Last week, there were 501 vulnerabilities disclosed in 367 WordPress Plugins and 9 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 201 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back. Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free. Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. New Firewall Rules Deployed Last Week The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection. The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week: WAF-RULE-963 – Data redacted while we work with the vendor on a patch. Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay. Total Unpatched & Patched Vulnerabilities Last Week Patch Status Number of Vulnerabilities Patched 449 Unpatched 52 Total Vulnerabilities by CVSS Severity Last Week Severity Rating Number of Vulnerabilities Low Severity 1 Medium Severity 306 High Severity 174 Critical Severity 20 Total Vulnerabilities by CWE Type Last Week Vulnerability Type by CWE Number of Vulnerabilities Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 206 Missing Authorization 68 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 42 Exposure of Sensitive Information to an Unauthorized Actor 34 Deserialization of Untrusted Data 30 Authorization Bypass Through User-Controlled Key 23 Improper Control of Generation of Code ('Code Injection') 14 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 13 Improper Privilege Management 13 Client-Side Enforcement of Server-Side Security 9 Improper Authentication 8 Cross-Site Request Forgery (CSRF) 7 Unrestricted Upload of File with Dangerous Type 5 Server-Side Request Forgery (SSRF) 4 Uncontrolled Resource Consumption 4 External Control of File Name or Path 3 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 3 URL Redirection to Untrusted Site ('Open Redirect') 3 Improper Input Validation 2 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') 1 Guessable CAPTCHA 1 Improper Authorization 1 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') 1 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 1 Incorrect Authorization 1 Insufficiently Protected Credentials 1 Path Traversal: '/dir/../filename' 1 Protection Mechanism Failure 1 Use of Hard-coded Password 1 Researchers That Contributed to WordPress Security Last Week Researcher Name Number of Vulnerabilities Ananda Dhakal 72 Intrudify 19 Jakub Herman 14 nh4tvd 12 neurotx 12 Artus KG 10 Kuba 9 Rafie Muhammad 9 theviper17y 7 Wordfence PRISM 7 UKO 7 daroo 7 Nguyen Ba Khanh 6 Enrico Marcolini 6 crow 5 dutafi 5 Erwan LR 5 Peter Tang 5 Adrien Brunner 5 Oly Hossen 4 Asim Alshaya 4 Nixxies 4 JunHee CHO 4 Naoki Kawahigashi 4 Seongwon Lee 4 zickzick2 4 Lucas torres (Rooting) 4 Yuto Hyakumoto 4 Eunho Kim 4 Sarvar Eshboyev 3 Supakiad S. 3 b1ue0cean 3 V1T 3 Ayukiab 3 Yaswanth Reddy Sunkara 3 lhking 3 Webbernaut 3 Pablo González Pérez 3 Francisco José Ramírez Vicente 3 Iñigo Sánchez Enciso 3 d.v4n_s3c 3 Mutantgun 3 Dthangws 3 dcs 3 SecondGateWP 3 Alban Roche 3 Dmitrii Ignatyev 3 Khanh Nguyen 2 Tarcísio Luchesi De Almeida Silva (Poystick) 2 berke bodur 2 Sebastian Albrecht (mySebbe) 2 ChuongVN 2 Supakiad S. (m3ez) 2 sungbyeongchan 2 Nguyen Dinh Hai (HaiND) 2 Het Kalariya 2 MYUNGYONG LEE 2 vuxvinh 2 cazy 2 Ivaylo 2 Usama Arshad 2 Nabil Irawan 2 Heinrihs Skrodelis 2 Ashish Agarwal 2 Patchstack 2 0xd4rk5id3 2 sequence_X0 2 Murad Akhmedov 2 Claudio Marchesini 2 Dottor Marc 2 kiemtiendinhau 2 OKISO 2 Ivaylo Atanassov 2 whale120 2 Suhayb Ahmed 2 j4ck13ch4n 2 Tran Nguyen Bao Khanh 2 Philipp Doblhofer 2 Pedro Pinho 2 Mor Golan 2 rpgsec 2 Osvaldo Noe Gonzalez Del Rio (Os) 2 Afifudin Maarif 2 braintx 2 Raphael P. Cigana 2 Mike Gozdiskowski 2 Brobicho 2 Niv Kochan 2 Revanth Hari Narayana Matte 2 walid213 2 elaprendiz1927 1 Naiches 1 Saruul 1 Nawaf Althurwi (JailBr3ak) 1 aymen benlamari 1 TRAN THE LONG 1 mad4cyber 1 Phat RiO 1 c4st1e 1 Kevin Whelan 1 Sakri Koskimies 1 Muhamad Visat 1 Zein 1 Jiemook 1 Meher Sudhakar Abbireddi 1 Akshat Parikh 1 HieuPenguinnn 1 henise 1 Ronny Greenberg 1 Md. Moniruzzaman Prodhan (NomanProdhan) 1 Mark Moore 1 Khoa Dang 1 vta.itsec 1 whp-wessel 1 Aydan Arabadzha 1 Charles Vosburgh 1 r3foxx 1 h0xilo 1 tiborisaak 1 Kaan Özbek 1 Hayoso 1 Luke Eldridge 1 Pham Duc Anh 1 Jack Taylor 1 Naoya Takahashi (nakko) 1 Jorgson 1 cyberkareem 1 nguyen viet tin 1 Thaer Assfour 1 Xanlar Agamalizade 1 Ángel Santana 1 Nguyen Truong (Roll) 1 Phap Nguyen Anh 1 Amin Guliyev 1 clever 1 thevietronin 1 Krugov Artyom 1 Shivamani Vastrala 1 onecomputerguy 1 Animesh Gaurav 1 mak3bread 1 Shirshak 1 R4mbb 1 khado 1 Nhien Pham (nhienit) (nhienit) 1 gueco 1 dodoh4t 1 Ahmed Hassan 1 Zenith 1 ieuns 1 Romain Deperne 1 Kasia Sok 1 Muhammad Yudha - DJ 1 Andy Urlep 1 Morato Antoine 1 Nox Axter 1 Chamseddine Bouzaiene 1 Leonid Semenenko (lsemenenko) 1 John Ryan Albon 1 João Ramos Maciel 1 testoun 1 Adam Rayyan Aryasatya 1 Karthik 1 Skalucy 1 Md. Moniruzzaman Prodhan 1 kawagishi kouhei 1 Thomas Valadez 1 Denver Jackson 1 Abu Hurayra (HurayraIIT) 1 ashv4ni 1 Abdullah Kareem 1 SavPhill (Savphill) 1 Ryan Fabella 1 Karthik Ramakrishnan 1 Décio Brandão 1 Muni Nitish Kumar Yaddala (Stranger825) 1 Pedro Delgado 1 Ori Ashkenazi 1 @nacento 1 Peerapat Samatathanyakorn 1 Rully Miftahur Rozaq 1 hashiramasenju333 1 Trương Hữu Phúc 1 Saad.Codes 1 jtb75 1 Zahid Abbasi 1 minhgalaxy 1 Manopakorn Kooharueangrong (manop55555) 1 Theklis 1 afei 1 bamper1 1 Matan Bachar 1 bekitousei 1 ParkHyunWoo 1 Swayam Bhageria 1 Erik Debye 1 Sebastian Riveros 1 Chi Trung Huynh 1 Luke Eldridge (system) 1 Dick Snel 1 Jashid Sany 1 Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report. WordPress Plugins with Reported Vulnerabilities Last Week Software Name Software Slug Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning academy Aculect AI Companion aculect-ai-companion AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress acymailing Ad Inserter – Ad Manager & AdSense Ads ad-inserter Advanced Ads – Ad Manager & AdSense advanced-ads Advanced Partial Payment or Deposit for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce Advanced Post Manager advanced-post-manager Advanced Woo Labels – Product Labels & Badges for WooCommerce advanced-woo-labels AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo AI Engine – The Chatbot, AI Framework & MCP for WordPress ai-engine Airano MCP Bridge airano-mcp-bridge Ajax Search Pro ajax-search-pro All in One Files Upload for WooCommerce all-in-one-files-upload-for-woocommerce All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) all-in-one-seo-pack AllAble Connector allable-connector Alt Text AI – Automatically generate image alt text for SEO and accessibility alttext-ai Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint Appointment Hour Booking – Booking Calendar appointment-hour-booking Aruba Migration Tool aruba-wp-migration-tool Audio Player Block – Advanced Block for Embedding Audio Files audio-player-block Authorizer authorizer Autoptimize autoptimize Awesome Support – WordPress HelpDesk & Support Plugin awesome-support BA Book Everything ba-book-everything BackupEase – Scheduled Backup, Restore & Site Migration backupease BackupSheep WordPress Backup Plugin backupsheep bbp style pack bbp-style-pack BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) woo-bulk-editor Beaver Builder Page Builder – Drag and Drop Website Builder beaver-builder-lite-version BlockStrap Page Builder – Bootstrap Blocks blockstrap-page-builder-blocks Bold Page Builder bold-page-builder Booking Activities booking-activities Booking Calendar booking Books Gallery – Book Showcase, Library & Affiliate Plugin wp-books-gallery Branda – White Label & Branding, Free Login Page Customizer branda-white-labeling Broken Link Notifier broken-link-notifier BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) burst-statistics Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation Business Directory Plugin – Easy Listing & Member Directories for WordPress business-directory-plugin Business Essentials for Contact Form 7 cf7-redirect-thank-you-page ByteCoreStack – MCP Connector for AI Tools bcs-mcp-manager Cache Enabler cache-enabler Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More calculated-fields-form Captivate Sync captivatesync-trade CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 contact-form-7-honeypot CF7 Views – Complete Entry Management for Contact Form 7 cf7-views Classified Listing – AI-Powered Classified ads & Business Directory classified-listing CMB2 cmb2 CMP – Coming Soon & Maintenance Plugin by NiteoThemes cmp-coming-soon-maintenance CoCart – Headless REST API for WooCommerce cart-rest-api-for-woocommerce Connections Business Directory connections Content Egg – Affiliate Product Importer & Price Comparison content-egg ConvertPlus convertplug Cool FormKit Lite – Advanced Form Builder for Elementor extensions-for-elementor-form Cost Calculator Builder cost-calculator-builder Cost of Goods: Product Cost & Profit Calculator for WooCommerce cost-of-goods-for-woocommerce Course Booking System course-booking-system Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates cozy-addons Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators creatorlms CTX Feed Pro webappick-product-feed-for-woocommerce-pro CURCY – Multi Currency for WooCommerce woo-multi-currency Customer Reviews for WooCommerce customer-reviews-woocommerce Deema Payment Gateway deema-payment-gateway DesignSetGo designsetgo DevKit Pro devkit Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts Divi Membership divi-membership DoFollow Case by Case dofollow-case-by-case Download Manager downloadmanager Download Manager download-manager Download Monitor download-monitor Duplicate Post copy-delete-posts Easy Google Maps google-maps-easy Easy PayPal & Stripe Buy Now Button wp-ecommerce-paypal eCommerce Product Catalog ecommerce-product-catalog ECPay Ecommerce for WooCommerce ecpay-ecommerce-for-woocommerce EduAdmin Booking eduadmin-booking elegro Crypto Payment elegro-payment ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor elementskit-lite EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents embedpress ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce erp Essential Addons for Elementor – Popular Elementor Templates & Widgets essential-addons-for-elementor-lite Event Tickets and Registration event-tickets Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI everest-forms EWWW Image Optimizer ewww-image-optimizer Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export wp-ultimate-exporter Extendify extendify Extra Product Options For WooCommerce | Custom Product Addons and Fields woo-extra-product-options Faktur Pro for WooCommerce woorechnung Fast Courier – Shipping & Freight fast-courier-shipping-freight Featured Image from URL (FIFU) featured-image-from-url File Media Renamer file-media-renamer File Uploads Addon for WooCommerce woo-addon-uploads Five Star Business Profile and Schema business-profile Five Star Restaurant Reservations – WordPress Booking Plugin restaurant-reservations Five Star Restaurant Reviews good-reviews-wp Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce flexible-coupons Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder fluentform FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration fluent-boards FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler fluent-cart Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder form-maker FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More formgent Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator Frontend File Manager Plugin nmedia-user-file-uploader Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms frontend-post-submission-manager-lite GD Rating System gd-rating-system Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 Geo Mashup geo-mashup GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers rafflepress Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce GravityExport Lite for Gravity Forms gf-entries-in-excel Greenshift – animation and page builder blocks greenshift-animation-and-page-builder-blocks Groundhogg — CRM, Newsletters, and Marketing Automation groundhogg GSpeech TTS – WordPress Text To Speech Plugin gspeech Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns essential-blocks HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates happy-elementor-addons hCaptcha for WP hcaptcha-for-forms-and-more Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce Hide Shipping Method For WooCommerce hide-shipping-method-for-woocommerce Horizontal scrolling announcements horizontal-scrolling-announcements Hostinger Migrator migrator-plugin Hostinger Reach – AI-Powered Email Marketing for WordPress hostinger-reach HT Contact Form – Drag & Drop Form Builder for WordPress ht-contactform HT Mega Addons for Elementor – Elementor Widgets & Template Builder ht-mega-for-elementor Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT hyve-lite IATO MCP iato-mcp Icegram Engage – Popups, Optins, CTAs & Lead Generation icegram If-So Dynamic Content – Elementor & All Page Builders Personalization if-so Image Optimizer image-optimizer InPost PL inpost-for-woocommerce Iptanus File Upload wp-file-upload Issues and Series for Newspapers, Magazines, Publishers, Writers organize-series Ivory Search – WordPress Search Plugin add-search-to-menu Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress jeg-elementor-kit JetAppointment jet-appointments-booking JetBlog jet-blog JetEngine jet-engine JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder JetReviews jet-reviews JNews - Pay Writer jnews-pay-writer JSON API Auth json-api-auth JW Player for WordPress jw-player-7-for-wp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor kadence-blocks King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder king-addons Kirki – Freeform Page Builder, Website Builder & Customizer kirki Kognetiks Chatbot chatbot-chatgpt Kubio AI Page Builder kubio LA-Studio Element Kit for Elementor lastudio-element-kit LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress Listdom: AI-powered Business Directory with Classifieds Ads Listings listdom Loco Translate loco-translate Lookzy LookBook for WooCommerce woo-lookbook Magic Tooltips For Contact Form 7 magic-tooltips-for-contact-form-7 Mail logging & Catcher wp-mail-catcher Mailchimp for WooCommerce mailchimp-for-woocommerce Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin majestic-support MakeCommerce for WooCommerce makecommerce Mang Board mangboard MaxGalleria maxgalleria MCP Content Manager Lite mcp-content-manager-lite Media Library Assistant media-library-assistant Media Library Organizer – Folders, File Manager & Media Categories media-library-organizer Memberful – Membership Plugin memberful-wp MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor metform Mindio Magic MCP mindio-magic-mcp Minimum and Maximum Quantity for WooCommerce min-and-max-quantity-for-woocommerce Mooberry Book Manager mooberry-book-manager Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO