11 Intrudify 11 vuxvinh 8 Jakub Herman 8 Artus KG 8 Wordfence PRISM 8 nh4tvd 8 h0xilo 7 Dmitrii Ignatyev 6 Erwan LR 6 daroo 6 Usama Arshad 5 Raphael P. Cigana 5 Supakiad S. (m3ez) 5 Revanth Hari Narayana Matte 4 Asim Alshaya 4 Charles Vosburgh 4 Farid Narimanov 4 Doniyor Sotiboldiyev 4 Dthangws 4 Adrien Brunner 3 JunHee CHO 3 Jonah Burgess (CryptoCat) 3 Ivaylo 3 Phat RiO 3 Pablo González Pérez 3 Francisco José Ramírez Vicente 3 Iñigo Sánchez Enciso 3 Mor Golan 2 Tarcísio Luchesi De Almeida Silva (Poystick) 2 Athiwat Tiprasaharn (Jitlada) 2 Itthidej Aramsri (Boeing777) 2 crow 2 Abdullah Kareem 2 Mutantgun 2 Philipp Doblhofer 2 lhking 2 Pham Duc Anh 2 Naoki Kawahigashi 2 Naiches 2 neurotx 2 Tonn 2 Muni Nitish Kumar Yaddala 2 Quốc Huy (jtwings) 2 nthng 2 Yaswanth Reddy Sunkara 2 Que Thanh Tuan 2 Arman Kumar 2 Oly Hossen 1 Nixxies 1 Nguyen Ngoc Duc (duc193) 1 UKO 1 Isuka sanuj 1 Voyag3r-Security 1 Trương Hữu Phúc 1 satokan 1 Eyüphan Şahin 1 pb>sec 1 Austin Ginder 1 Nguyen Nhat Long 1 Như Nguyễn 1 Hanif Naufal Rahman 1 Luke Eldridge 1 Salúa Es-sair 1 spectreDeveloper 1 Alex Spataru 1 Thatchapol Booranatanit (AliceZz) 1 Abdelrhman Allam 1 achmad sonif 1 Venkateswara Reddy Challa 1 pervinzahidli 1 Paul Serban 1 t4g0 1 gueco 1 Asaf Mozes 1 Coopernicus 1 Vaibhav Narkhede 1 Mike Gozdiskowski 1 Lê Gia Khôi (KLg) 1 Rafie Muhammad 1 Khoa Dang 1 Tin Pham (TF1T) 1 Trong Pham (dtro) 1 Hao Ngo 1 FeelSoClean 1 RIA Labs 1 Ihsan Saddan 1 rpgsec 1 Sai Praneeth Koti 1 ParkHyunWoo 1 khanhnv 1 Hasyros 1 benzdeus 1 Nabil Irawan 1 刀 妖 1 sequence_X0 1 foehn 1 Huseyin Mertoglu 1 Nakul Chodha 1 Anand Sharma (andy) 1 Robert Ressl 1 Choriyev Qahramon 1 0xQRx 1 Yu Liu 1 Bee 1 Brobicho 1 Dion Mulaj 1 Saggre 1 K. Sorrachat 1 Hippolyte Quere 1 Murad Islamzada 1 mamgad 1 Ryan Fabella 1 Deva Parekh 1 Shirshak Roy 1 anhcd05 1 Pedro Pinho 1 Matheo Beuve 1 Legion Hunter 1 Google Threat Intelligence Group 1 LevinityCyber 1 sermsak 1 Jashid Sany 1 Bhaveshkumar Parmar 1 Muhammad Yudha - DJ 1 Bruno Alvarenga 1 Shivamani Vastrala 1 HumbertoSP 1 dcs 1 Yuto Hyakumoto 1 Mohammed Abd Alrahman 1 Vũ Quang Huy 1 m1w34p0n 1 Krypt3d 1 Hippolyte Quéré (Hippie) (Hippie) 1 Averon Averenkov (Averon Averenkov) 1 Aydan Arabadzha 1 sungbyeongchan 1 Jaime F. Murillo 1 Tarcísio Luchesi 1 Theklis 1 Supakiad S. 1 kuzomo 1 Mohamed Bassia 1 jtb75 1 nobody 1 Kaveesha Nirmal 1 dodoh4t 1 João Ramos Maciel 1 moonge 1 se1en 1 Jiemook 1 Teerachai Somprasong 1 thevietronin 1 Marc-André Beaulieu 1 Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report. WordPress Plugins with Reported Vulnerabilities Last Week Software Name Software Slug 10Web Booster – Website speed optimization, Cache & Page Speed optimizer tenweb-speed-optimizer Ad Inserter – Ad Manager & AdSense Ads ad-inserter Admin Notices Manager admin-notices-manager Advanced Contact form 7 DB advanced-cf7-db AI Engine – The Chatbot, AI Framework & MCP for WordPress ai-engine All-In-One Security (AIOS) – Security and Firewall all-in-one-wp-security-and-firewall AMP for WP – Accelerated Mobile Pages accelerated-mobile-pages AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) appmysite Appointment Booking Plugin & Scheduling System – Webba Booking Calendar webba-booking-lite Asset CleanUp: Page Speed Booster wp-asset-clean-up Automatic.css automatic-css Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code automation-web-platform BA Book Everything ba-book-everything Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots bp-better-messages Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification wc-blacklist-manager Blocksy Companion blocksy-companion Blog2Social: Social Media Auto Post & Scheduler blog2social Bluff Post bluff-post BM Content Builder bm-builder Booking Calendar booking Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar booking-manager Business Directory Plugin – Easy Listing & Member Directories for WordPress business-directory-plugin Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More calculated-fields-form Captcha Code captcha-code-authentication CartFlows – Funnel Builder & Checkout Plugin for WooCommerce cartflows CMB2 cmb2 CMP – Coming Soon & Maintenance Plugin by NiteoThemes cmp-coming-soon-maintenance Conekta Payment Gateway conekta-payment-gateway Contextual Related Posts contextual-related-posts Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster CSS & JavaScript Toolbox css-javascript-toolbox Custom Field Template custom-field-template Custom Thank You Page for WooCommerce custom-thank-you-page Customer Reviews for WooCommerce customer-reviews-woocommerce Directorist: AI-Powered Business Directory, Listings & Classified Ads directorist Ditty – Responsive News Tickers, Sliders, and Lists ditty-news-ticker Divi Dash divi-dash Download Manager downloadmanager Easy Digital Downloads – eCommerce Payments and Subscriptions made easy easy-digital-downloads Easy Hide Login easy-hide-login eesy_ID2WP – Publish InDesign HTML5 eesy-id2wp-publish-indesign-html5 Elementor Website Builder – more than just a page builder elementor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor elementskit-lite Email Log email-log Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress email-subscribers EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents embedpress ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce erp Estatik Real Estate Plugin estatik EthPress – Web3 Login ethpress Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar mage-eventpress Event Tickets and Registration event-tickets Events Manager – Calendar, Bookings, Tickets, Appointments and more! events-manager Fancy Product Designer fancy-product-designer File Manager wp-file-manager File Manager Pro – Filester filester FileOrganizer – WordPress File Manager fileorganizer Fluent Support – Helpdesk & Customer Support Ticket System fluent-support FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration fluent-boards Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI gamipress GEO Plugin by Squirrly SEO squirrly-seo GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory Give Tributes give-tributes GiveWP – Donation Plugin and Fundraising Platform give Go Live Update Urls go-live-update-urls Groups – Memberships and Access Control groups Gutenverse – WordPress Blocks, Page Builder & Site Editor gutenverse Handily handily HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates happy-elementor-addons Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms happyforms HashBar – Announcement, Notification Bar & Popup Campaign hashbar-wp-notification-bar Hostel hostel HT Contact Form – Drag & Drop Form Builder for WordPress ht-contactform HUSKY – Products Filter for WooCommerce Professional woocommerce-products-filter Image Buzz image-buzz Import and export users and customers import-users-from-csv-with-meta JetEngine jet-engine JetFormBuilder Stripe Gateway jet-form-builder-stripe-gateway JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder JetTricks jet-tricks JSM Show Post Metadata jsm-show-post-meta Kadence WooCommerce Email Designer kadence-woocommerce-email-designer King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder king-addons Kirki – Freeform Page Builder, Website Builder & Customizer kirki Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more knit-pay LayerSlider LayerSlider Link Library link-library Live Composer – Free WordPress Website Builder live-composer-page-builder Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator live-copy-paste Mailchimp for WooCommerce mailchimp-for-woocommerce MailerLite – Signup forms (official) official-mailerlite-sign-up-forms Malcure Malware Shield — Removal, Repair, Monitor wp-malware-removal Mang Board mangboard MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution marketking-multivendor-marketplace-for-woocommerce Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP ai-workflow-automation-ai-agent-hub Meta Box AIO meta-box-aio Meta Box Frontend Submission mb-frontend-submission Meta Box User Profile mb-user-profile miniOrange OTP Login, Verification and SMS Notifications miniorange-otp-verification Modula Image Gallery – Photo Grid & Video Gallery modula-best-grid-gallery Mollie Forms mollie-forms Netgsm netgsm Newsletters newsletters-lite NextScripts: Social Networks Auto-Poster social-networks-auto-poster-facebook-twitter-g Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder ninja-forms Ninja Tables – Easy Data Table Builder ninja-tables NP Quote Request for WooCommerce woo-rfq-for-woocommerce Ocean Extra ocean-extra Online Booking & Scheduling Calendar by vcita meeting-scheduler-by-vcita Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin desktop-mode Optima Express IDX optima-express Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management wp-payment-form Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce Paymob for WooCommerce paymob-for-woocommerce PayPlus Payment Gateway payplus-payment-gateway Paytium: Mollie payment forms & donations paytium Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery nextgen-gallery Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing woocommerce-google-adwords-conversion-tracking-tag PixelPlay pixelplay PixelYourSite – Your smart PIXEL (TAG) & API Manager pixelyoursite Podcast Importer SecondLine podcast-importer-secondline Points and Rewards for WooCommerce points-and-rewards-for-woocommerce Post Grid Gutenberg Blocks – PostX ultimate-post Post Voting System post-voting-system PowerPress Podcasting plugin by Blubrry powerpress Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates premium-addons-for-elementor Premium Blocks – Gutenberg Blocks, Patterns & Templates premium-blocks-for-gutenberg Premium Packages – Sell Digital Products Securely wpdm-premium-packages Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster easy-sale-badges-for-woocommerce Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels webappick-product-feed-for-woocommerce Product Filter for WooCommerce by WBW woo-product-filter Product Table & List Builder for WooCommerce wc-product-table-lite PublishPress Capabilities: User Role Access Control, Admin Area Permissions capability-manager-enhanced Razorpay Payment Button Plugin razorpay-payment-button Real3D Flipbook real3d-flipbook Rename wp-login.php to anything you want rename-wp-loginphp-to-anything-you-want Repeater Fields for Elementor Forms repeater-for-elementor Request a Quote for WooCommerce woocommerce-request-a-quote Restaurant Menu and Food Ordering mp-restaurant-menu Reycob Product Import Export reycob-product-import-export RW Elephant Rental Inventory rw-elephant-rental-inventory s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions s2member Safe SVG safe-svg Shopping Cart & eCommerce Store wp-easycart ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel-image-optimiser Simple Discount Rules for Woocommerce woo-product-category-discount Simply Schedule Appointments simply-schedule-appointments Site Reviews site-reviews SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP siteskite Spectra Legacy – Gutenberg Blocks ultimate-addons-for-gutenberg Sprout Invoices – Client Invoicing & Estimates sprout-invoices SPS-Suite sps-suite-121 SSL Zen — SSL Certificate Installer & HTTPS Redirects ssl-zen Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form wp-subscribe-form SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments surecart Tainacan tainacan Tangible: Loops & Logic tangible-loops-and-logic Team Members tc-team-members Team – Team Members Showcase Plugin tlp-team Template Kit – Import template-kit-import Testimonials Widget testimonials-widget Text Styler text-styler The Events Calendar the-events-calendar The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates the-plus-addons-for-elementor-page-builder The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid the-post-grid ThemeREX Addons trx_addons Themify Builder themify-builder ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More image-sizes Translate WordPress with GTranslate gtranslate TranslatePress – Translate Multilingual sites with AI Translation translatepress-multilingual TrustedLogin Connector trustedlogin-connector Tutor LMS – eLearning and online course solution tutor Ultimate FAQ Accordion Plugin ultimate-faqs Ultimeter – the Ultimate Progress and Goals Meter ultimeter Ultra Addons for Contact Form 7 ultimate-addons-for-contact-form-7 UpdraftPlus: WP Backup & Migration Plugin updraftplus User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission wp-user-frontend User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor profile-builder Verge3D Publishing and E-Commerce verge3d Visual Composer Website Builder visualcomposer W4 Post List w4-post-list WC Fields Factory wc-fields-factory WebFacing – Email Accounts management for cPanel® wf-cpanel-email-accounts WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards wp-data-access WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) delicious-recipes WP Directory Kit wpdirectorykit WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings wp-google-map-plugin WP Multilang – Translation and Multilingual Plugin wp-multilang WP OAuth Server ( Login with WordPress ) miniorange-oauth-20-server WP Photo Album Plus wp-photo-album-plus WP Recipe Maker wp-recipe-maker WP Review Slider Pro wp-review-slider-pro WP Statistics – Simple, privacy-friendly Google Analytics alternative wp-statistics WP Store Locator wp-store-locator WP Table Builder – Drag & Drop Table Builder wp-table-builder WP Travel Engine – Tour Booking Plugin – Tour Operator Software wp-travel-engine WP Ultimate Review wp-ultimate-review WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory wp-user-manager WP Verify API wp-verify-api WP Yelp Review Slider wp-yelp-review-slider WP YouTube Lyte wp-youtube-lyte WP-CRM System – Manage Clients and Projects wp-crm-system WPC Product Bundles for WooCommerce woo-product-bundle WPC Smart Compare for WooCommerce woo-smart-compare WPeMatico RSS Feed Fetcher wpematico WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More wpforms-lite wpForo Forum wpforo WPS Limit Login wps-limit-login WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent wsp-mcp-ai-agents-connector YAHMAN Add-ons yahman-add-ons YITH Request a Quote for WooCommerce yith-woocommerce-request-a-quote YITH WooCommerce Ajax Search yith-woocommerce-ajax-search YOP Poll yop-poll Zero Spam for WordPress zero-spam Zportals zportals پارسی دیت – Parsi Date wp-parsidate Vulnerability Details Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize. Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-14281 Patch Status Patched Published Sep 24, 2026 Affected Software Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code [automation-web-platform] Researcher Jiemook More Details > Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-19658 Patch Status Patched Published Sep 21, 2026 Affected Software Give Tributes [give-tributes] Researcher Voyag3r-Security More Details > Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-13355 Patch Status Patched Published Sep 21, 2026 Affected Software Meta Box User Profile [mb-user-profile] Researcher h0xilo More Details > Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-13355 Patch Status Patched Published Sep 21, 2026 Affected Software Meta Box AIO [meta-box-aio] Researcher h0xilo More Details > Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-13355 Patch Status Patched Published Sep 21, 2026 Affected Software Meta Box Frontend Submission [mb-frontend-submission] Researcher h0xilo More Details > Meta Box AIO <= 3.7.2 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-13355 Patch Status Patched Published Sep 21, 2026 Affected Software Meta Box AIO [meta-box-aio]Meta Box Frontend Submission [mb-frontend-submission]Meta Box User Profile [mb-user-profile] Researcher h0xilo More Details > miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-85984 Patch Status Patched Published Sep 26, 2026 Affected Software miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification] Researcher Supakiad S. (m3ez) More Details > Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-18467 Patch Status Patched Published Sep 23, 2026 Affected Software Paytium: Mollie payment forms & donations [paytium] Researcher Aydan Arabadzha More Details > Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-18143 Patch Status Unpatched Published Sep 25, 2026 Affected Software Request a Quote for WooCommerce [woocommerce-request-a-quote] Researcher t4g0 More Details > Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-82901 Patch Status Patched Published Sep 26, 2026 Affected Software Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] Researcher Supakiad S. (m3ez) More Details > Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-12227 Patch Status Patched Published Sep 23, 2026 Affected Software Visual Composer Website Builder [visualcomposer] Researchers Tin Pham (TF1T)Trong Pham (dtro)Hao Ngo More Details > YAHMAN Add-ons <= 0.9.30 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-75799 Patch Status Patched Published Sep 21, 2026 Affected Software YAHMAN Add-ons [yahman-add-ons] Researcher Artus KG More Details > Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-89055 Patch Status Patched Published Sep 24, 2026 Affected Software Customer Reviews for WooCommerce [customer-reviews-woocommerce] Researcher HumbertoSP More Details > Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-93399 Patch Status Patched Published Sep 24, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher Theklis More Details > BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2025-1281 Patch Status Patched Published Sep 21, 2026 Affected Software BM Content Builder [bm-builder] Researcher Tonn More Details > CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.2.0 - Authenticated (Contributor+) Remote Code Execution 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-96837 Patch Status Patched Published Sep 24, 2026 Affected Software CartFlows – Funnel Builder & Checkout Plugin for WooCommerce [cartflows] Researcher Hippolyte Quere More Details > Elementor Website Builder 4.3.0 - 4.3.1 - Cross-Site Request Forgery via REST Nonce Bypass to Privilege Escalation 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-62062 Patch Status Patched Published Sep 25, 2026 Affected Software Elementor Website Builder – more than just a page builder [elementor] Researchers SaggreWordfence PRISM More Details > Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-77203 Patch Status Patched Published Sep 26, 2026 Affected Software Groups – Memberships and Access Control [groups] Researcher daroo More Details > Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-86583 Patch Status Patched Published Sep 23, 2026 Affected Software Import and export users and customers [import-users-from-csv-with-meta] Researcher khanhnv More Details > Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-89426 Patch Status Patched Published Sep 24, 2026 Affected Software Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more [knit-pay] Researcher moonge More Details > OAuth Server <= 6.3.0 - Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-82843 Patch Status Patched Published Sep 21, 2026 Affected Software WP OAuth Server ( Login with WordPress ) [miniorange-oauth-20-server] Researcher vuxvinh More Details > s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-19804 Patch Status Patched Published Sep 24, 2026 Affected Software s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions [s2member] Researcher Supakiad S. (m3ez) More Details > YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-85682 Patch Status Patched Published Sep 23, 2026 Affected Software YOP Poll [yop-poll] Researcher Supakiad S. (m3ez) More Details > EthPress <= 2.3.5 - Unauthenticated Authentication Bypass 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-19125 Patch Status Patched Published Sep 23, 2026 Affected Software EthPress – Web3 Login [ethpress] Researcher Thatchapol Booranatanit (AliceZz) More Details > HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-92969 Patch Status Patched Published Sep 21, 2026 Affected Software HUSKY – Products Filter for WooCommerce Professional [woocommerce-products-filter] Researcher crow More Details > Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-92713 Patch Status Patched Published Sep 24, 2026 Affected Software Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery] Researcher pb>sec More Details > Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-91827 Patch Status Patched Published Sep 22, 2026 Affected Software Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] Researcher Karthik Ramakrishnan More Details > User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Arbitrary File Deletion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-95525 Patch Status Patched Published Sep 23, 2026 Affected Software User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend] Researcher Ananda Dhakal More Details > WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated Local File Inclusion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-84069 Patch Status Patched Published Sep 24, 2026 Affected Software WebFacing – Email Accounts management for cPanel® [wf-cpanel-email-accounts] Researcher nobody More Details > WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-87902 Patch Status Patched Published Sep 22, 2026 Affected Software WordPress [wordpress] Researcher Robert Ressl More Details > WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-92235 Patch Status Patched Published Sep 21, 2026 Affected Software WP Ultimate Review [wp-ultimate-review] Researcher jtb75 More Details > 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-94121 Patch Status Patched Published Sep 24, 2026 Affected Software 10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer] Researcher Ananda Dhakal More Details > Bluff Post <= 1.1.1 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-89237 Patch Status Unpatched Published Sep 23, 2026 Affected Software Bluff Post [bluff-post] Researcher João Ramos Maciel More Details > Bookly 23.2 - 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-86841 Patch Status Patched Published Sep 25, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher Muni Nitish Kumar Yaddala More Details > eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-77193 Patch Status Patched Published Sep 23, 2026 Affected Software eesy_ID2WP – Publish InDesign HTML5 [eesy-id2wp-publish-indesign-html5] Researcher sermsak More Details > GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.2 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-94177 Patch Status Patched Published Sep 25, 2026 Affected Software GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress] Researcher Bruno Alvarenga More Details > GEO Plugin by Squirrly SEO <= 14.2.5 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-94076 Patch Status Patched Published Sep 24, 2026 Affected Software GEO Plugin by Squirrly SEO [squirrly-seo] Researcher Ananda Dhakal More Details > Go Live Update Urls <= 7.0.8 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-94678 Patch Status Patched Published Sep 24, 2026 Affected Software Go Live Update Urls [go-live-update-urls] Researcher Ananda Dhakal More Details > JetFormBuilder Stripe Gateway <= 1.0.