multiple-pages-generator-by-porthas MStore API – Create Native Android & iOS Apps On The Cloud mstore-api MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor Music Player for WooCommerce music-player-for-woocommerce MW WP Form mw-wp-form Nelio Content – Editorial Calendar & Social Media Auto-Posting nelio-content Nested Pages wp-nested-pages New User Approve new-user-approve Newsletter – Send awesome emails from WordPress newsletter Newsletters, Email Marketing, SMS and Popups by Omnisend omnisend NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder Ninja Forms - File Uploads ninja-forms-uploads Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder ninja-forms No External Links mihdan-no-external-links Notification for Telegram notification-for-telegram Notivo Notification for WooCommerce woo-notification OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook Ohio Extra ohio-extra oik oik OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. host-webfonts-local Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE otter-blocks Page Builder by SiteOrigin siteorigin-panels Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress wp-user-avatar Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions Parallax Section Block – Add Parallax Scrolling Effects to Sections parallax-section Pay with Vipps and MobilePay for WooCommerce woo-vipps Payflex Payment Gateway payflex-payment-gateway Payments for Hubtel payments-hubtel Paytm Payment Gateway paytm-payments PDF for Contact Form 7 + Drag and Drop Template Builder pdf-for-contact-form-7 PDF Invoices & Packing Slips for WooCommerce woocommerce-pdf-invoices-packing-slips PDF Smart Viewer for Elementor pdf-smart-viewer-for-elementor Persistent Login wp-persistent-login Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery Photo Gallery – Responsive Image Galleries by Supsystic gallery-by-supsystic Photo Reviews for WooCommerce woo-photo-reviews Photonic Gallery & Lightbox for Flickr, SmugMug & Others photonic Pie Register – User Registration, Profiles & Content Restriction pie-register Pixfort Core pixfort-core Polylang polylang Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More popup-maker-wp Post and Page Builder by BoldGrid – Visual Drag and Drop Editor post-and-page-builder Post Views Stats Counter post-views-stats-counter Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates premium-addons-for-elementor Premmerce Permalink Manager for WooCommerce woo-permalink-manager Premmerce Wishlist for WooCommerce premmerce-woocommerce-wishlist Prevent Files / Folders Access prevent-file-access Pricing Table WordPress Plugin – Easy Pricing Tables easy-pricing-tables Prime Mover – Backup and Migration prime-mover Pro Like Button prolike-button Product Designer App product-designer-app Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce woo-product-feed-pro ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities Progress Planner progress-planner Progressify – All-in-One Progressive Web App (PWA) progressify Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker wedevs-project-manager Qi Addons For Elementor qi-addons-for-elementor Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker quiz-master-next Quiz Cat – WordPress Quiz Plugin quiz-cat Razorpay for WooCommerce woo-razorpay Razorpay Payment Links for WooCommerce rzp-woocommerce ReactPress – Create React App for WordPress reactpress Real Cookie Banner: GDPR & ePrivacy Cookie Consent real-cookie-banner Real Estate Manager – Property Listing and Agent Management real-estate-manager Redux Framework redux-framework Relevanssi Premium relevanssi-premium Relevanssi – A Better Search relevanssi RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress computer-repair-shop Request a Quote – Quote Forms for Any WordPress Site request-a-quote Responsive Slider Gallery – Responsive Image Photo Slider responsive-slider-gallery Responsive Starter Templates – Elementor Templates & Starter Sites responsive-add-ons REST API Log wp-rest-api-log Rich Showcase for Google Reviews widget-google-reviews Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF robin-image-optimizer Safe Redirect Manager safe-redirect-manager Salon Booking System – Appointment Booking for Salons, Barbershops & Spas salon-booking-system SaveTo Wishlist Lite – WooCommerce Wishlist saveto-wishlist-lite-for-woocommerce Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO review-schema Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more scratch-win-giveaways-for-website-facebook Search in Place search-in-place SEOPress – AI SEO Plugin & On-site SEO wp-seopress Sermon'e sermone ShopBuilder – WooCommerce Builder For Elementor shopbuilder Simple Event Planner simple-event-planner Simple Membership simple-membership Simple Payment simple-payment Simple Shopping Cart wordpress-simple-paypal-shopping-cart Simply Schedule Appointments simply-schedule-appointments Site Reviews site-reviews SiteOrigin Widgets Bundle so-widgets-bundle SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP siteskite Slider Pro slider-pro-wp Smart Forms – when you need more than just a contact form smart-forms Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) smart-manager-for-wp-e-commerce Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup Smart Popup by Supsystic popup-by-supsystic Smart Slider 3 smart-slider-3 SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more wc-ukr-shipping Smash Balloon Social Post Feed – Simple Social Feeds for WordPress custom-facebook-feed Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more social-boost Social Media Share Buttons & Social Sharing Icons ultimate-social-media-icons Social Sharing Plugin – Sassy Social Share sassy-social-share Solace Extra solace-extra StifLi Backup Tools stifli-backup-tools Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions wp-full-stripe-free Strong Testimonials strong-testimonials SUMO Affiliates Pro affs Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers sunshine-photo-cart Super Forms – Drag & Drop Form Builder super-forms SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent supportcandy Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder supreme-modules-for-divi Tabs Responsive – With WooCommerce Product Tabs Extension tabs-responsive tagDiv Opt-In Builder td-subscription Taskbuilder – Project Management & Task Management Tool With Kanban Board taskbuilder The Events Calendar the-events-calendar ThemeREX Addons trx_addons Themify Builder themify-builder TillKit tillkit Timetics – Appointment Booking Calendar & Scheduling timetics Total Donations totaldonations TranslatePress – Translate Multilingual sites with AI Translation translatepress-multilingual Transliterator – Multilingual and Multi-script Text Conversion serbian-transliteration Travelly – Tour & Travel Booking Manager for WooCommerce tour-booking-manager Trusted Shops Easy Integration for WooCommerce trusted-shops-easy-integration-for-woocommerce Twenty20 Image Before-After twenty20 Two Factor two-factor Ultimate Maps by Supsystic ultimate-maps-by-supsystic Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform ultimate-multisite Ultra Addons Lite for Elementor ut-elementor-addons-lite Unlimited Elements for Elementor unlimited-elements-for-elementor UPI QR Code Payment Gateway upi-qr-code-payment-gateway UpSolution Core us-core User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission wp-user-frontend User Private Files – Secure File Sharing and Client Portal Plugin user-private-files User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder user-registration User Submitted Posts – Enable Users to Submit Posts from the Front End user-submitted-posts UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP userswp Verge3D Publishing and E-Commerce verge3d Viable URL Media Uploader viable-url-media-uploader VikAppointments Services Booking Calendar vikappointments VikBooking Hotel Booking Engine & PMS vikbooking Virtue/Ascend/Pinnacle Toolkit virtue-toolkit Visitor Traffic Real Time Statistics visitors-traffic-real-time-statistics Visitor Traffic Real Time Statistics pro visitors-traffic-real-time-statistics-pro Visual Composer Website Builder visualcomposer Vitepos – Point of Sale (POS) for WooCommerce vitepos-lite VK Google Job Posting Manager vk-google-job-posting-manager W3 Total Cache w3-total-cache WDS MCP Content Manager wds-mcp-content-manager WEBO MCP webo-mcp WebSamurai websamurai WebToffee Gift Cards for WooCommerce wt-gift-cards-woocommerce WebToffee WP Backup and Migration wp-migration-duplicator Welcart e-Commerce usc-e-shop WooCommerce Appointments woocommerce-appointments WooCommerce Designer Pro wc-designer-pro WooCommerce Lottery wc-lottery WP 2FA – Two-factor authentication for WordPress wp-2fa WP Activity Log wp-security-audit-log WP BASE Booking of Appointments, Services and Events wp-base-booking-of-appointments-services-and-events WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps wp-data-access WP Directory Kit wpdirectorykit WP Express Checkout (Fast Payments via PayPal & Stripe) wp-express-checkout WP Fusion Lite – Marketing Automation and CRM Integration for WordPress wp-fusion-lite WP Mail Logging wp-mail-logging WP Media folder wp-media-folder WP Mobile Menu – The Mobile-Friendly Responsive Menu mobile-menu WP OAuth Server (OAuth Authentication) oauth2-provider WP Photo Album Plus wp-photo-album-plus WP Popular Posts wordpress-popular-posts Wp Social Login and Register Social Counter wp-social WP Spell Check wp-spell-check WP Statistics – Simple, privacy-friendly Google Analytics alternative wp-statistics WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export wp-ultimate-csv-importer WP Ultimate Review wp-ultimate-review WP User Frontend Pro wp-user-frontend-pro WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory wp-user-manager WP Visitor Statistics (Real Time Traffic) wp-stats-manager WPBot – ChatBot Conversational Forms conversational-forms WPC Estimated Delivery Date for WooCommerce wpc-estimated-delivery-date WPC Product Options for WooCommerce wpc-product-options WPC Shop as a Customer for WooCommerce wpc-shop-as-customer WPC Smart Quick View for WooCommerce woo-smart-quick-view WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System wp-cafe WPEPP – Essential Security, Password Protect & Login Page Customizer wp-edit-password-protected WPFront Notification Bar wpfront-notification-bar WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell wpfunnels WPML Multilingual & Multicurrency for WooCommerce woocommerce-multilingual WPMobile.App – Android and iOS App Builder wpappninja WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons social-icons-widget-by-wpzoom YayReviews – Advanced Customer Reviews for WooCommerce yay-customer-reviews-woocommerce YITH WooCommerce Tab Manager yith-woocommerce-tab-manager Zombify zombify 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 pgall-for-woocommerce WordPress Themes with Reported Vulnerabilities Last Week Software Name Software Slug Astra astra Avada | Website Builder For WordPress & WooCommerce Avada Betheme betheme Grand Restaurant WordPress grandrestaurant Haaken - Fashion Store WordPress Theme haaken Vayu X vayu-x Virtue Premium virtue_premium Wallstreet wallstreet zella-theme zella-theme Vulnerability Details Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize. AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-94389 Patch Status Patched Published Sep 30, 2026 Affected Software AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing] Researcher rpgsec More Details > DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-14378 Patch Status Patched Published Oct 1, 2026 Affected Software DevKit Pro [devkit] Researcher h0xilo More Details > Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-19652 Patch Status Patched Published Oct 1, 2026 Affected Software Divi Membership [divi-membership] Researcher 0xd4rk5id3 More Details > Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-19660 Patch Status Patched Published Oct 1, 2026 Affected Software Divi Membership [divi-membership] Researcher 0xd4rk5id3 More Details > JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-97637 Patch Status Patched Published Oct 1, 2026 Affected Software JSON API Auth [json-api-auth] Researcher Chi Trung Huynh More Details > Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-103065 Patch Status Patched Published Oct 1, 2026 Affected Software Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] Researcher Dthangws More Details > Kognetiks Chatbot <= 2.4.9 - Unauthenticated Arbitrary File Upload 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-32579 Patch Status Unpatched Published Oct 4, 2026 Affected Software Kognetiks Chatbot [chatbot-chatgpt] Researcher Nguyen Dinh Hai (HaiND) More Details > SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.8 - Unauthenticated Remote Code Execution 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-96349 Patch Status Patched Published Sep 29, 2026 Affected Software SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP [siteskite] Researcher Ananda Dhakal More Details > Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-15989 Patch Status Patched Published Sep 30, 2026 Affected Software Super Forms – Drag & Drop Form Builder [super-forms] Researcher d.v4n_s3c More Details > Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-75957 Patch Status Patched Published Sep 30, 2026 Affected Software Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform [ultimate-multisite] Researcher zickzick2 More Details > WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-94541 Patch Status Patched Published Oct 1, 2026 Affected Software WPMobile.App – Android and iOS App Builder [wpappninja] Researcher Supakiad S. (m3ez) More Details > Zella <= 2.6.2 - Unauthenticated Arbitrary File Upload 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-75873 Patch Status Patched Published Sep 28, 2026 Affected Software zella-theme [zella-theme] Researcher Mike Gozdiskowski More Details > Zombify <= 1.7.7 - Unauthenticated Arbitrary File Upload 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-94503 Patch Status Unpatched Published Oct 4, 2026 Affected Software Zombify [zombify] Researcher Phat RiO More Details > AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-95588 Patch Status Patched Published Oct 1, 2026 Affected Software AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing] Researcher Oly Hossen More Details > Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-92966 Patch Status Patched Published Sep 30, 2026 Affected Software Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] Researcher hashiramasenju333 More Details > BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-101148 Patch Status Unpatched Published Sep 29, 2026 Affected Software BackupSheep WordPress Backup Plugin [backupsheep] Researchers Enrico MarcoliniClaudio MarchesiniDottor