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2022-4997 Patch Status Patched Published Sep 21, 2026 Affected Software JetFormBuilder Stripe Gateway [jet-form-builder-stripe-gateway] Researcher Jakub Herman More Details > MasterStudy LMS 3.5.29 - 3.7.49 - Authenticated (Contributor+) Local File Inclusion 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-88843 Patch Status Patched Published Sep 25, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher Karthik Ramakrishnan More Details > Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-89406 Patch Status Patched Published Sep 24, 2026 Affected Software Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery] Researcher Supakiad S. (m3ez) More Details > Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.0 - Unauthenticated Arbitrary File Read 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-94123 Patch Status Patched Published Sep 24, 2026 Affected Software Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] Researcher Intrudify More Details > Product Filter for WooCommerce by WBW <= 3.1.7 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-95601 Patch Status Patched Published Sep 23, 2026 Affected Software Product Filter for WooCommerce by WBW [woo-product-filter] Researcher daroo More Details > Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-93368 Patch Status Unpatched Published Sep 22, 2026 Affected Software Rename wp-login.php to anything you want [rename-wp-loginphp-to-anything-you-want] Researcher nthng More Details > ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.5 - Authenticated (Subscriber+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-97246 Patch Status Patched Published Sep 24, 2026 Affected Software ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser] Researcher Asim Alshaya More Details > SPS-Suite <= 1.4.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-93000 Patch Status Unpatched Published Sep 25, 2026 Affected Software SPS-Suite [sps-suite-121] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.84 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-93621 Patch Status Patched Published Sep 25, 2026 Affected Software WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards [wp-data-access] Researcher Raphael P. Cigana More Details > WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-13456 Patch Status Patched Published Sep 24, 2026 Affected Software WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin] Researcher lhking More Details > WP Store Locator < 3.0.0 - Unauthenticated Denial of Service 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-94681 Patch Status Patched Published Sep 24, 2026 Affected Software WP Store Locator [wp-store-locator] Researcher satokan More Details > WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-9231 Patch Status Patched Published Sep 21, 2026 Affected Software WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine] Researcher 0xQRx More Details > wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-80513 Patch Status Patched Published Sep 22, 2026 Affected Software wpForo Forum [wpforo] Researcher Sai Praneeth Koti More Details > Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-93901 Patch Status Patched Published Sep 24, 2026 Affected Software Optima Express IDX [optima-express] Researcher Wordfence PRISM More Details > Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97077 Patch Status Patched Published Sep 24, 2026 Affected Software Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] Researcher Asim Alshaya More Details > AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-83591 Patch Status Patched Published Sep 24, 2026 Affected Software AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] Researcher Pham Duc Anh More Details > BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96039 Patch Status Patched Published Sep 24, 2026 Affected Software BA Book Everything [ba-book-everything] Researcher Adrien Brunner More Details > Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More <= 5.5.1.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95529 Patch Status Patched Published Sep 23, 2026 Affected Software Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form] Researcher daroo More Details > CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-12470 Patch Status Patched Published Sep 21, 2026 Affected Software CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] Researcher Như Nguyễn More Details > Core Web Vitals & PageSpeed Booster <= 1.0.31 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95528 Patch Status Patched Published Sep 23, 2026 Affected Software Core Web Vitals & PageSpeed Booster [core-web-vitals-pagespeed-booster] Researcher Nguyen Nhat Long More Details > Download Manager Pro <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-86609 Patch Status Patched Published Sep 25, 2026 Affected Software Download Manager [downloadmanager] Researcher Anand Sharma (andy) More Details > Event Tickets and Registration <= 5.29.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93526 Patch Status Patched Published Sep 23, 2026 Affected Software Event Tickets and Registration [event-tickets] Researcher sequence_X0 More Details > Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-84279 Patch Status Patched Published Sep 24, 2026 Affected Software Fancy Product Designer [fancy-product-designer] Researcher h0xilo More Details > Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-84281 Patch Status Patched Published Sep 24, 2026 Affected Software Fancy Product Designer [fancy-product-designer] Researcher h0xilo More Details > Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-84280 Patch Status Patched Published Sep 24, 2026 Affected Software Fancy Product Designer [fancy-product-designer] Researcher h0xilo More Details > GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96830 Patch Status Patched Published Sep 24, 2026 Affected Software GiveWP – Donation Plugin and Fundraising Platform [give] Researcher Luke Eldridge More Details > Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.15 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97065 Patch Status Patched Published Sep 24, 2026 Affected Software Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms [happyforms] Researcher Dthangws More Details > HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93303 Patch Status Patched Published Sep 24, 2026 Affected Software HT Contact Form – Drag & Drop Form Builder for WordPress [ht-contactform] Researcher kuzomo More Details > JetEngine <= 3.8.14.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97237 Patch Status Patched Published Sep 24, 2026 Affected Software JetEngine [jet-engine] Researcher nh4tvd More Details > LayerSlider <= 8.4.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97253 Patch Status Patched Published Sep 24, 2026 Affected Software LayerSlider [LayerSlider] Researcher Rafie Muhammad More Details > Link Library <= 7.9.5 - Unauthenticated Server-Side Request Forgery 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-78397 Patch Status Patched Published Sep 23, 2026 Affected Software Link Library [link-library] Researcher Charles Vosburgh More Details > Mang Board <= 2.4.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94176 Patch Status Patched Published Sep 23, 2026 Affected Software Mang Board [mangboard] Researcher dcs More Details > Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95515 Patch Status Patched Published Sep 23, 2026 Affected Software Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] Researcher Dthangws More Details > Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94504 Patch Status Patched Published Sep 21, 2026 Affected Software Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] Researcher Hippolyte Quéré (Hippie) (Hippie) More Details > Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-92438 Patch Status Patched Published Sep 22, 2026 Affected Software Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] Researcher Venkateswara Reddy Challa More Details > Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93654 Patch Status Patched Published Sep 24, 2026 Affected Software Premium Packages – Sell Digital Products Securely [wpdm-premium-packages] Researcher Coopernicus More Details > Product Table & List Builder for WooCommerce <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96814 Patch Status Patched Published Sep 24, 2026 Affected Software Product Table & List Builder for WooCommerce [wc-product-table-lite] Researcher Asim Alshaya More Details > Razorpay Payment Button Plugin <= 2.4.9 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94179 Patch Status Patched Published Sep 23, 2026 Affected Software Razorpay Payment Button Plugin [razorpay-payment-button] Researcher Ananda Dhakal More Details > Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94573 Patch Status Patched Published Sep 24, 2026 Affected Software Repeater Fields for Elementor Forms [repeater-for-elementor] Researcher nthng More Details > Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96568 Patch Status Patched Published Sep 24, 2026 Affected Software Restaurant Menu and Food Ordering [mp-restaurant-menu] Researcher 刀 妖 More Details > Site Reviews <= 8.3.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94078 Patch Status Patched Published Sep 24, 2026 Affected Software Site Reviews [site-reviews] Researcher Intrudify More Details > Testimonials Widget <= 4.0.4 - Unauthenticated Server-Side Request Forgery 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96533 Patch Status Unpatched Published Sep 24, 2026 Affected Software Testimonials Widget [testimonials-widget] Researcher Naiches More Details > ThemeREX Addons < 2.45.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97235 Patch Status Patched Published Sep 24, 2026 Affected Software ThemeREX Addons [trx_addons] Researcher nh4tvd More Details > Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95864 Patch Status Patched Published Sep 24, 2026 Affected Software Themify Builder [themify-builder] Researcher thevietronin More Details > TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-89412 Patch Status Patched Published Sep 21, 2026 Affected Software TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] Researcher Yu Liu More Details > User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95866 Patch Status Patched Published Sep 24, 2026 Affected Software User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] Researcher Jonah Burgess (CryptoCat) More Details > WP Photo Album Plus <= 9.3.02.002 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93774 Patch Status Patched Published Sep 23, 2026 Affected Software WP Photo Album Plus [wp-photo-album-plus] Researcher daroo More Details > WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.13 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93770 Patch Status Patched Published Sep 24, 2026 Affected Software WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] Researcher Intrudify More Details > WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93778 Patch Status Patched Published Sep 21, 2026 Affected Software WP Yelp Review Slider [wp-yelp-review-slider] Researcher Ivaylo More Details > WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93836 Patch Status Patched Published Sep 21, 2026 Affected Software WPC Product Bundles for WooCommerce [woo-product-bundle] Researcher lhking More Details > WPS Limit Login <= 1.5.9.