Marc More Details > Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-92084 Patch Status Patched Published Oct 2, 2026 Affected Software Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version] Researcher OKISO More Details > Cache Enabler <= 1.8.16 - Unauthenticated Arbitrary File and Directory Deletion 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-19253 Patch Status Patched Published Sep 29, 2026 Affected Software Cache Enabler [cache-enabler] Researcher Jakub Herman More Details > Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-15896 Patch Status Patched Published Oct 1, 2026 Affected Software Super Forms – Drag & Drop Form Builder [super-forms] Researcher afei More Details > VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter 9.1 CVSS Rating 9.1 (Critical) CVE-ID CVE-2026-87115 Patch Status Patched Published Oct 2, 2026 Affected Software VikAppointments Services Booking Calendar [vikappointments] Researcher zickzick2 More Details > ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-19807 Patch Status Patched Published Sep 30, 2026 Affected Software ByteCoreStack – MCP Connector for AI Tools [bcs-mcp-manager] Researcher Décio Brandão More Details > CoCart 4.9.0 - 4.9.6 - Cross-Site Request Forgery to Privilege Escalation 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-93549 Patch Status Patched Published Oct 2, 2026 Affected Software CoCart – Headless REST API for WooCommerce [cart-rest-api-for-woocommerce] Researcher Naoki Kawahigashi More Details > ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-87741 Patch Status Patched Published Sep 28, 2026 Affected Software ConvertPlus [convertplug] Researcher Rafie Muhammad More Details > Featured Image from URL (FIFU) Free & Premium <= 6.0.7 - Cross-Site Request Forgery 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-101147 Patch Status Patched Published Sep 29, 2026 Affected Software Featured Image from URL (FIFU) [featured-image-from-url] Researchers Enrico MarcoliniClaudio MarchesiniDottor Marc More Details > Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-97644 Patch Status Patched Published Oct 2, 2026 Affected Software Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg] Researcher Supakiad S. (m3ez) More Details > Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-92536 Patch Status Patched Published Oct 2, 2026 Affected Software Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar] Researcher Jakub Herman More Details > Prime Mover – Backup and Migration <= 2.2.0 - Authenticated (Admin+) Arbitrary File Upload 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-101888 Patch Status Patched Published Oct 1, 2026 Affected Software Prime Mover – Backup and Migration [prime-mover] Researcher Sarvar Eshboyev More Details > Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-18443 Patch Status Patched Published Oct 2, 2026 Affected Software Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) [smart-manager-for-wp-e-commerce] Researcher lhking More Details > Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-15897 Patch Status Patched Published Oct 1, 2026 Affected Software Super Forms – Drag & Drop Form Builder [super-forms] Researcher d.v4n_s3c More Details > WooCommerce Designer Pro <= 1.9.33 - Authenticated (Subscriber+) Remote Code Execution 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-32568 Patch Status Unpatched Published Oct 4, 2026 Affected Software WooCommerce Designer Pro [wc-designer-pro] Researcher Nguyen Ba Khanh More Details > WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint 8.8 CVSS Rating 8.8 (High) CVE-ID CVE-2026-95687 Patch Status Patched Published Sep 30, 2026 Affected Software WPC Shop as a Customer for WooCommerce [wpc-shop-as-customer] Researcher clever More Details > Booking Activities <= 1.18.7.1 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-97248 Patch Status Patched Published Sep 28, 2026 Affected Software Booking Activities [booking-activities] Researcher Supakiad S. More Details > Haaken <= 1.5 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-104747 Patch Status Patched Published Oct 4, 2026 Affected Software Haaken - Fashion Store WordPress Theme [haaken] Researcher Denver Jackson More Details > Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-94505 Patch Status Patched Published Oct 2, 2026 Affected Software Nelio Content – Editorial Calendar & Social Media Auto-Posting [nelio-content] Researcher Wordfence PRISM More Details > Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-92820 Patch Status Patched Published Oct 1, 2026 Affected Software Ninja Forms - File Uploads [ninja-forms-uploads] Researcher daroo More Details > Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-101923 Patch Status Patched Published Oct 2, 2026 Affected Software Photo Reviews for WooCommerce [woo-photo-reviews] Researcher Ivaylo More Details > Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-15983 Patch Status Patched Published Sep 30, 2026 Affected Software Super Forms – Drag & Drop Form Builder [super-forms] Researcher d.v4n_s3c More Details > The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-95606 Patch Status Patched Published Oct 2, 2026 Affected Software The Events Calendar [the-events-calendar] Researcher Naoya Takahashi (nakko) More Details > WEBO MCP <= 3.0.18 - Authenticated (Author+) Arbitrary File Deletion 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-97242 Patch Status Patched Published Sep 29, 2026 Affected Software WEBO MCP [webo-mcp] Researcher Ananda Dhakal More Details > Advanced Post Manager <= 4.5.5 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-97283 Patch Status Patched Published Oct 3, 2026 Affected Software Advanced Post Manager [advanced-post-manager] Researcher Peter Tang More Details > Ajax Search Pro <= 4.29.1 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-96331 Patch Status Patched Published Oct 3, 2026 Affected Software Ajax Search Pro [ajax-search-pro] Researcher Rafie Muhammad More Details > Books Gallery – Book Showcase, Library & Affiliate Plugin <= 4.8.3 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-96822 Patch Status Patched Published Sep 29, 2026 Affected Software Books Gallery – Book Showcase, Library & Affiliate Plugin [wp-books-gallery] Researcher sungbyeongchan More Details > DesignSetGo <= 2.8.0 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-94683 Patch Status Patched Published Sep 28, 2026 Affected Software DesignSetGo [designsetgo] Researcher Ananda Dhakal More Details > eCommerce Product Catalog <= 3.6.0 - Authenticated (Custom Role+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-96344 Patch Status Patched Published Sep 28, 2026 Affected Software eCommerce Product Catalog [ecommerce-product-catalog] Researcher Ananda Dhakal More Details > EduAdmin Booking < 6.0.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-96809 Patch Status Patched Published Oct 3, 2026 Affected Software EduAdmin Booking [eduadmin-booking] Researcher Seongwon Lee More Details > ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Custom Role+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-96343 Patch Status Patched Published Sep 28, 2026 Affected Software ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp] Researcher Ananda Dhakal More Details > EWWW Image Optimizer 8.6.0 - 8.7.7 - Authenticated (Author+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-91051 Patch Status Patched Published Sep 28, 2026 Affected Software EWWW Image Optimizer [ewww-image-optimizer] Researcher Karthik More Details > Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export <= 3.0 - Authenticated (Custom Role+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-103348 Patch Status Patched Published Oct 3, 2026 Affected Software Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export [wp-ultimate-exporter] Researcher Ananda Dhakal More Details > Generate PDF using Contact Form 7 <= 4.2.1 - Unauthenticated Arbitrary File Read 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-94666 Patch Status Patched Published Oct 4, 2026 Affected Software Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7] Researcher Eunho Kim More Details > GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-103913 Patch Status Patched Published Oct 2, 2026 Affected Software GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] Researcher OKISO More Details > Icegram Engage – Popups, Optins, CTAs & Lead Generation <= 3.1.31 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-97284 Patch Status Patched Published Oct 1, 2026 Affected Software Icegram Engage – Popups, Optins, CTAs & Lead Generation [icegram] Researcher Ananda Dhakal More Details > Iptanus File Upload <= 5.1.10 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-62071 Patch Status Patched Published Oct 1, 2026 Affected Software Iptanus File Upload [wp-file-upload] Researcher Andy Urlep More Details > JNews - Pay Writer <= 12.0.1 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-96328 Patch Status Patched Published Oct 3, 2026 Affected Software JNews - Pay Writer [jnews-pay-writer] Researcher Rafie Muhammad More Details > LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-93882 Patch Status Patched Published Sep 30, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher Khoa Dang More Details > Minimum and Maximum Quantity for WooCommerce <= 2.1.2 - Authenticated (Author+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-93651 Patch Status Patched Published Sep 28, 2026 Affected Software Minimum and Maximum Quantity for WooCommerce [min-and-max-quantity-for-woocommerce] Researcher Ananda Dhakal More Details > Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-6806 Patch Status Patched Published Sep 29, 2026 Affected Software Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings] Researcher Leonid Semenenko (lsemenenko) More Details > Nested Pages <= 3.3.2 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-100512 Patch Status Patched Published Sep 30, 2026 Affected Software Nested Pages [wp-nested-pages] Researcher Ananda Dhakal More Details > OMGF <= 6.3.10 - Denial of Service to Unauthenticated Site Availability Exhaustion 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-91828 Patch Status Patched Published Sep 29, 2026 Affected Software OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. [host-webfonts-local] Researcher Ángel Santana More Details > Paytm Payment Gateway <= 2.8.8 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-81809 Patch Status Patched Published Sep 29, 2026 Affected Software Paytm Payment Gateway [paytm-payments] Researcher Erwan LR More Details > PDF for Contact Form 7 + Drag and Drop Template Builder <= 7.1.0 - Unauthenticated Arbitrary File Read 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-94664 Patch Status Patched Published Oct 4, 2026 Affected Software PDF for Contact Form 7 + Drag and Drop Template Builder [pdf-for-contact-form-7] Researcher Eunho Kim More Details > Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-102377 Patch Status Patched Published Sep 30, 2026 Affected Software Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery] Researcher Ananda Dhakal More Details > Pro Like Button <= 1.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-89296 Patch Status Patched Published Sep 29, 2026 Affected Software Pro Like Button [prolike-button] Researcher Enrico Marcolini More Details > Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-75098 Patch Status Unpatched Published Sep 29, 2026 Affected Software Product Designer App [product-designer-app] Researcher Sebastian Albrecht (mySebbe) More Details > SaveTo Wishlist Lite <= 1.1.4 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-89236 Patch Status Patched Published Oct 1, 2026 Affected Software SaveTo Wishlist Lite – WooCommerce Wishlist [saveto-wishlist-lite-for-woocommerce] Researcher Naoki Kawahigashi More Details > Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-97291 Patch Status Patched Published Sep 30, 2026 Affected Software Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] Researcher Ananda Dhakal More Details > Simple Event Planner <= 1.5.7 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-97257 Patch Status Patched Published Oct 3, 2026 Affected Software Simple Event Planner [simple-event-planner] Researcher Ananda Dhakal More Details > Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-97337 Patch Status Patched Published Oct 2, 2026 Affected Software Simple Membership [simple-membership] Researcher Kuba More Details > Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-89294 Patch Status Patched Published Sep 29, 2026 Affected Software Simply Schedule Appointments [simply-schedule-appointments] Researcher crow More Details > Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-92245 Patch Status Patched Published Sep 30, 2026 Affected Software Simply Schedule Appointments [simply-schedule-appointments] Researcher Md. Moniruzzaman Prodhan (NomanProdhan) More Details > SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-92174 Patch Status Patched Published Oct 1, 2026 Affected Software SiteOrigin Widgets Bundle [so-widgets-bundle] Researcher kiemtiendinhau More Details > Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.1 - Authenticated (Custom Role+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-93617 Patch Status Patched Published Oct 3, 2026 Affected Software Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart] Researcher Ananda Dhakal More Details > tagDiv Opt-In Builder <= 1.7.6 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-96330 Patch Status Patched Published Oct 3, 2026 Affected Software tagDiv Opt-In Builder [td-subscription] Researcher Rafie Muhammad More Details > Themify Builder <= 7.8.1 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-96831 Patch Status Patched Published Sep 28, 2026 Affected Software Themify Builder [themify-builder] Researcher Ananda Dhakal More Details > Two Factor <= 0.16.0 - Unauthenticated Denial of Service 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-100508 Patch Status Patched Published Sep 30, 2026 Affected Software Two Factor [two-factor] Researcher Ananda Dhakal More Details > Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-93428 Patch Status Patched Published Oct 2, 2026 Affected Software Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] Researcher Mutantgun More Details > Unlimited Elements for Elementor <= 2.0.19 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-95534 Patch Status Patched Published Oct 2, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher Ayukiab More Details > Unlimited Elements for Elementor <= 2.0.20 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-103355 Patch Status Patched Published Oct 2, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher b1ue0cean More Details > Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-85568 Patch Status Patched Published Oct 1, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher Jakub Herman More Details > VK Google Job Posting Manager <= 1.3.1 - Authenticated (Contributor+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-100511 Patch Status Patched Published Oct 3, 2026 Affected Software VK Google Job Posting Manager [vk-google-job-posting-manager] Researcher Ananda Dhakal More Details > WooCommerce Appointments <= 5.3.2 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-32557 Patch Status Unpatched Published Oct 4, 2026 Affected Software WooCommerce Appointments [woocommerce-appointments] Researcher Nguyen Ba Khanh More Details > WooCommerce Lottery <= 2.2.9 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-32580 Patch Status Unpatched Published Oct 4, 2026 Affected Software WooCommerce Lottery [wc-lottery] Researcher dutafi More Details > WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-103352 Patch Status Patched Published Oct 3, 2026 Affected Software WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events] Researcher Khanh Nguyen More Details > WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.82 - Unauthenticated SQL Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-95605 Patch Status Patched Published Oct 2, 2026 Affected Software WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps [wp-data-access] Researcher neurotx More Details > WP Spell Check <= 12.1 - Authenticated (Author+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-100506 Patch Status Patched Published Oct 3, 2026 Affected Software WP Spell Check [wp-spell-check] Researcher Ananda Dhakal More Details > WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-96267 Patch Status Patched Published Oct 2, 2026 Affected Software WP Visitor Statistics (Real Time Traffic) [wp-stats-manager] Researcher Nox Axter More Details > WPBot – ChatBot Conversational Forms <= 1.5.0 - Authenticated (Subscriber+) PHP Object Injection 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-95531 Patch Status Patched Published Sep 29, 2026 Affected Software WPBot – ChatBot Conversational Forms [conversational-forms] Researcher Ananda Dhakal More Details > WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-75028 Patch Status Patched Published Oct 2, 2026 Affected Software WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe] Researcher Wordfence PRISM More Details > Aculect AI Companion <= 0.8.2 - Missing Authorization to Unauthorized Redirects 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-39600 Patch Status Unpatched Published Oct 2, 2026 Affected Software Aculect AI Companion [aculect-ai-companion] Researcher Ananda Dhakal More Details > Authorizer <= 3.15.3 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-103752 Patch Status Patched Published Oct 1, 2026 Affected Software Authorizer [authorizer] Researcher Raphael P. Cigana More Details > FluentCart <= 1.6.4 - Unauthenticated Unauthorized Customer Account Access 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-100143 Patch Status Patched Published Sep 28, 2026 Affected Software FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler [fluent-cart] Researcher Mutantgun More Details > hCaptcha for WP <= 5.3.0 - Unauthenticated Captcha Verification Bypass 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-103347 Patch Status Patched Published Oct 1, 2026 Affected Software hCaptcha for WP [hcaptcha-for-forms-and-more] Researcher bamper1 More Details > User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-75823 Patch Status Patched Published Sep 28, 2026 Affected Software User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend] Researcher Murad Akhmedov More Details > WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.20 - Unauthenticated Privilege Escalation 7.3 CVSS Rating 7.3 (High) CVE-ID CVE-2026-103085 Patch Status Patched Published Oct 3, 2026 Affected Software WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] Researcher Pedro Delgado More Details > AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96561 Patch Status Patched Published Sep 30, 2026 Affected Software AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine] Researcher whale120 More Details > All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-85573 Patch Status Patched Published Sep 28, 2026 Affected Software All in One Files Upload for WooCommerce [all-in-one-files-upload-for-woocommerce] Researcher Mike Gozdiskowski More Details > Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96573 Patch Status Patched Published Sep 30, 2026 Affected Software Appointment Hour Booking – Booking Calendar [appointment-hour-booking] Researcher Hayoso More Details > Astra <= 4.13.12 - Authenticated (Shop Manager+) Arbitrary CSS Injection 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-27085 Patch Status Patched Published Sep 30, 2026 Affected Software Astra [astra] Researcher SavPhill (Savphill) More Details > Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-14995 Patch Status Patched Published Sep 30, 2026 Affected Software Autoptimize [autoptimize] Researcher lhking More Details > BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-102565 Patch Status Patched Published Oct 1, 2026 Affected Software BA Book Everything [ba-book-everything] Researcher crow More Details > Betheme <= 28.5.8 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94415 Patch Status Unpatched Published Oct 3, 2026 Affected Software Betheme [betheme] Researcher Rafie Muhammad More Details > BlockStrap Page Builder – Bootstrap Blocks <= 0.1.58 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94632 Patch Status Patched Published Oct 3, 2026 Affected Software BlockStrap Page Builder – Bootstrap Blocks [blockstrap-page-builder-blocks] Researcher nguyen viet tin More Details > Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated Server-Side Request Forgery 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97316 Patch Status Patched Published Sep 28, 2026 Affected Software Broken Link Notifier [broken-link-notifier] Researcher Amin Guliyev More Details > Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97661 Patch Status Patched Published Sep 30, 2026 Affected Software Business Essentials for Contact Form 7 [cf7-redirect-thank-you-page] Researcher Adrien Brunner More Details > Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96351 Patch Status Patched Published Sep 28, 2026 Affected Software Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing] Researcher Manopakorn Kooharueangrong (manop55555) More Details > CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97336 Patch Status Patched Published Oct 1, 2026 Affected Software CMB2 [cmb2] Researcher Ivaylo More Details > CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-102772 Patch Status Patched Published Oct 1, 2026 Affected Software CMB2 [cmb2] Researcher Kuba More Details > CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-10026 Patch Status Unpatched Published Oct 1, 2026 Affected Software CTX Feed Pro [webappick-product-feed-for-woocommerce-pro] Researchers Nguyen Truong (Roll)Phap Nguyen Anh More Details > CURCY – Multi Currency for WooCommerce 2.2.18 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94171 Patch Status Unpatched Published Sep 30, 2026 Affected Software CURCY – Multi Currency for WooCommerce [woo-multi-currency] Researcher Luke Eldridge More Details > Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97663 Patch Status Patched Published Oct 1, 2026 Affected Software Customer Reviews for WooCommerce [customer-reviews-woocommerce] Researcher crow More Details > DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95817 Patch Status Patched Published Oct 1, 2026 Affected Software DoFollow Case by Case [dofollow-case-by-case] Researcher theviper17y More Details > Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-100182 Patch Status Patched Published Oct 1, 2026 Affected Software Download Monitor [download-monitor] Researcher whale120 More Details > Easy Google Maps <= 1.14.6 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-102395 Patch Status Patched Published Sep 30, 2026 Affected Software Easy Google Maps [google-maps-easy] Researcher neurotx More Details > Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-85679 Patch Status Patched Published Sep 30, 2026 Affected Software Extendify [extendify] Researcher Jack Taylor More Details > Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96813 Patch Status Patched Published Sep 30, 2026 Affected Software Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker] Researcher lhking More Details > Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-92144 Patch Status Patched Published Sep 30, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher Luke Eldridge (system) More Details > Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-85235 Patch Status Patched Published Sep 30, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher tiborisaak More Details > Frontend File Manager Plugin <= 23.6 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-32577 Patch Status Unpatched Published Oct 4, 2026 Affected Software Frontend File Manager Plugin [nmedia-user-file-uploader] Researcher Chamseddine Bouzaiene More Details > Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96649 Patch Status Patched Published Sep 29, 2026 Affected Software Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms [frontend-post-submission-manager-lite] Researcher Tarcísio Luchesi De Almeida Silva (Poystick) More Details > GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93430 Patch Status Patched Published Oct 2, 2026 Affected Software GD Rating System [gd-rating-system] Researcher R4mbb More Details > Geo Mashup <= 1.13.21 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97250 Patch Status Patched Published Sep 29, 2026 Affected Software Geo Mashup [geo-mashup] Researcher Asim Alshaya More Details > GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96578 Patch Status Patched Published Oct 1, 2026 Affected Software GSpeech TTS – WordPress Text To Speech Plugin [gspeech] Researcher theviper17y More Details > HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96326 Patch Status Patched Published Sep 28, 2026 Affected Software HT Contact Form – Drag & Drop Form Builder for WordPress [ht-contactform] Researcher Muhammad Yudha - DJ More Details > If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-100507 Patch Status Patched Published Sep 30, 2026 Affected Software If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so] Researcher Ananda Dhakal More Details > JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93875 Patch Status Patched Published Oct 1, 2026 Affected Software JetAppointment [jet-appointments-booking] Researcher Rafie Muhammad More Details > JetBlog <= 2.4.10 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94661 Patch Status Patched Published Oct 3, 2026 Affected Software JetBlog [jet-blog] Researcher nh4tvd More Details > JetEngine <= 3.8.15.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97265 Patch Status Patched Published Sep 30, 2026 Affected Software JetEngine [jet-engine] Researcher nh4tvd More Details > JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-102391 Patch Status Patched Published Sep 30, 2026 Affected Software JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] Researcher Intrudify More Details > JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97342 Patch Status Patched Published Oct 1, 2026 Affected Software JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] Researcher UKO More Details > JW Player for WordPress <= 2.3.11 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93512 Patch Status Patched Published Sep 29, 2026 Affected Software JW Player for WordPress [jw-player-7-for-wp] Researcher Ivaylo Atanassov More Details > Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-103354 Patch Status Patched Published Oct 2, 2026 Affected Software Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] Researcher vta.itsec More Details > Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-88783 Patch Status Patched Published Oct 1, 2026 Affected Software Kubio AI Page Builder [kubio] Researcher Jakub Herman More Details > Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass) 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-100107 Patch Status Patched Published Oct 1, 2026 Affected Software Kubio AI Page Builder [kubio] Researcher daroo More Details > Kubio AI Page Builder <= 2.9.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94167 Patch Status Unpatched Published Oct 4, 2026 Affected Software Kubio AI Page Builder [kubio] Researcher daroo More Details > Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-101928 Patch Status Patched Published Oct 2, 2026 Affected Software Magic Tooltips For Contact Form 7 [magic-tooltips-for-contact-form-7] Researcher Afifudin Maarif More Details > Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93889 Patch Status Patched Published Oct 2, 2026 Affected Software Mail logging & Catcher [wp-mail-catcher] Researcher Adrien Brunner More Details > Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96871 Patch Status Patched Published Oct 1, 2026 Affected Software Mang Board [mangboard] Researcher John Ryan Albon More Details > MaxGalleria <= 6.5.