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93622 Patch Status Patched Published Sep 23, 2026 Affected Software WPS Limit Login [wps-limit-login] Researcher Ananda Dhakal More Details > YITH WooCommerce Ajax Search <= 2.28.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96352 Patch Status Patched Published Sep 24, 2026 Affected Software YITH WooCommerce Ajax Search [yith-woocommerce-ajax-search] Researcher Dthangws More Details > Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96752 Patch Status Patched Published Sep 24, 2026 Affected Software Zero Spam for WordPress [zero-spam] Researcher Adrien Brunner More Details > پارسی دیت – Parsi Date <= 6.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96836 Patch Status Patched Published Sep 24, 2026 Affected Software پارسی دیت – Parsi Date [wp-parsidate] Researcher neurotx More Details > WP Table Builder 2.1.1 - 2.1.13 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter 7.1 CVSS Rating 7.1 (High) CVE-ID CVE-2026-6922 Patch Status Patched Published Sep 21, 2026 Affected Software WP Table Builder – Drag & Drop Table Builder [wp-table-builder] Researcher Quốc Huy (jtwings) More Details > Kadence WooCommerce Email Designer <= 1.5.19.1 - Authenticated (Shop Manager+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-94677 Patch Status Patched Published Sep 24, 2026 Affected Software Kadence WooCommerce Email Designer [kadence-woocommerce-email-designer] Researcher Ananda Dhakal More Details > Reycob Product Import Export <= 2.3.0 - Authenticated (Shop Manager+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-95603 Patch Status Patched Published Sep 23, 2026 Affected Software Reycob Product Import Export [reycob-product-import-export] Researcher Ananda Dhakal More Details > Ultra Addons for Contact Form 7 <= 3.5.51 - Authenticated (Editor+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-96833 Patch Status Patched Published Sep 24, 2026 Affected Software Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] Researcher Ananda Dhakal More Details > Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-6831 Patch Status Patched Published Sep 22, 2026 Affected Software Advanced Contact form 7 DB [advanced-cf7-db] Researcher Quốc Huy (jtwings) More Details > Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-93899 Patch Status Patched Published Sep 24, 2026 Affected Software Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] Researcher Ivaylo More Details > BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2025-1280 Patch Status Patched Published Sep 21, 2026 Affected Software BM Content Builder [bm-builder] Researcher Tonn More Details > Booking Manager <= 2.1.20 - Authenticated (Author+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-91024 Patch Status Patched Published Sep 21, 2026 Affected Software Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar [booking-manager] Researcher Mohamed Bassia More Details > Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-4806 Patch Status Patched Published Sep 23, 2026 Affected Software Custom Thank You Page for WooCommerce [custom-thank-you-page] Researcher Legion Hunter More Details > ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Author+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-96346 Patch Status Patched Published Sep 23, 2026 Affected Software ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp] Researcher Ananda Dhakal More Details > GTranslate <= 5.0.0 - Unauthenticated Arbitrary Shortcode Execution 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-86604 Patch Status Patched Published Sep 21, 2026 Affected Software Translate WordPress with GTranslate [gtranslate] Researcher Jakub Herman More Details > Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator <= 1.5.10 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-93527 Patch Status Patched Published Sep 23, 2026 Affected Software Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator [live-copy-paste] Researcher Ananda Dhakal More Details > Malcure Malware Shield <= 19.9.6 - Missing Authorization 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-96896 Patch Status Patched Published Sep 25, 2026 Affected Software Malcure Malware Shield — Removal, Repair, Monitor [wp-malware-removal] Researcher Charles Vosburgh More Details > Mollie Forms <= 2.11.0 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-93773 Patch Status Patched Published Sep 23, 2026 Affected Software Mollie Forms [mollie-forms] Researcher Ananda Dhakal More Details > Ninja Tables <= 5.2.16 - Unauthenticated Arbitrary Shortcode Execution 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-86612 Patch Status Patched Published Sep 21, 2026 Affected Software Ninja Tables – Easy Data Table Builder [ninja-tables] Researcher Jakub Herman More Details > Post Voting System <= 1.0 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-89303 Patch Status Unpatched Published Sep 25, 2026 Affected Software Post Voting System [post-voting-system] Researcher Erwan LR More Details > Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-86601 Patch Status Patched Published Sep 21, 2026 Affected Software WP Recipe Maker [wp-recipe-maker] Researcher Jakub Herman More Details > Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-84097 Patch Status Patched Published Sep 24, 2026 Affected Software WP Review Slider Pro [wp-review-slider-pro] Researcher Erwan LR More Details > Shopping Cart & eCommerce Store <= 5.9.4 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-94124 Patch Status Patched Published Sep 23, 2026 Affected Software Shopping Cart & eCommerce Store [wp-easycart] Researcher Ananda Dhakal More Details > Tainacan <= 1.2.0 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-95590 Patch Status Patched Published Sep 23, 2026 Affected Software Tainacan [tainacan] Researcher Trương Hữu Phúc More Details > Template Kit – Import <= 1.0.16 - Authenticated (Editor+) Arbitrary File Deletion 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-96824 Patch Status Patched Published Sep 24, 2026 Affected Software Template Kit – Import [template-kit-import] Researcher Ananda Dhakal More Details > WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-84744 Patch Status Patched Published Sep 24, 2026 Affected Software WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] Researcher Jakub Herman More Details > Ad Inserter 2.8.12 - 2.8.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-81655 Patch Status Patched Published Sep 25, 2026 Affected Software Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] Researcher Jakub Herman More Details > Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15273 Patch Status Patched Published Sep 25, 2026 Affected Software Automatic.css [automatic-css] Researcher Nguyen Ngoc Duc (duc193) More Details > Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94376 Patch Status Patched Published Sep 24, 2026 Affected Software Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] Researcher Adrien Brunner More Details > Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-85653 Patch Status Patched Published Sep 21, 2026 Affected Software Contextual Related Posts [contextual-related-posts] Researchers Athiwat Tiprasaharn (Jitlada)Itthidej Aramsri (Boeing777) More Details > CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2025-14814 Patch Status Patched Published Sep 24, 2026 Affected Software CSS & JavaScript Toolbox [css-javascript-toolbox] Researcher Muhammad Yudha - DJ More Details > Delicious <= 1.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-92411 Patch Status Patched Published Sep 24, 2026 Affected Software WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) [delicious-recipes] Researcher Philipp Doblhofer More Details > Directorist <= 8.9.4 - Authenticated (Subscriber+) Server-Side Request Forgery 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-84046 Patch Status Patched Published Sep 21, 2026 Affected Software Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] Researcher Bhaveshkumar Parmar More Details > Directory Kit <= 1.5.7 - Authenticated (Listing Admin+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-16591 Patch Status Patched Published Sep 24, 2026 Affected Software WP Directory Kit [wpdirectorykit] Researcher Yaswanth Reddy Sunkara More Details > Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.69 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-93339 Patch Status Patched Published Sep 21, 2026 Affected Software Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker] Researcher Paul Serban More Details > Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.69 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94461 Patch Status Patched Published Sep 23, 2026 Affected Software Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker] Researcher Intrudify More Details > ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94500 Patch Status Patched Published Sep 23, 2026 Affected Software ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite] Researcher nh4tvd More Details > EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-85002 Patch Status Patched Published Sep 25, 2026 Affected Software EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress] Researcher Dthangws More Details > GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-93897 Patch Status Patched Published Sep 24, 2026 Affected Software GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] Researcher Jonah Burgess (CryptoCat) More Details > GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96766 Patch Status Patched Published Sep 24, 2026 Affected Software GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] Researcher Yuto Hyakumoto More Details > Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-92746 Patch Status Patched Published Sep 24, 2026 Affected Software Gutenverse – WordPress Blocks, Page Builder & Site Editor [gutenverse] Researcher Dmitrii Ignatyev More Details > Happy Addons for Elementor <= 3.49.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-85006 Patch Status Patched Published Sep 21, 2026 Affected Software HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons] Researcher Revanth Hari Narayana Matte More Details > JetEngine <= 3.