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97260 Patch Status Patched Published Oct 1, 2026 Affected Software MaxGalleria [maxgalleria] Researcher Ananda Dhakal More Details > Media Library Assistant <= 3.41 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95609 Patch Status Patched Published Oct 3, 2026 Affected Software Media Library Assistant [media-library-assistant] Researcher nh4tvd More Details > MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta) 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96567 Patch Status Patched Published Oct 1, 2026 Affected Software MW WP Form [mw-wp-form] Researcher Kuba More Details > Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96566 Patch Status Patched Published Oct 1, 2026 Affected Software Newsletter – Send awesome emails from WordPress [newsletter] Researcher crow More Details > Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-102385 Patch Status Patched Published Sep 30, 2026 Affected Software Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] Researcher Intrudify More Details > Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-90438 Patch Status Patched Published Oct 1, 2026 Affected Software Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] Researcher UKO More Details > No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95670 Patch Status Patched Published Oct 1, 2026 Affected Software No External Links [mihdan-no-external-links] Researcher Afifudin Maarif More Details > Notification for Telegram <= 3.5.2 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93514 Patch Status Patched Published Sep 28, 2026 Affected Software Notification for Telegram [notification-for-telegram] Researcher Ananda Dhakal More Details > Parallax Section Block – Add Parallax Scrolling Effects to Sections <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-102378 Patch Status Patched Published Oct 1, 2026 Affected Software Parallax Section Block – Add Parallax Scrolling Effects to Sections [parallax-section] Researcher Asim Alshaya More Details > Paytm Payment Gateway <= 2.8.8 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-81739 Patch Status Patched Published Sep 29, 2026 Affected Software Paytm Payment Gateway [paytm-payments] Researcher Artus KG More Details > PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-92244 Patch Status Patched Published Sep 30, 2026 Affected Software PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips] Researcher Kuba More Details > PDF Smart Viewer for Elementor <= 1.0.4 - Unauthenticated Server-Side Request Forgery 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-39719 Patch Status Unpatched Published Oct 4, 2026 Affected Software PDF Smart Viewer for Elementor [pdf-smart-viewer-for-elementor] Researcher ParkHyunWoo More Details > Persistent Login <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94081 Patch Status Patched Published Sep 30, 2026 Affected Software Persistent Login [wp-persistent-login] Researcher neurotx More Details > Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97290 Patch Status Patched Published Sep 30, 2026 Affected Software Photonic Gallery & Lightbox for Flickr, SmugMug & Others [photonic] Researcher neurotx More Details > Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.14 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-100510 Patch Status Patched Published Sep 30, 2026 Affected Software Post and Page Builder by BoldGrid – Visual Drag and Drop Editor [post-and-page-builder] Researcher Intrudify More Details > Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97347 Patch Status Unpatched Published Sep 29, 2026 Affected Software Post Views Stats Counter [post-views-stats-counter] Researcher Nawaf Althurwi (JailBr3ak) More Details > Premmerce Permalink Manager for WooCommerce <= 2.3.13 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97272 Patch Status Patched Published Sep 30, 2026 Affected Software Premmerce Permalink Manager for WooCommerce [woo-permalink-manager] Researcher Nguyen Ba Khanh More Details > Premmerce Wishlist for WooCommerce <= 1.1.13 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97273 Patch Status Patched Published Oct 1, 2026 Affected Software Premmerce Wishlist for WooCommerce [premmerce-woocommerce-wishlist] Researcher dutafi More Details > Premmerce Wishlist for WooCommerce <= 1.1.13 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97268 Patch Status Patched Published Oct 1, 2026 Affected Software Premmerce Wishlist for WooCommerce [premmerce-woocommerce-wishlist] Researcher Seongwon Lee More Details > Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.6 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97289 Patch Status Patched Published Sep 30, 2026 Affected Software Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next] Researcher Ivaylo Atanassov More Details > Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-92977 Patch Status Patched Published Oct 2, 2026 Affected Software Real Cookie Banner: GDPR & ePrivacy Cookie Consent [real-cookie-banner] Researcher Pham Duc Anh More Details > Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97641 Patch Status Patched Published Oct 1, 2026 Affected Software Relevanssi – A Better Search [relevanssi] Researcher Yuto Hyakumoto More Details > Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-103426 Patch Status Patched Published Oct 1, 2026 Affected Software Relevanssi Premium [relevanssi-premium] Researcher Philipp Doblhofer More Details > Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-89193 Patch Status Patched Published Sep 28, 2026 Affected Software Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF [robin-image-optimizer] Researcher Jakub Herman More Details > Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94668 Patch Status Patched Published Oct 4, 2026 Affected Software Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system] Researcher Ananda Dhakal More Details > Search in Place <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95598 Patch Status Patched Published Oct 3, 2026 Affected Software Search in Place [search-in-place] Researcher Nixxies More Details > SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96564 Patch Status Patched Published Oct 2, 2026 Affected Software SEOPress – AI SEO Plugin & On-site SEO [wp-seopress] Researcher Adrien Brunner More Details > ShopBuilder – WooCommerce Builder For Elementor <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95596 Patch Status Patched Published Oct 3, 2026 Affected Software ShopBuilder – WooCommerce Builder For Elementor [shopbuilder] Researcher neurotx More Details > Simple Payment <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96332 Patch Status Patched Published Oct 4, 2026 Affected Software Simple Payment [simple-payment] Researcher V1T More Details > Smart Forms – when you need more than just a contact form <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-32574 Patch Status Unpatched Published Oct 4, 2026 Affected Software Smart Forms – when you need more than just a contact form [smart-forms] Researcher Nguyen Dinh Hai (HaiND) More Details > Smart Popup by Supsystic <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-102398 Patch Status Patched Published Sep 30, 2026 Affected Software Smart Popup by Supsystic [popup-by-supsystic] Researcher neurotx More Details > Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93756 Patch Status Patched Published Oct 1, 2026 Affected Software Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] Researcher Yuto Hyakumoto More Details > Social Sharing Plugin – Sassy Social Share <= 3.3.79 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94170 Patch Status Unpatched Published Oct 4, 2026 Affected Software Social Sharing Plugin – Sassy Social Share [sassy-social-share] Researcher ChuongVN More Details > Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96650 Patch Status Patched Published Oct 2, 2026 Affected Software Strong Testimonials [strong-testimonials] Researcher Tarcísio Luchesi De Almeida Silva (Poystick) More Details > SUMO Affiliates Pro <= 11.7.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-32575 Patch Status Unpatched Published Oct 4, 2026 Affected Software SUMO Affiliates Pro [affs] Researcher dutafi More Details > Total Donations <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94159 Patch Status Unpatched Published Oct 4, 2026 Affected Software Total Donations [totaldonations] Researcher Tran Nguyen Bao Khanh More Details > TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.6 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-103062 Patch Status Patched Published Oct 2, 2026 Affected Software TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] Researcher b1ue0cean More Details > Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96575 Patch Status Patched Published Oct 2, 2026 Affected Software Transliterator – Multilingual and Multi-script Text Conversion [serbian-transliteration] Researcher theviper17y More Details > Trusted Shops Easy Integration for WooCommerce <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96816 Patch Status Patched Published Sep 28, 2026 Affected Software Trusted Shops Easy Integration for WooCommerce [trusted-shops-easy-integration-for-woocommerce] Researcher bekitousei More Details > Ultimate Maps by Supsystic <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-102396 Patch Status Patched Published Sep 30, 2026 Affected Software Ultimate Maps by Supsystic [ultimate-maps-by-supsystic] Researcher neurotx More Details > Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96270 Patch Status Patched Published Oct 2, 2026 Affected Software Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] Researcher thevietronin More Details > Ultimate Review <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-101159 Patch Status Patched Published Oct 1, 2026 Affected Software WP Ultimate Review [wp-ultimate-review] Researcher Jakub Herman More Details > Unlimited Elements for Elementor <= 2.0.19 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94662 Patch Status Patched Published Oct 2, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher Ayukiab More Details > Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Admin+) Arbitrary File Write 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-85015 Patch Status Patched Published Oct 1, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher Yaswanth Reddy Sunkara More Details > UpSolution Core <= 8.44 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94166 Patch Status Unpatched Published Oct 3, 2026 Affected Software UpSolution Core [us-core] Researcher Rafie Muhammad More Details > UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-94641 Patch Status Patched Published Oct 3, 2026 Affected Software UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp] Researcher Mor Golan More Details > Verge3D <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-92994 Patch Status Patched Published Sep 28, 2026 Affected Software Verge3D Publishing and E-Commerce [verge3d] Researcher Raphael P. Cigana More Details > VikBooking Hotel Booking Engine & PMS <= 1.8.14 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-95591 Patch Status Patched Published Oct 3, 2026 Affected Software VikBooking Hotel Booking Engine & PMS [vikbooking] Researcher neurotx More Details > Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97341 Patch Status Patched Published Oct 2, 2026 Affected Software Visitor Traffic Real Time Statistics [visitors-traffic-real-time-statistics] Researcher Kuba More Details > Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title) 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-93367 Patch Status Patched Published Oct 1, 2026 Affected Software Visitor Traffic Real Time Statistics pro [visitors-traffic-real-time-statistics-pro] Researcher Rafie Muhammad More Details > W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-87920 Patch Status Patched Published Oct 1, 2026 Affected Software W3 Total Cache [w3-total-cache] Researcher theviper17y More Details > Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-87091 Patch Status Patched Published Oct 2, 2026 Affected Software Welcart e-Commerce [usc-e-shop] Researcher minhgalaxy More Details > Welcart e-Commerce <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-96761 Patch Status Patched Published Oct 3, 2026 Affected Software Welcart e-Commerce [usc-e-shop] Researcher Nguyen Ba Khanh More Details > WP Media folder <= 6.2.2 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-32569 Patch Status Unpatched Published Oct 4, 2026 Affected Software WP Media folder [wp-media-folder] Researcher dutafi More Details > WP User Frontend Pro <= 4.2.13 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-32572 Patch Status Unpatched Published Oct 4, 2026 Affected Software WP User Frontend Pro [wp-user-frontend-pro] Researcher dutafi More Details > WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97660 Patch Status Patched Published Oct 2, 2026 Affected Software WPC Product Options for WooCommerce [wpc-product-options] Researcher Sebastian Albrecht (mySebbe) More Details > WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-97271 Patch Status Patched Published Sep 30, 2026 Affected Software WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels] Researcher daroo More Details > Prime Mover – Backup and Migration <= 2.2.0 - Authenticated (Admin+) Arbitrary Directory Deletion 7.1 CVSS Rating 7.1 (High) CVE-ID CVE-2026-101889 Patch Status Patched Published Oct 1, 2026 Affected Software Prime Mover – Backup and Migration [prime-mover] Researcher Sarvar Eshboyev More Details > Content Egg – Affiliate Product Importer & Price Comparison <= 6.3.1 - Authenticated (Shop Manager+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-96832 Patch Status Patched Published Sep 28, 2026 Affected Software Content Egg – Affiliate Product Importer & Price Comparison [content-egg] Researcher Ananda Dhakal More Details > Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 3.5.2 - Authenticated (Shop Manager+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-93771 Patch Status Patched Published Sep 28, 2026 Affected Software Cost of Goods: Product Cost & Profit Calculator for WooCommerce [cost-of-goods-for-woocommerce] Researcher Ananda Dhakal More Details > Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 - Authenticated (Shop Manager+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-102392 Patch Status Patched Published Sep 30, 2026 Affected Software Extra Product Options For WooCommerce | Custom Product Addons and Fields [woo-extra-product-options] Researcher Ananda Dhakal More Details > Hide Shipping Method For WooCommerce <= 1.5.4 - Authenticated (Editor+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-94390 Patch Status Patched Published Oct 1, 2026 Affected Software Hide Shipping Method For WooCommerce [hide-shipping-method-for-woocommerce] Researcher Ananda Dhakal More Details > Music Player for WooCommerce <= 1.9.1 - Authenticated (Shop Manager+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-93624 Patch Status Patched Published Sep 29, 2026 Affected Software Music Player for WooCommerce [music-player-for-woocommerce] Researcher Ananda Dhakal More Details > Page Builder by SiteOrigin <= 2.36.0 - Authenticated (Editor+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-97256 Patch Status Patched Published Sep 30, 2026 Affected Software Page Builder by SiteOrigin [siteorigin-panels] Researcher Ananda Dhakal More Details > Pay with Vipps and MobilePay for WooCommerce <= 6.2.0 - Authenticated (Shop Manager+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-94568 Patch Status Patched Published Oct 3, 2026 Affected Software Pay with Vipps and MobilePay for WooCommerce [woo-vipps] Researcher Ananda Dhakal More Details > Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce <= 13.5.7 - Authenticated (Shop Manager+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-103349 Patch Status Patched Published Oct 3, 2026 Affected Software Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce [woo-product-feed-pro] Researcher Ananda Dhakal More Details > Responsive Slider Gallery – Responsive Image Photo Slider <= 1.5.5 - Authenticated (Editor+) PHP Object Injection 6.6 CVSS Rating 6.6 (Medium) CVE-ID CVE-2026-94122 Patch Status Patched Published Sep 29, 2026 Affected Software Responsive Slider Gallery – Responsive Image Photo Slider [responsive-slider-gallery] Researcher Ananda Dhakal More Details > All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-100152 Patch Status Patched Published Oct 2, 2026 Affected Software All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] Researcher Kuba More Details > All in One SEO <= 5.0.2.0 - Unauthenticated Arbitrary Shortcode Execution 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-19856 Patch Status Patched Published Oct 2, 2026 Affected Software All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] Researcher Jakub Herman More Details > Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-95865 Patch Status Patched Published Oct 2, 2026 Affected Software Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version] Researcher Wordfence PRISM More Details > BuildKit – Product Builder for WooCommerce – Custom PC Builder <= 1.0.28 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-102379 Patch Status Patched Published Oct 1, 2026 Affected Software BuildKit – Product Builder for WooCommerce – Custom PC Builder [woo-product-builder] Researcher cazy More Details > BuildKit <= 1.0.28 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-94298 Patch Status Patched Published Sep 30, 2026 Affected Software BuildKit – Product Builder for WooCommerce – Custom PC Builder [woo-product-builder] Researcher Naiches More Details > Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Contributor+) Path Traversal 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-97244 Patch Status Patched Published Sep 29, 2026 Affected Software Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms] Researcher JunHee CHO More Details > Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-97287 Patch Status Patched Published Sep 30, 2026 Affected Software Event Tickets and Registration [event-tickets] Researcher Intrudify More Details > Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-97634 Patch Status Patched Published Oct 1, 2026 Affected Software Event Tickets and Registration [event-tickets] Researcher Wordfence PRISM More Details > Media Library Assistant <= 3.41 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-97293 Patch Status Patched Published Sep 30, 2026 Affected Software Media Library Assistant [media-library-assistant] Researcher Intrudify More Details > Mooberry Book Manager 4.16.2 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-32581 Patch Status Unpatched Published Oct 4, 2026 Affected Software Mooberry Book Manager [mooberry-book-manager] Researcher dodoh4t More Details > MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-12951 Patch Status Patched Published Oct 1, 2026 Affected Software MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor] Researcher Wordfence PRISM More Details > Pricing Table WordPress Plugin – Easy Pricing Tables <= 4.1.2 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-94115 Patch Status Patched Published Sep 30, 2026 Affected Software Pricing Table WordPress Plugin – Easy Pricing Tables [easy-pricing-tables] Researcher Ananda Dhakal More Details > ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-94663 Patch Status Patched Published Oct 4, 2026 Affected Software ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities] Researcher neurotx More Details > Quiz Cat – WordPress Quiz Plugin <= 3.1.1 - Authenticated (Author+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-94082 Patch Status Patched Published Sep 30, 2026 Affected Software Quiz Cat – WordPress Quiz Plugin [quiz-cat] Researcher Ananda Dhakal More Details > Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-91109 Patch Status Patched Published Sep 30, 2026 Affected Software Simply Schedule Appointments [simply-schedule-appointments] Researcher jtb75 More Details > SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-94539 Patch Status Patched Published Oct 2, 2026 Affected Software SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent [supportcandy] Researcher Adrien Brunner More Details > tagDiv Opt-In Builder <= 1.7.6 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-96329 Patch Status Patched Published Oct 3, 2026 Affected Software tagDiv Opt-In Builder [td-subscription] Researcher Rafie Muhammad More Details > Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 6.0.5 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-95599 Patch Status Patched Published Oct 3, 2026 Affected Software Taskbuilder – Project Management & Task Management Tool With Kanban Board [taskbuilder] Researcher Heinrihs Skrodelis More Details > The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-84740 Patch Status Patched Published Sep 28, 2026 Affected Software The Events Calendar [the-events-calendar] Researcher Jakub Herman More Details > Unlimited Elements for Elementor <= 2.0.20 - Authenticated (Contributor+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-103338 Patch Status Patched Published Oct 1, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher Ayukiab More Details > Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-92923 Patch Status Patched Published Oct 1, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher Jakub Herman More Details > WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Authenticated (Subscriber+) SQL Injection 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-103066 Patch Status Patched Published Oct 3, 2026 Affected Software WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events] Researcher Khanh Nguyen More Details > WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-16596 Patch Status Patched Published Sep 29, 2026 Affected Software WP Directory Kit [wpdirectorykit] Researcher zickzick2 More Details > WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode) 6.5 CVSS Rating 6.5 (Medium) CVE-ID CVE-2026-100157 Patch Status Patched Published Oct 2, 2026 Affected Software WP Ultimate Review [wp-ultimate-review] Researcher walid213 More Details > Audio Player Block 1.1.0 - 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-85415 Patch Status Patched Published Sep 28, 2026 Affected Software Audio Player Block – Advanced Block for Embedding Audio Files [audio-player-block] Researcher Philipp Doblhofer More Details > Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96820 Patch Status Patched Published Sep 28, 2026 Affected Software Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support] Researcher sequence_X0 More Details > Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96268 Patch Status Patched Published Sep 30, 2026 Affected Software Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support] Researcher Nhien Pham (nhienit) (nhienit) More Details > bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-101925 Patch Status Patched Published Sep 30, 2026 Affected Software bbp style pack [bbp-style-pack] Researcher zickzick2 More Details > Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-6173 Patch Status Patched Published Sep 29, 2026 Affected Software Bold Page Builder [bold-page-builder] Researcher Lucas torres (Rooting) More Details > Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-6172 Patch Status Patched Published Sep 29, 2026 Affected Software Bold Page Builder [bold-page-builder] Researcher Lucas torres (Rooting) More Details > Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-6171 Patch Status Patched Published Sep 29, 2026 Affected Software Bold Page Builder [bold-page-builder] Researcher Lucas torres (Rooting) More Details > Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-6170 Patch Status Patched Published Sep 29, 2026 Affected Software Bold Page Builder [bold-page-builder] Researcher Lucas torres (Rooting) More Details > Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-88037 Patch Status Patched Published Sep 29, 2026 Affected Software Bold Page Builder [bold-page-builder] Researcher theviper17y More Details > Branda – White Label & Branding, Free Login Page Customizer <= 3.4.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-102376 Patch Status Patched Published Sep 30, 2026 Affected Software Branda – White Label & Branding, Free Login Page Customizer [branda-white-labeling] Researcher Intrudify More Details > CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-100513 Patch Status Patched Published Sep 30, 2026 Affected Software CF7 Views – Complete Entry Management for Contact Form 7 [cf7-views] Researcher Ananda Dhakal More Details > Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94665 Patch Status Patched Published Oct 4, 2026 Affected Software Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing] Researcher Zein More Details > CMB2 <= 2.13.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97270 Patch Status Patched Published Sep 30, 2026 Affected Software CMB2 [cmb2] Researcher Jorgson More Details > Content Egg <= 11.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-92424 Patch Status Patched Published Sep 28, 2026 Affected Software Content Egg – Affiliate Product Importer & Price Comparison [content-egg] Researcher aymen benlamari More Details > Cool FormKit Lite – Advanced Form Builder for Elementor <= 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97301 Patch Status Patched Published Sep 30, 2026 Affected Software Cool FormKit Lite – Advanced Form Builder for Elementor [extensions-for-elementor-form] Researcher Intrudify More Details > Download Manager <= 3.3.70 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-86610 Patch Status Patched Published Sep 29, 2026 Affected Software Download Manager [downloadmanager] Researcher Mark Moore More Details > Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97338 Patch Status Patched Published Oct 1, 2026 Affected Software Download Manager [download-manager] Researcher daroo More Details > Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-89424 Patch Status Patched Published Sep 30, 2026 Affected Software Duplicate Post [copy-delete-posts] Researcher Kuba More Details > ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-103064 Patch Status Patched Published Oct 1, 2026 Affected Software ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite] Researcher nh4tvd More Details > ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-103063 Patch Status Patched Published Oct 1, 2026 Affected Software ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite] Researcher Intrudify More Details > EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-92727 Patch Status Patched Published Oct 2, 2026 Affected Software EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress] Researcher UKO More Details > EmbedPress 4.4.9 - 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-85001 Patch Status Patched Published Sep 28, 2026 Affected Software EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress] Researcher Revanth Hari Narayana Matte More Details > Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-102394 Patch Status Patched Published Oct 1, 2026 Affected Software Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite] Researcher Intrudify More Details > EWWW Image Optimizer <= 8.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97067 Patch Status Patched Published Sep 30, 2026 Affected Software EWWW Image Optimizer [ewww-image-optimizer] Researcher Intrudify More Details > Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-103343 Patch Status Patched Published Oct 1, 2026 Affected Software Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] Researcher Intrudify More Details > Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96256 Patch Status Patched Published Sep 30, 2026 Affected Software Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns [essential-blocks] Researcher Webbernaut More Details > HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-62080 Patch Status Patched Published Sep 30, 2026 Affected Software HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons] Researcher nh4tvd More Details > Horizontal Scrolling Announcements <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-17005 Patch Status Unpatched Published Oct 1, 2026 Affected Software Horizontal scrolling announcements [horizontal-scrolling-announcements] Researcher testoun More Details > Hostinger Reach 1.0.6 - 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-87777 Patch Status Patched Published Sep 28, 2026 Affected Software Hostinger Reach – AI-Powered Email Marketing for WordPress [hostinger-reach] Researcher Dmitrii Ignatyev More Details > HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-11895 Patch Status Patched Published Sep 29, 2026 Affected Software HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor] Researcher kiemtiendinhau More Details > JetReviews <= 3.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94667 Patch Status Patched Published Oct 4, 2026 Affected Software JetReviews [jet-reviews] Researcher nh4tvd More Details > King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.86 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97298 Patch Status Patched Published Sep 30, 2026 Affected Software King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons] Researcher Intrudify More Details > Kubio AI Page Builder <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-88782 Patch Status Patched Published Oct 1, 2026 Affected Software Kubio AI Page Builder [kubio] Researcher Artus KG More Details > LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Contributor+) Server-Side Request Forgery 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-103082 Patch Status Patched Published Oct 1, 2026 Affected Software LA-Studio Element Kit for Elementor [lastudio-element-kit] Researcher JunHee CHO More Details > Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96647 Patch Status Patched Published Oct 1, 2026 Affected Software Listdom: AI-powered Business Directory with Classifieds Ads Listings [listdom] Researcher Theklis More Details > Loco Translate <= 2.8.8 - Authenticated (Translator+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94239 Patch Status Patched Published Oct 1, 2026 Affected Software Loco Translate [loco-translate] Researcher Het Kalariya More Details > MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-103339 Patch Status Patched Published Oct 1, 2026 Affected Software MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] Researcher Intrudify More Details > Motors <= 1.4.123 - Authenticated (Listing Manager+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-91022 Patch Status Patched Published Sep 30, 2026 Affected Software Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings] Researcher Yaswanth Reddy Sunkara More Details > NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96607 Patch Status Patched Published Oct 4, 2026 Affected Software NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder] Researcher Ahmed Hassan More Details > Ohio Extra <= 3.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-32571 Patch Status Unpatched Published Oct 4, 2026 Affected Software Ohio Extra [ohio-extra] Researcher Nguyen Ba Khanh More Details > oik <= 4.15.