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97238 Patch Status Patched Published Sep 24, 2026 Affected Software JetEngine [jet-engine] Researcher nh4tvd More Details > JetTricks <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-93618 Patch Status Patched Published Sep 23, 2026 Affected Software JetTricks [jet-tricks] Researcher nh4tvd More Details > JSM Show Post Metadata <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-88997 Patch Status Patched Published Sep 21, 2026 Affected Software JSM Show Post Metadata [jsm-show-post-meta] Researcher pervinzahidli More Details > King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.85 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96835 Patch Status Patched Published Sep 24, 2026 Affected Software King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons] Researcher nh4tvd More Details > Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-16778 Patch Status Patched Published Sep 21, 2026 Affected Software Live Composer – Free WordPress Website Builder [live-composer-page-builder] Researcher Wordfence PRISM More Details > Ocean Extra <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94684 Patch Status Patched Published Sep 23, 2026 Affected Software Ocean Extra [ocean-extra] Researcher Ananda Dhakal More Details > Optima Express 8.6.0 - 8.7.5 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96899 Patch Status Patched Published Sep 25, 2026 Affected Software Optima Express IDX [optima-express] Researcher Usama Arshad More Details > Optimole 4.0.0 - 4.2.12 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96531 Patch Status Patched Published Sep 24, 2026 Affected Software Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp] Researcher Dmitrii Ignatyev More Details > Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing <= 1.69.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94674 Patch Status Patched Published Sep 24, 2026 Affected Software Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing [woocommerce-google-adwords-conversion-tracking-tag] Researcher Intrudify More Details > PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 11.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-95530 Patch Status Patched Published Sep 23, 2026 Affected Software PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] Researcher Intrudify More Details > Podcast Importer SecondLine <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94682 Patch Status Patched Published Sep 23, 2026 Affected Software Podcast Importer SecondLine [podcast-importer-secondline] Researcher Ananda Dhakal More Details > PowerPress <= 11.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97319 Patch Status Patched Published Sep 25, 2026 Affected Software PowerPress Podcasting plugin by Blubrry [powerpress] Researcher Dmitrii Ignatyev More Details > Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94168 Patch Status Patched Published Sep 23, 2026 Affected Software Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor] Researcher Intrudify More Details > Premium Blocks – Gutenberg Blocks, Patterns & Templates <= 2.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94118 Patch Status Patched Published Sep 23, 2026 Affected Software Premium Blocks – Gutenberg Blocks, Patterns & Templates [premium-blocks-for-gutenberg] Researcher benzdeus More Details > Real3D Flipbook Lite <= 5.3 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2025-15696 Patch Status Patched Published Sep 21, 2026 Affected Software Real3D Flipbook [real3d-flipbook] Researcher Hanif Naufal Rahman More Details > Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-84096 Patch Status Patched Published Sep 24, 2026 Affected Software WP Review Slider Pro [wp-review-slider-pro] Researcher Erwan LR More Details > Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-84095 Patch Status Patched Published Sep 24, 2026 Affected Software WP Review Slider Pro [wp-review-slider-pro] Researcher Erwan LR More Details > Safe SVG <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94077 Patch Status Patched Published Sep 23, 2026 Affected Software Safe SVG [safe-svg] Researcher spectreDeveloper More Details > Subscribe Forms 1.4.1 - 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-91073 Patch Status Patched Published Sep 21, 2026 Affected Software Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form [wp-subscribe-form] Researcher Artus KG More Details > Text Styler <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-88788 Patch Status Unpatched Published Sep 22, 2026 Affected Software Text Styler [text-styler] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96829 Patch Status Patched Published Sep 24, 2026 Affected Software The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates [the-plus-addons-for-elementor-page-builder] Researcher nh4tvd More Details > The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94680 Patch Status Patched Published Sep 23, 2026 Affected Software The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid [the-post-grid] Researcher Intrudify More Details > The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94671 Patch Status Patched Published Sep 23, 2026 Affected Software The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid [the-post-grid] Researcher Google Threat Intelligence Group More Details > The Post Grid <= 7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-84151 Patch Status Patched Published Sep 22, 2026 Affected Software The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid [the-post-grid] Researcher Revanth Hari Narayana Matte More Details > ThemeREX Addons < 2.45.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97236 Patch Status Patched Published Sep 24, 2026 Affected Software ThemeREX Addons [trx_addons] Researcher nh4tvd More Details > Ultimate FAQ Accordion Plugin <= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94391 Patch Status Patched Published Sep 23, 2026 Affected Software Ultimate FAQ Accordion Plugin [ultimate-faqs] Researcher Ananda Dhakal More Details > Ultra Addons for Contact Form 7 <= 3.5.50 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-95586 Patch Status Patched Published Sep 22, 2026 Affected Software Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7] Researcher Marc-André Beaulieu More Details > User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96338 Patch Status Patched Published Sep 24, 2026 Affected Software User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] Researcher Tarcísio Luchesi More Details > User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-93656 Patch Status Patched Published Sep 24, 2026 Affected Software User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] Researcher FeelSoClean More Details > WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-13179 Patch Status Patched Published Sep 24, 2026 Affected Software WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin] Researcher daroo More Details > WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15731 Patch Status Patched Published Sep 23, 2026 Affected Software WP Multilang – Translation and Multilingual Plugin [wp-multilang] Researchers Athiwat Tiprasaharn (Jitlada)Itthidej Aramsri (Boeing777) More Details > WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-89005 Patch Status Patched Published Sep 22, 2026 Affected Software WPeMatico RSS Feed Fetcher [wpematico] Researcher achmad sonif More Details > WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-89002 Patch Status Patched Published Sep 22, 2026 Affected Software WPeMatico RSS Feed Fetcher [wpematico] Researcher Karthik Ramakrishnan More Details > WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Server-Side Request Forgery 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-89003 Patch Status Patched Published Sep 25, 2026 Affected Software WPeMatico RSS Feed Fetcher [wpematico] Researcher Karthik Ramakrishnan More Details > WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Server-Side Request Forgery 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-89000 Patch Status Patched Published Sep 25, 2026 Affected Software WPeMatico RSS Feed Fetcher [wpematico] Researcher JunHee CHO More Details > WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-89006 Patch Status Patched Published Sep 25, 2026 Affected Software WPeMatico RSS Feed Fetcher [wpematico] Researcher Philipp Doblhofer More Details > wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-93772 Patch Status Patched Published Sep 23, 2026 Affected Software wpForo Forum [wpforo] Researcher neurotx More Details > wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-93747 Patch Status Patched Published Sep 24, 2026 Affected Software wpForo Forum [wpforo] Researcher Ivaylo More Details > YouTube Lyte <= 1.7.30 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96895 Patch Status Patched Published Sep 25, 2026 Affected Software WP YouTube Lyte [wp-youtube-lyte] Researcher Dmitrii Ignatyev More Details > All-In-One Security (AIOS) – Security and Firewall <= 5.4.8 - Authenticated (Subscriber+) Security Control Bypass 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-96825 Patch Status Patched Published Sep 24, 2026 Affected Software All-In-One Security (AIOS) – Security and Firewall [all-in-one-wp-security-and-firewall] Researcher Ananda Dhakal More Details > Estatik Real Estate Plugin <= 4.3.5 - Authenticated (Subscriber+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-96350 Patch Status Patched Published Sep 24, 2026 Affected Software Estatik Real Estate Plugin [estatik] Researcher daroo More Details > Import and export users and customers <= 2.5.2 - Authenticated (Subscriber+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-94178 Patch Status Patched Published Sep 24, 2026 Affected Software Import and export users and customers [import-users-from-csv-with-meta] Researcher Intrudify More Details > MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) HTML Injection 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-81338 Patch Status Patched Published Sep 21, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher Jaime F. Murillo More Details > SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.7.2 - Authenticated (Shop Worker+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-97245 Patch Status Patched Published Sep 24, 2026 Affected Software SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart] Researcher Supakiad S. More Details > User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-95523 Patch Status Patched Published Sep 23, 2026 Affected Software User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend] Researcher Ananda Dhakal More Details > WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-89001 Patch Status Patched Published Sep 25, 2026 Affected Software WPeMatico RSS Feed Fetcher [wpematico] Researcher Karthik Ramakrishnan More Details > Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-93655 Patch Status Patched Published Sep 21, 2026 Affected Software Booking Calendar [booking] Researcher Asaf Mozes More Details > JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92212 Patch Status Patched Published Sep 24, 2026 Affected Software JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] Researcher Tarcísio Luchesi De Almeida Silva (Poystick) More Details > Link Library <= 7.9.5 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-78393 Patch Status Patched Published Sep 23, 2026 Affected Software Link Library [link-library] Researcher Karthik Ramakrishnan More Details > Multiple elFinder Plugins <= 8.0.4 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-85081 Patch Status Patched Published Sep 24, 2026 Affected Software File Manager Pro – Filester [filester]FileOrganizer – WordPress File Manager [fileorganizer]File Manager [wp-file-manager] Researcher Mutantgun More Details > SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-17577 Patch Status Patched Published Sep 24, 2026 Affected Software SSL Zen — SSL Certificate Installer & HTTPS Redirects [ssl-zen] Researcher Wordfence PRISM More Details > WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-88996 Patch Status Patched Published Sep 24, 2026 Affected Software WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] Researcher UKO More Details > Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter 5.5 CVSS Rating 5.5 (Medium) CVE-ID CVE-2026-12037 Patch Status Patched Published Sep 24, 2026 Affected Software Asset CleanUp: Page Speed Booster [wp-asset-clean-up] Researcher Pham Duc Anh More Details > Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-18335 Patch Status Patched Published Sep 23, 2026 Affected Software Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] Researcher Khoa Dang More Details > 10Web Booster <= 2.33.