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96819 Patch Status Patched Published Sep 29, 2026 Affected Software oik [oik] Researcher sequence_X0 More Details > Pixfort Core < 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-96450 Patch Status Patched Published Sep 29, 2026 Affected Software Pixfort Core [pixfort-core] Researcher Saad.Codes More Details > Polylang <= 3.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97279 Patch Status Patched Published Sep 30, 2026 Affected Software Polylang [polylang] Researcher Intrudify More Details > Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-62078 Patch Status Patched Published Sep 30, 2026 Affected Software Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor] Researcher nh4tvd More Details > Qi Addons For Elementor <= 1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-62079 Patch Status Patched Published Sep 30, 2026 Affected Software Qi Addons For Elementor [qi-addons-for-elementor] Researcher nh4tvd More Details > ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-92712 Patch Status Unpatched Published Sep 29, 2026 Affected Software ReactPress – Create React App for WordPress [reactpress] Researcher Nabil Irawan More Details > Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-93908 Patch Status Unpatched Published Sep 29, 2026 Affected Software Real Estate Manager – Property Listing and Agent Management [real-estate-manager] Researcher theviper17y More Details > Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-90992 Patch Status Patched Published Sep 30, 2026 Affected Software Redux Framework [redux-framework] Researcher daroo More Details > RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1225 - Authenticated (Customer+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-100509 Patch Status Patched Published Oct 3, 2026 Affected Software RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop] Researcher Ananda Dhakal More Details > Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-15795 Patch Status Patched Published Oct 2, 2026 Affected Software Responsive Starter Templates – Elementor Templates & Starter Sites [responsive-add-ons] Researcher Wordfence PRISM More Details > Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API) 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-100148 Patch Status Patched Published Oct 2, 2026 Affected Software Rich Showcase for Google Reviews [widget-google-reviews] Researcher Jakub Herman More Details > Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-14876 Patch Status Patched Published Sep 29, 2026 Affected Software Smart Slider 3 [smart-slider-3] Researcher Webbernaut More Details > Strong Testimonials <= 3.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97286 Patch Status Patched Published Sep 30, 2026 Affected Software Strong Testimonials [strong-testimonials] Researcher Rully Miftahur Rozaq More Details > SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-94378 Patch Status Patched Published Oct 2, 2026 Affected Software SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent [supportcandy] Researcher Adrien Brunner More Details > Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.63 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-102384 Patch Status Patched Published Sep 30, 2026 Affected Software Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder [supreme-modules-for-divi] Researcher Ananda Dhakal More Details > ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Server-Side Request Forgery 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-102797 Patch Status Patched Published Oct 2, 2026 Affected Software ThemeREX Addons [trx_addons] Researcher nh4tvd More Details > ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-102798 Patch Status Patched Published Oct 2, 2026 Affected Software ThemeREX Addons [trx_addons] Researcher nh4tvd More Details > Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-92767 Patch Status Patched Published Oct 2, 2026 Affected Software Twenty20 Image Before-After [twenty20] Researcher Dmitrii Ignatyev More Details > Ultimate Review <= 2.4.3 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-101162 Patch Status Patched Published Oct 1, 2026 Affected Software WP Ultimate Review [wp-ultimate-review] Researcher Alban Roche More Details > Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2025-12828 Patch Status Patched Published Oct 2, 2026 Affected Software Ultra Addons Lite for Elementor [ut-elementor-addons-lite] Researcher Abu Hurayra (HurayraIIT) More Details > Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-85016 Patch Status Patched Published Sep 30, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher Revanth Hari Narayana Matte More Details > User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20260810 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-62084 Patch Status Patched Published Sep 30, 2026 Affected Software User Submitted Posts – Enable Users to Submit Posts from the Front End [user-submitted-posts] Researcher Ananda Dhakal More Details > Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2025-14564 Patch Status Unpatched Published Sep 29, 2026 Affected Software Viable URL Media Uploader [viable-url-media-uploader] Researcher Peerapat Samatathanyakorn More Details > Virtue Premium <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) Patch Status Patched Published Sep 30, 2026 Affected Software Virtue Premium [virtue_premium] Researcher Patchstack More Details > Virtue Premium <= 4.10.22 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) Patch Status Patched Published Sep 30, 2026 Affected Software Virtue Premium [virtue_premium] Researcher Patchstack More Details > Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97266 Patch Status Patched Published Sep 30, 2026 Affected Software Virtue/Ascend/Pinnacle Toolkit [virtue-toolkit] Researcher Intrudify More Details > Visual Composer Website Builder <= 45.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97262 Patch Status Patched Published Sep 30, 2026 Affected Software Visual Composer Website Builder [visualcomposer] Researcher Intrudify More Details > WP OAuth Server (OAuth Authentication) <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97288 Patch Status Patched Published Sep 30, 2026 Affected Software WP OAuth Server (OAuth Authentication) [oauth2-provider] Researcher Ananda Dhakal More Details > WP Photo Album Plus <= 9.3.02.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-102386 Patch Status Patched Published Sep 30, 2026 Affected Software WP Photo Album Plus [wp-photo-album-plus] Researcher neurotx More Details > Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97344 Patch Status Patched Published Oct 2, 2026 Affected Software Wp Social Login and Register Social Counter [wp-social] Researcher Jakub Herman More Details > YITH WooCommerce Tab Manager <= 2.15.0 - Authenticated (Author+) Stored Cross-Site Scripting 6.4 CVSS Rating 6.4 (Medium) CVE-ID CVE-2026-97292 Patch Status Patched Published Sep 28, 2026 Affected Software YITH WooCommerce Tab Manager [yith-woocommerce-tab-manager] Researcher Seongwon Lee More Details > ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-103068 Patch Status Patched Published Oct 1, 2026 Affected Software ByteCoreStack – MCP Connector for AI Tools [bcs-mcp-manager] Researcher Ananda Dhakal More Details > Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Subscriber+) Free Paid Course Enrollment 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-62083 Patch Status Patched Published Sep 30, 2026 Affected Software Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms] Researcher khado More Details > FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 2.0.12 - Authenticated (Subscriber+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-96821 Patch Status Patched Published Sep 28, 2026 Affected Software FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards] Researcher Asim Alshaya More Details > Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-96451 Patch Status Patched Published Oct 1, 2026 Affected Software Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] Researcher Intrudify More Details > Vitepos – Point of Sale (POS) for WooCommerce <= 3.5.0 - Authenticated (Custom Role+) Privilege Escalation 6.3 CVSS Rating 6.3 (Medium) CVE-ID CVE-2026-96815 Patch Status Patched Published Sep 28, 2026 Affected Software Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite] Researcher Adam Rayyan Aryasatya More Details > Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-89427 Patch Status Patched Published Sep 30, 2026 Affected Software Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] Researcher Kuba More Details > Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header) 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-19902 Patch Status Patched Published Sep 30, 2026 Affected Software Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] Researcher Yuto Hyakumoto More Details > All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-85492 Patch Status Patched Published Oct 1, 2026 Affected Software All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] Researcher mak3bread More Details > Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-84925 Patch Status Patched Published Oct 1, 2026 Affected Software Avada | Website Builder For WordPress & WooCommerce [Avada] Researcher daroo More Details > Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices() 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-100179 Patch Status Patched Published Sep 30, 2026 Affected Software Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form] Researcher UKO More Details > Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-103909 Patch Status Patched Published Oct 2, 2026 Affected Software Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form] Researcher UKO More Details > Disable and Remove Google Fonts | GDPR & DSGVO friendly <= 2.0.2 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-95595 Patch Status Patched Published Oct 2, 2026 Affected Software Disable and Remove Google Fonts | GDPR & DSGVO friendly [disable-remove-google-fonts] Researcher neurotx More Details > Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-94670 Patch Status Patched Published Oct 2, 2026 Affected Software Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] Researcher neurotx More Details > EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92826 Patch Status Patched Published Oct 2, 2026 Affected Software EWWW Image Optimizer [ewww-image-optimizer] Researcher braintx More Details > Five Star Restaurant Reviews <= 2.3.13 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92412 Patch Status Patched Published Sep 29, 2026 Affected Software Five Star Restaurant Reviews [good-reviews-wp] Researcher V1T More Details > Grand Restaurant WordPress < 7.0.11 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-94161 Patch Status Patched Published Oct 4, 2026 Affected Software Grand Restaurant WordPress [grandrestaurant] Researcher Tran Nguyen Bao Khanh More Details > Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-93880 Patch Status Patched Published Oct 1, 2026 Affected Software Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks] Researcher Jiemook More Details > If-So Dynamic Content 1.8 - 1.10.1 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-87970 Patch Status Patched Published Sep 29, 2026 Affected Software If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so] Researcher João Ramos Maciel More Details > Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92243 Patch Status Patched Published Oct 2, 2026 Affected Software Ivory Search – WordPress Search Plugin [add-search-to-menu] Researcher @nacento More Details > LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92538 Patch Status Patched Published Oct 2, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher Yuto Hyakumoto More Details > Mobile Menu 2.7.4 - 2.8.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-91832 Patch Status Patched Published Sep 28, 2026 Affected Software WP Mobile Menu – The Mobile-Friendly Responsive Menu [mobile-menu] Researcher Het Kalariya More Details > Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92551 Patch Status Patched Published Oct 2, 2026 Affected Software Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar] Researcher UKO More Details > Payflex Payment Gateway <= 2.7.1 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-103346 Patch Status Patched Published Oct 4, 2026 Affected Software Payflex Payment Gateway [payflex-payment-gateway] Researcher Ananda Dhakal More Details > Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-92974 Patch Status Patched Published Oct 2, 2026 Affected Software Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery] Researcher r3foxx More Details > Photo Reviews for WooCommerce <= 1.2.30 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-100515 Patch Status Patched Published Oct 3, 2026 Affected Software Photo Reviews for WooCommerce [woo-photo-reviews] Researcher Oly Hossen More Details > Progressify - Progressive Web App (PWA) <= 1.6.0 - Unauthenticated Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-32570 Patch Status Unpatched Published Oct 4, 2026 Affected Software Progressify – All-in-One Progressive Web App (PWA) [progressify] Researcher Nguyen Ba Khanh More Details > Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-89047 Patch Status Patched Published Sep 30, 2026 Affected Software Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] Researcher Muhamad Visat More Details > Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-103344 Patch Status Patched Published Oct 2, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher nh4tvd More Details > Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-103342 Patch Status Patched Published Oct 1, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher nh4tvd More Details > WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-97276 Patch Status Patched Published Oct 2, 2026 Affected Software WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] Researcher b1ue0cean More Details > WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-97652 Patch Status Patched Published Oct 1, 2026 Affected Software WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] Researcher Jakub Herman More Details > WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-104313 Patch Status Patched Published Oct 2, 2026 Affected Software WPC Estimated Delivery Date for WooCommerce [wpc-estimated-delivery-date] Researcher Osvaldo Noe Gonzalez Del Rio (Os) More Details > WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-103888 Patch Status Patched Published Oct 2, 2026 Affected Software WPC Smart Quick View for WooCommerce [woo-smart-quick-view] Researcher Kuba More Details > WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-93896 Patch Status Patched Published Oct 2, 2026 