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-82195 Patch Status Patched Published Sep 22, 2026 Affected Software 10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer] Researcher Shirshak Roy More Details > AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.7.8 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-93623 Patch Status Patched Published Sep 23, 2026 Affected Software AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine] Researcher foehn More Details > AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) <= 3.15.4 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94498 Patch Status Patched Published Sep 23, 2026 Affected Software AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) [appmysite] Researcher dodoh4t More Details > Better Payment <= 2.3.3 - Unauthenticated Payment Manipulation 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-77765 Patch Status Patched Published Sep 21, 2026 Affected Software Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More [better-payment] Researcher Muni Nitish Kumar Yaddala More Details > Blocksy Companion <= 2.1.55 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97247 Patch Status Patched Published Sep 24, 2026 Affected Software Blocksy Companion [blocksy-companion] Researcher Asim Alshaya More Details > Bookly <= 28.2 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86837 Patch Status Patched Published Sep 25, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher Artus KG More Details > Bookly <= 28.2 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86838 Patch Status Patched Published Sep 25, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher vuxvinh More Details > Captcha Code <= 3.32 - Unauthenticated Login Captcha Protection Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94457 Patch Status Patched Published Sep 23, 2026 Affected Software Captcha Code [captcha-code-authentication] Researcher Lê Gia Khôi (KLg) More Details > Conekta Payment Gateway <= 6.2.4 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95527 Patch Status Patched Published Sep 23, 2026 Affected Software Conekta Payment Gateway [conekta-payment-gateway] Researcher anhcd05 More Details > Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96823 Patch Status Patched Published Sep 24, 2026 Affected Software Customer Reviews for WooCommerce [customer-reviews-woocommerce] Researcher Matheo Beuve More Details > Directorist 8.1 - 8.9.4 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-84026 Patch Status Patched Published Sep 21, 2026 Affected Software Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] Researcher Usama Arshad More Details > Divi Dash <= 1.0.6 - Unauthenticated IP Spoofing to Protection Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-14321 Patch Status Patched Published Sep 21, 2026 Affected Software Divi Dash [divi-dash] Researcher Mike Gozdiskowski More Details > Easy Hide Login <= 1.6 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-84168 Patch Status Patched Published Sep 21, 2026 Affected Software Easy Hide Login [easy-hide-login] Researcher Huseyin Mertoglu More Details > Email Subscribers by Icegram Express <= 5.9.34 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-83555 Patch Status Patched Published Sep 21, 2026 Affected Software Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress [email-subscribers] Researcher Usama Arshad More Details > File Manager 7.2.2 - 8.0.4 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-19708 Patch Status Patched Published Sep 24, 2026 Affected Software File Manager [wp-file-manager] Researcher Jakub Herman More Details > FluentBoards 1.95 - 2.0.15 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-89331 Patch Status Patched Published Sep 21, 2026 Affected Software FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards] Researcher vuxvinh More Details > Forminator Forms <= 1.57.2.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87074 Patch Status Patched Published Sep 21, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher vuxvinh More Details > Forminator Forms <= 1.57.2.0 - Missing Authorization to Unauthenticated Arbitrary Post Meta Injection 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87071 Patch Status Patched Published Sep 21, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher Dion Mulaj More Details > Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87070 Patch Status Patched Published Sep 21, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher vuxvinh More Details > GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97066 Patch Status Patched Published Sep 24, 2026 Affected Software GiveWP – Donation Plugin and Fundraising Platform [give] Researcher Ananda Dhakal More Details > GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated User Impersonation 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97196 Patch Status Patched Published Sep 24, 2026 Affected Software GiveWP – Donation Plugin and Fundraising Platform [give] Researcher Abdelrhman Allam More Details > Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2025-14487 Patch Status Patched Published Sep 21, 2026 Affected Software Handily [handily] Researcher Phat RiO More Details > Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2025-14484 Patch Status Unpatched Published Sep 21, 2026 Affected Software Image Buzz [image-buzz] Researcher Phat RiO More Details > Mailchimp for WooCommerce <= 6.2 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92436 Patch Status Patched Published Sep 25, 2026 Affected Software Mailchimp for WooCommerce [mailchimp-for-woocommerce] Researcher JunHee CHO More Details > MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.70 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94080 Patch Status Patched Published Sep 23, 2026 Affected Software MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce] Researcher JunHee CHO More Details > MasterStudy LMS <= 3.7.49 - Missing Authorization to Account Registration 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-88846 Patch Status Patched Published Sep 22, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher vuxvinh More Details > Netgsm <= 2.10.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95514 Patch Status Patched Published Sep 23, 2026 Affected Software Netgsm [netgsm] Researcher Eyüphan Şahin More Details > Newsletters <= 4.18.0 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-16264 Patch Status Patched Published Sep 21, 2026 Affected Software Newsletters [newsletters-lite] Researcher Yaswanth Reddy Sunkara More Details > NP Quote Request for WooCommerce <= 2.4.15 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-93528 Patch Status Patched Published Sep 21, 2026 Affected Software NP Quote Request for WooCommerce [woo-rfq-for-woocommerce] Researcher Murad Islamzada More Details > Online Booking & Scheduling Calendar by vcita <= 4.6.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95513 Patch Status Patched Published Sep 23, 2026 Affected Software Online Booking & Scheduling Calendar by vcita [meeting-scheduler-by-vcita] Researcher ParkHyunWoo More Details > Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96348 Patch Status Patched Published Sep 24, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher Ananda Dhakal More Details > Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92799 Patch Status Patched Published Sep 24, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher crow More Details > Optima Express 8.5.0 - 8.7.5 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96897 Patch Status Patched Published Sep 25, 2026 Affected Software Optima Express IDX [optima-express] Researcher Alex Spataru More Details > Paid Member Subscriptions <= 3.0.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90951 Patch Status Patched Published Sep 21, 2026 Affected Software Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions] Researcher vuxvinh More Details > Paid Member Subscriptions <= 3.0.0 - Unauthenticated CAPTCHA Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90950 Patch Status Patched Published Sep 21, 2026 Affected Software Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions] Researcher Naoki Kawahigashi More Details > Paymattic <= 4.6.25 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-89411 Patch Status Patched Published Sep 24, 2026 Affected Software Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management [wp-payment-form] Researcher Artus KG More Details > Payment Plugins for PayPal WooCommerce <= 2.0.26 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-80342 Patch Status Patched Published Sep 21, 2026 Affected Software Payment Plugins for PayPal WooCommerce [pymntpl-paypal-woocommerce] Researchers m1w34p0nKrypt3d More Details > Paymob for WooCommerce <= 4.1.13 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87979 Patch Status Patched Published Sep 21, 2026 Affected Software Paymob for WooCommerce [paymob-for-woocommerce] Researcher Salúa Es-sair More Details > Paymob for WooCommerce <= 4.1.13 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-87978 Patch Status Patched Published Sep 21, 2026 Affected Software Paymob for WooCommerce [paymob-for-woocommerce] Researcher Charles Vosburgh More Details > PayPlus Payment Gateway <= 8.2.5 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-93620 Patch Status Patched Published Sep 23, 2026 Affected Software PayPlus Payment Gateway [payplus-payment-gateway] Researcher mamgad More Details > PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2025-14486 Patch Status Unpatched Published Sep 21, 2026 Affected Software PixelPlay [pixelplay] Researcher Phat RiO More Details > PostX <= 5.0.40 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86783 Patch Status Patched Published Sep 21, 2026 Affected Software Post Grid Gutenberg Blocks – PostX [ultimate-post] Researcher Pedro Pinho More Details > Premium Packages <= 7.2.0 - Unauthenticated Forged Payment and Subscription Events 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-93511 Patch Status Patched Published Sep 21, 2026 Affected Software Premium Packages – Sell Digital Products Securely [wpdm-premium-packages] Researcher Farid Narimanov More Details > Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated Arbitrary User Meta Corruption 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86608 Patch Status Patched Published Sep 21, 2026 Affected Software WP Recipe Maker [wp-recipe-maker] Researcher Isuka sanuj More Details > Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-88929 Patch Status Patched Published Sep 21, 2026 Affected Software Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster [easy-sale-badges-for-woocommerce] Researcher Que Thanh Tuan More Details > Simply Schedule Appointments <= 1.6.12.29 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94074 Patch Status Patched Published Sep 24, 2026 Affected Software Simply Schedule Appointments [simply-schedule-appointments] Researcher Mor Golan More Details > Simply Schedule Appointments <= 1.6.12.31 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94673 Patch Status Patched Published Sep 24, 2026 Affected Software Simply Schedule Appointments [simply-schedule-appointments] Researcher rpgsec More Details > Sprout Invoices – Client Invoicing & Estimates <= 20.8.17 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97078 Patch Status Patched Published Sep 24, 2026 Affected Software Sprout Invoices – Client Invoicing & Estimates [sprout-invoices] Researcher gueco More Details > Tangible: Loops & Logic <= 4.2.4 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95604 Patch Status Patched Published Sep 23, 2026 Affected Software Tangible: Loops & Logic [tangible-loops-and-logic] Researcher K. Sorrachat More Details > Team – Team Members Showcase Plugin <= 6.0.0 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95592 Patch Status Patched Published Sep 23, 2026 Affected Software Team – Team Members Showcase Plugin [tlp-team] Researcher Ihsan Saddan More Details > Team Showcase Supreme <= 9.2 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-11871 Patch Status Patched Published Sep 23, 2026 Affected Software Team Members [tc-team-members] Researcher Vaibhav Narkhede More Details > Testimonials Widget <= 4.0.4 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96532 Patch Status Unpatched Published Sep 24, 2026 Affected Software Testimonials Widget [testimonials-widget] Researcher Naiches More Details > The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-84741 Patch Status Patched Published Sep 21, 2026 Affected Software The Events Calendar [the-events-calendar] Researcher Kaveesha Nirmal More Details > TrustedLogin Connector <= 2.0.3 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95600 Patch Status Patched Published Sep 22, 2026 Affected Software TrustedLogin Connector [trustedlogin-connector] Researcher Oly Hossen More Details > User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Unauthenticated Unauthorized User Registration 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95524 Patch Status Patched Published Sep 23, 2026 Affected Software User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend] Researcher Ananda Dhakal More Details > Verge3D <= 4.13.0 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92995 Patch Status Patched Published Sep 25, 2026 Affected Software Verge3D Publishing and E-Commerce [verge3d] Researcher Raphael P. Cigana More Details > Verge3D 4.1.0 - 4.13.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92996 Patch Status Unpatched Published Sep 25, 2026 Affected Software Verge3D Publishing and E-Commerce [verge3d] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Verify API <= 1.0.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-89300 Patch Status Unpatched Published Sep 25, 2026 Affected Software WP Verify API [wp-verify-api] Researcher RIA Labs More Details > WP User Manager – User Profile Builder & Membership <= 2.9.19 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94079 Patch Status Patched Published Sep 22, 2026 Affected Software WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] Researcher Ananda Dhakal More Details > WPC Smart Compare for WooCommerce <= 6.6.0 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90985 Patch Status Patched Published Sep 21, 2026 Affected Software WPC Smart Compare for WooCommerce [woo-smart-compare] Researcher Artus KG More Details > WPForms Lite 1.8.8.2 - 2.0.1.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-74991 Patch Status Patched Published Sep 22, 2026 Affected Software WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] Researcher Charles Vosburgh More Details > wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-80514 Patch Status Patched Published Sep 22, 2026 Affected Software wpForo Forum [wpforo] Researcher Usama Arshad More Details > YITH Request a Quote for WooCommerce < 4.46.1 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95602 Patch Status Patched Published Sep 23, 2026 Affected Software YITH Request a Quote for WooCommerce [yith-woocommerce-request-a-quote] Researcher Austin Ginder More Details > Admin Notices Manager <= 1.6.0 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-96827 Patch Status Patched Published Sep 23, 2026 Affected Software Admin Notices Manager [admin-notices-manager] Researcher Ananda Dhakal More Details > Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.0 - Authenticated (Shop Manager+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-95522 Patch Status Patched Published Sep 23, 2026 Affected Software Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] Researcher Ananda Dhakal More Details > Email Log <= 2.63 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-94174 Patch Status Patched Published Sep 23, 2026 Affected Software Email Log [email-log] Researcher Ananda Dhakal More Details > Estatik Real Estate Plugin <= 4.3.5 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-96345 Patch Status Patched Published Sep 23, 2026 Affected Software Estatik Real Estate Plugin [estatik] Researcher Ananda Dhakal More Details > HashBar – Announcement, Notification Bar & Popup Campaign <= 2.0.3 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-94117 Patch Status Patched Published Sep 21, 2026 Affected Software HashBar – Announcement, Notification Bar & Popup Campaign [hashbar-wp-notification-bar] Researcher Ananda Dhakal More Details > Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-15095 Patch Status Patched Published Sep 21, 2026 Affected Software Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels [webappick-product-feed-for-woocommerce] Researcher Wordfence PRISM More Details > Simple Discount Rules for Woocommerce <= 5.18 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-96828 Patch Status Patched Published Sep 23, 2026 Affected Software Simple Discount Rules for Woocommerce [woo-product-category-discount] Researcher Ananda Dhakal More Details > SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-17602 Patch Status Patched Published Sep 24, 2026 Affected Software SSL Zen — SSL Certificate Installer & HTTPS Redirects [ssl-zen] Researcher Wordfence PRISM More Details > Ultimeter – the Ultimate Progress and Goals Meter <= 3.0.8 - Authenticated (Editor+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-95593 Patch Status Patched Published Sep 23, 2026 Affected Software Ultimeter – the Ultimate Progress and Goals Meter [ultimeter] Researcher Ananda Dhakal More Details > W4 Post List <= 3.0.6 - Authenticated (Editor+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-96826 Patch Status Patched Published Sep 23, 2026 Affected Software W4 Post List [w4-post-list] Researcher Ananda Dhakal More Details > Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-1645 Patch Status Unpatched Published Sep 21, 2026 Affected Software Hostel [hostel] Researcher Bee More Details > Appointment Booking Plugin & Scheduling System – Webba Booking Calendar <= 6.5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97079 Patch Status Patched Published Sep 24, 2026 Affected Software Appointment Booking Plugin & Scheduling System – Webba Booking Calendar [webba-booking-lite] Researcher sungbyeongchan More Details > Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-96838 Patch Status Patched Published Sep 24, 2026 Affected Software Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification [wc-blacklist-manager] Researcher Mor Golan More Details > Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-88828 Patch Status Patched Published Sep 25, 2026 Affected Software Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification [wc-blacklist-manager] Researcher Naoki Kawahigashi More Details > Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-92829 Patch Status Patched Published Sep 24, 2026 Affected Software Blog2Social: Social Media Auto Post & Scheduler [blog2social] Researcher Averon Averenkov (Averon Averenkov) More Details > Booking Manager <= 2.1.20 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-91025 Patch Status Patched Published Sep 21, 2026 Affected Software Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar [booking-manager] Researcher Choriyev Qahramon More Details > Bookly <= 28.2 - Authenticated (Staff+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-86839 Patch Status Patched Published Sep 25, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher Vũ Quang Huy More Details > Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.27 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-94173 Patch Status Patched Published Sep 24, 2026 Affected Software Business Directory Plugin – Easy Listing & Member Directories for WordPress [business-directory-plugin] Researcher Deva Parekh More Details > CMB2 <= 2.12.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-80338 Patch Status Patched Published Sep 22, 2026 Affected Software CMB2 [cmb2] Researcher Mutantgun More Details > Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-12995 Patch Status Patched Published Sep 21, 2026 Affected Software Custom Field Template [custom-field-template] Researcher Dmitrii Ignatyev More Details > Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-84150 Patch Status Patched Published Sep 21, 2026 Affected Software Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] Researcher Revanth Hari Narayana Matte More Details > Directorist 3.1.0 - 8.9.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-84098 Patch Status Patched Published Sep 21, 2026 Affected Software Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] Researcher Artus KG More Details > Directorist 8.5 - 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-77766 Patch Status Patched Published Sep 21, 2026 Affected Software Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] Researcher Shivamani Vastrala More Details > Directorist 8.9.1 - 8.9.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-84027 Patch Status Patched Published Sep 21, 2026 Affected Software Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] Researcher LevinityCyber More Details > Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-91077 Patch Status Patched Published Sep 21, 2026 Affected Software Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress] Researcher Artus KG More Details > Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93661 Patch Status Patched Published Sep 22, 2026 Affected Software Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager] Researcher Hasyros More Details > Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93662 Patch Status Patched Published Sep 22, 2026 Affected Software Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager] Researcher Karthik Ramakrishnan More Details > Fluent Support – Helpdesk & Customer Support Ticket System <= 2.3.2 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-94679 Patch Status Patched Published Sep 23, 2026 Affected Software Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support] Researcher Brobicho More Details > Forminator Forms <= 1.57.2.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-87069 Patch Status Patched Published Sep 21, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher Karthik Ramakrishnan More Details > GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-96834 Patch Status Patched Published Sep 24, 2026 Affected Software GiveWP – Donation Plugin and Fundraising Platform [give] Researcher Intrudify More Details > Link Library <= 7.9.5 - Authenticated (Contributor+) Path Traversal 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-78394 Patch Status Patched Published Sep 23, 2026 Affected Software Link Library [link-library] Researcher Karthik Ramakrishnan More Details > MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-3253 Patch Status Patched Published Sep 23, 2026 Affected Software MailerLite – Signup forms (official) [official-mailerlite-sign-up-forms] Researcher Tarcísio Luchesi De Almeida Silva (Poystick) More Details > MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93344 Patch Status Patched Published Sep 22, 2026 Affected Software MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce] Researcher Doniyor Sotiboldiyev More Details > MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93343 Patch Status Patched Published Sep 22, 2026 Affected Software MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce] Researcher Doniyor Sotiboldiyev More Details > MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93342 Patch Status Patched Published Sep 22, 2026 Affected Software MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce] Researcher Doniyor Sotiboldiyev More Details > MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization to Authenticated (Subscriber+) Refund Requests 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93341 Patch Status Patched Published Sep 22, 2026 Affected Software MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce] Researcher Doniyor Sotiboldiyev More Details > Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-82850 Patch Status Patched Published Sep 22, 2026 Affected Software Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system] Researcher Usama Arshad More Details > Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-82849 Patch Status Patched Published Sep 22, 2026 Affected Software Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system] Researcher Karthik Ramakrishnan More Details > MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-81339 Patch Status Patched Published Sep 21, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher Revanth Hari Narayana Matte More Details > MasterStudy LMS <= 3.7.49 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-88845 Patch Status Patched Published Sep 22, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher vuxvinh More Details > MasterStudy LMS <= 3.7.49 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-88847 Patch Status Patched Published Sep 22, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher Arman Kumar More Details > MasterStudy LMS <= 3.7.49 - Unauthenticated (Subscriber+) Unauthorized Course Enrollment 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-88848 Patch Status Patched Published Sep 22, 2026 Affected Software MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] Researcher Arman Kumar More Details > MCP Server for WordPress <= 1.8.1 - Authenticated (Contributor+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-96526 Patch Status Patched Published Sep 24, 2026 Affected Software MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP [ai-workflow-automation-ai-agent-hub] Researcher Raphael P. Cigana More Details > MCP Server for WordPress <= 1.8.1 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-96524 Patch Status Patched Published Sep 24, 2026 Affected Software MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP [ai-workflow-automation-ai-agent-hub] Researcher Raphael P. Cigana More Details > MCP Server for WordPress <= 1.8.1 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-96525 Patch Status Patched Published Sep 24, 2026 Affected Software MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP [ai-workflow-automation-ai-agent-hub] Researcher Raphael P. Cigana More Details > NextScripts: Social Networks Auto-Poster <= 4.4.7 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97227 Patch Status Patched Published Sep 25, 2026 Affected Software NextScripts: Social Networks Auto-Poster [social-networks-auto-poster-facebook-twitter-g] Researcher Dmitrii Ignatyev More Details > Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-96347 Patch Status Patched Published Sep 24, 2026 Affected Software Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] Researcher Ananda Dhakal More Details > OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-19775 Patch Status Patched Published Sep 24, 2026 Affected Software OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin [desktop-mode] Researcher Wordfence PRISM More Details > Paymob for WooCommerce <= 4.1.13 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-87981 Patch Status Patched Published Sep 21, 2026 Affected Software Paymob for WooCommerce [paymob-for-woocommerce] Researcher Ryan Fabella More Details > Points and Rewards for WooCommerce <= 2.10.3 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93510 Patch Status Patched Published Sep 21, 2026 Affected Software Points and Rewards for WooCommerce [points-and-rewards-for-woocommerce] Researcher Farid Narimanov More Details > PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.50.1 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-94487 Patch Status Patched Published Sep 23, 2026 Affected Software PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] Researcher Intrudify More Details > Real3D Flipbook Lite <= 5.3 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-86842 Patch Status Patched Published Sep 21, 2026 Affected Software Real3D Flipbook [real3d-flipbook] Researcher Artus KG More Details > Recipe Maker <= 10.8.1 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-86603 Patch Status Patched Published Sep 21, 2026 Affected Software WP Recipe Maker [wp-recipe-maker] Researcher Abdullah Kareem More Details > Recipe Maker 10.3.0 - 10.8.1 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-86602 Patch Status Patched Published Sep 21, 2026 Affected Software WP Recipe Maker [wp-recipe-maker] Researcher Abdullah Kareem More Details > RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-4123 Patch Status Patched Published Sep 21, 2026 Affected Software RW Elephant Rental Inventory [rw-elephant-rental-inventory] Researcher Nabil Irawan More Details > Safe SVG <= 2.5.0 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-94672 Patch Status Patched Published Sep 23, 2026 Affected Software Safe SVG [safe-svg] Researcher Ananda Dhakal More Details > SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.7 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93513 Patch Status Patched Published Sep 23, 2026 Affected Software SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP [siteskite] Researcher Nixxies More Details > Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-16302 Patch Status Patched Published Sep 23, 2026 Affected Software Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg] Researcher se1en More Details > The Events Calendar 6.15.0 - 6.17.4.1 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-84742 Patch Status Patched Published Sep 21, 2026 Affected Software The Events Calendar [the-events-calendar] Researcher Jashid Sany More Details > The Events Calendar 6.15.16.1 - 6.17.4.1 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-84743 Patch Status Patched Published Sep 21, 2026 Affected Software The Events Calendar [the-events-calendar] Researcher Mohammed Abd Alrahman More Details > ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-7622 Patch Status Patched Published Sep 21, 2026 Affected Software ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More [image-sizes] Researcher Que Thanh Tuan More Details > Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-18439 Patch Status Patched Published Sep 21, 2026 Affected Software Tutor LMS – eLearning and online course solution [tutor] Researcher Nakul Chodha More Details > UpdraftPlus 1.23.8 - 1.26.7 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-82841 Patch Status Patched Published Sep 25, 2026 Affected Software UpdraftPlus: WP Backup & Migration Plugin [updraftplus] Researcher Jakub Herman More Details > WC Fields Factory <= 4.1.10 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93508 Patch Status Patched Published Sep 21, 2026 Affected Software WC Fields Factory [wc-fields-factory] Researcher Farid Narimanov More Details > WC Fields Factory <= 4.1.10 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93507 Patch Status Patched Published Sep 21, 2026 Affected Software WC Fields Factory [wc-fields-factory] Researcher Farid Narimanov More Details > WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-18345 Patch Status Patched Published Sep 21, 2026 Affected Software WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] Researcher Wordfence PRISM More Details > WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-9004 Patch Status Unpatched Published Sep 21, 2026 Affected Software WP-CRM System – Manage Clients and Projects [wp-crm-system] Researcher Teerachai Somprasong More Details > WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89004 Patch Status Patched Published Sep 22, 2026 Affected Software WPeMatico RSS Feed Fetcher [wpematico] Researcher Karthik Ramakrishnan More Details > wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-91092 Patch Status Patched Published Sep 21, 2026 Affected Software wpForo Forum [wpforo] Researcher Jonah Burgess (CryptoCat) More Details > WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent <= 2.7.0 - Missing Authorization to Authenticated (Contributor+) Unauthorized Post and Media Modification 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-93529 Patch Status Patched Published Sep 23, 2026 Affected Software WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent [wsp-mcp-ai-agents-connector] Researcher Ananda Dhakal More Details > Zportals <= 6.4.1 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-18365 Patch Status Patched Published Sep 21, 2026 Affected Software Zportals [zportals] Researcher Erwan LR More Details > Zportals <= 6.4.1 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-18364 Patch Status Patched Published Sep 21, 2026 Affected Software Zportals [zportals] Researcher Erwan LR More Details > As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence. This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can. Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026) appeared first on Wordfence.