Affected Software WPFront Notification Bar [wpfront-notification-bar] Researcher Nabil Irawan More Details > WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Reflected Cross-Site Scripting 6.1 CVSS Rating 6.1 (Medium) CVE-ID CVE-2026-27371 Patch Status Patched Published Sep 30, 2026 Affected Software WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels] Researcher Skalucy More Details > Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-12241 Patch Status Patched Published Sep 30, 2026 Affected Software Advanced Woo Labels – Product Labels & Badges for WooCommerce [advanced-woo-labels] Researcher Osvaldo Noe Gonzalez Del Rio (Os) More Details > Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-78471 Patch Status Patched Published Oct 1, 2026 Affected Software Autoptimize [autoptimize] Researcher theviper17y More Details > Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-100180 Patch Status Patched Published Oct 2, 2026 Affected Software Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit] Researcher Dthangws More Details > Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Subscriber+) Arbitrary Shortcode Execution 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-92924 Patch Status Patched Published Sep 30, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher Jakub Herman More Details > WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-103519 Patch Status Patched Published Oct 2, 2026 Affected Software WP Ultimate Review [wp-ultimate-review] Researcher Eunho Kim More Details > WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search//0' Path Segment 5.4 CVSS Rating 5.4 (Medium) CVE-ID CVE-2026-103421 Patch Status Patched Published Oct 2, 2026 Affected Software WPMobile.App – Android and iOS App Builder [wpappninja] Researcher Kevin Whelan More Details > AFFI – Affiliate Marketing for WooCommerce <= 1.0.9 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-102390 Patch Status Patched Published Oct 1, 2026 Affected Software AFFI – Affiliate Marketing for WooCommerce [affi-affiliate-marketing-for-woo] Researcher Nixxies More Details > Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94432 Patch Status Patched Published Oct 1, 2026 Affected Software Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] Researchers Niv KochanMatan Bachar More Details > BackupEase – Scheduled Backup, Restore & Site Migration <= 2.2.2 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97241 Patch Status Patched Published Sep 29, 2026 Affected Software BackupEase – Scheduled Backup, Restore & Site Migration [backupease] Researcher Ananda Dhakal More Details > BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) <= 1.2.2 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95526 Patch Status Patched Published Oct 4, 2026 Affected Software BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) [woo-bulk-editor] Researcher Sakri Koskimies More Details > Booking Calendar <= 11.8.4 - Unauthenticated Duplicate Slot Booking 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-39601 Patch Status Patched Published Oct 2, 2026 Affected Software Booking Calendar [booking] Researcher Ananda Dhakal More Details > BuildKit – Product Builder for WooCommerce – Custom PC Builder <= 1.0.28 - Unauthenticated Cart Data Manipulation 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97275 Patch Status Patched Published Oct 3, 2026 Affected Software BuildKit – Product Builder for WooCommerce – Custom PC Builder [woo-product-builder] Researcher dcs More Details > Bus Ticket Booking with Seat Reservation <= 5.9.3 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97251 Patch Status Patched Published Oct 1, 2026 Affected Software Bus Ticket Booking with Seat Reservation [bus-ticket-booking-with-seat-reservation] Researcher Supakiad S. More Details > CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 <= 3.7.2 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-62058 Patch Status Patched Published Oct 1, 2026 Affected Software CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 [contact-form-7-honeypot] Researcher Romain Deperne More Details > CMP - Coming Soon & Maintenance <= 4.1.19 - Unauthenticated Maintenance Mode Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-13413 Patch Status Patched Published Sep 29, 2026 Affected Software CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] Researcher Meher Sudhakar Abbireddi More Details > Connections Business Directory <= 10.4.67 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86789 Patch Status Unpatched Published Sep 28, 2026 Affected Software Connections Business Directory [connections] Researcher Usama Arshad More Details > Cost Calculator Builder <= 4.0.17 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97307 Patch Status Patched Published Oct 2, 2026 Affected Software Cost Calculator Builder [cost-calculator-builder] Researcher Intrudify More Details > Course Booking System <= 7.0.8 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96886 Patch Status Patched Published Sep 28, 2026 Affected Software Course Booking System [course-booking-system] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates <= 2.2.23 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97070 Patch Status Patched Published Oct 3, 2026 Affected Software Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates [cozy-addons] Researcher Ananda Dhakal More Details > Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94271 Patch Status Unpatched Published Oct 3, 2026 Affected Software Deema Payment Gateway [deema-payment-gateway] Researcher Enrico Marcolini More Details > Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94270 Patch Status Unpatched Published Oct 3, 2026 Affected Software Deema Payment Gateway [deema-payment-gateway] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > Download Manager <= 3.3.70 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94405 Patch Status Patched Published Oct 2, 2026 Affected Software Download Manager [download-manager] Researcher Ananda Dhakal More Details > Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Arbitrary Payment Amount Reduction 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90987 Patch Status Patched Published Sep 28, 2026 Affected Software Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal] Researcher JunHee CHO More Details > Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Access Mode Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90952 Patch Status Patched Published Sep 28, 2026 Affected Software WPEPP – Essential Security, Password Protect & Login Page Customizer [wp-edit-password-protected] Researcher Artus KG More Details > elegro Crypto Payment <= 1.0.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94299 Patch Status Unpatched Published Oct 3, 2026 Affected Software elegro Crypto Payment [elegro-payment] Researcher JunHee CHO More Details > Fast Courier <= 5.2.3 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-89289 Patch Status Unpatched Published Oct 3, 2026 Affected Software Fast Courier – Shipping & Freight [fast-courier-shipping-freight] Researcher Enrico Marcolini More Details > File Uploads Addon for WooCommerce <= 1.7.6 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-13607 Patch Status Unpatched Published Oct 2, 2026 Affected Software File Uploads Addon for WooCommerce [woo-addon-uploads] Researcher j4ck13ch4n More Details > File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-78371 Patch Status Patched Published Oct 2, 2026 Affected Software File Uploads Addon for WooCommerce [woo-addon-uploads] Researcher Erwan LR More Details > Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.24 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-103334 Patch Status Patched Published Oct 3, 2026 Affected Software Five Star Restaurant Reservations – WordPress Booking Plugin [restaurant-reservations] Researcher Ananda Dhakal More Details > Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-103353 Patch Status Patched Published Oct 1, 2026 Affected Software Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] Researcher MYUNGYONG LEE More Details > Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96335 Patch Status Patched Published Oct 2, 2026 Affected Software Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] Researcher Ananda Dhakal More Details > Fusion Lite 3.37.14 - 3.47.14 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90974 Patch Status Patched Published Sep 29, 2026 Affected Software WP Fusion Lite – Marketing Automation and CRM Integration for WordPress [wp-fusion-lite] Researcher Naoki Kawahigashi More Details > Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97317 Patch Status Patched Published Sep 30, 2026 Affected Software Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers [rafflepress] Researcher Dmitrii Ignatyev More Details > GravityExport Lite for Gravity Forms <= 2.7.2 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94120 Patch Status Patched Published Sep 28, 2026 Affected Software GravityExport Lite for Gravity Forms [gf-entries-in-excel] Researcher Ashish Agarwal More Details > Hostinger Migrator <= 1.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95587 Patch Status Patched Published Sep 29, 2026 Affected Software Hostinger Migrator [migrator-plugin] Researcher onecomputerguy More Details > Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT <= 2.0.2 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97305 Patch Status Patched Published Oct 3, 2026 Affected Software Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT [hyve-lite] Researcher Ananda Dhakal More Details > InPost for WooCommerce 1.7.5 - 1.9.7 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-93580 Patch Status Patched Published Sep 28, 2026 Affected Software InPost PL [inpost-for-woocommerce] Researcher Ryan Fabella More Details > LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-104403 Patch Status Patched Published Oct 2, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher Ananda Dhakal More Details > Lookzy LookBook for WooCommerce <= 1.1.14 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-102383 Patch Status Patched Published Oct 3, 2026 Affected Software Lookzy LookBook for WooCommerce [woo-lookbook] Researcher cazy More Details > Mailchimp for WooCommerce <= 6.2 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92437 Patch Status Patched Published Oct 1, 2026 Affected Software Mailchimp for WooCommerce [mailchimp-for-woocommerce] Researcher Mutantgun More Details > Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-102381 Patch Status Patched Published Oct 1, 2026 Affected Software Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support] Researcher Peter Tang More Details > MetForm <= 4.3.0 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86832 Patch Status Patched Published Oct 1, 2026 Affected Software MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] Researcher Shirshak More Details > MetForm 2.2.1 - 4.3.0 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86834 Patch Status Patched Published Oct 1, 2026 Affected Software MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] Researcher vuxvinh More Details > MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO <= 4.2.3 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97302 Patch Status Patched Published Sep 30, 2026 Affected Software MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas] Researcher Ananda Dhakal More Details > New User Approve 3.1.0 - 3.2.9 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-83560 Patch Status Patched Published Sep 28, 2026 Affected Software New User Approve [new-user-approve] Researcher Suhayb Ahmed More Details > Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure) 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92537 Patch Status Patched Published Sep 30, 2026 Affected Software Newsletter – Send awesome emails from WordPress [newsletter] Researcher Swayam Bhageria More Details > Notivo Notification for WooCommerce <= 1.4.2 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97261 Patch Status Patched Published Sep 30, 2026 Affected Software Notivo Notification for WooCommerce [woo-notification] Researcher Ashish Agarwal More Details > OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 - Unauthenticated Authentication Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97274 Patch Status Patched Published Sep 30, 2026 Affected Software OAuth Single Sign On – SSO (OAuth Client) [miniorange-login-with-eve-online-google-facebook] Researcher rpgsec More Details > Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.9 - Unauthenticated Unauthorized Subscription Activation 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97249 Patch Status Patched Published Sep 28, 2026 Affected Software Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions] Researcher MYUNGYONG LEE More Details > Pay with Vipps and MobilePay for WooCommerce <= 6.2.4 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97259 Patch Status Patched Published Sep 30, 2026 Affected Software Pay with Vipps and MobilePay for WooCommerce [woo-vipps] Researcher Ananda Dhakal More Details > Payments for Hubtel <= 1.0.1 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96200 Patch Status Patched Published Sep 29, 2026 Affected Software Payments for Hubtel [payments-hubtel] Researcher Enrico Marcolini More Details > Payments for Hubtel <= 1.0.1 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96255 Patch Status Patched Published Sep 29, 2026 Affected Software Payments for Hubtel [payments-hubtel] Researcher Animesh Gaurav More Details > Payments for Hubtel <= 1.0.1 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96173 Patch Status Patched Published Sep 29, 2026 Affected Software Payments for Hubtel [payments-hubtel] Researcher Naoki Kawahigashi More Details > Paytm Payment Gateway <= 2.8.8 - Unauthenticated Payment Bypass 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-81740 Patch Status Patched Published Sep 29, 2026 Affected Software Paytm Payment Gateway [paytm-payments] Researcher Artus KG More Details > Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-100517 Patch Status Patched Published Oct 1, 2026 Affected Software Photo Reviews for WooCommerce [woo-photo-reviews] Researcher V1T More Details > Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.13 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-103345 Patch Status Patched Published Oct 1, 2026 Affected Software Pie Register – User Registration, Profiles & Content Restriction [pie-register] Researcher Ananda Dhakal More Details > Pie Register <= 3.8.4.13 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96962 Patch Status Patched Published Oct 1, 2026 Affected Software Pie Register – User Registration, Profiles & Content Restriction [pie-register] Researcher Usama Arshad More Details > ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-62061 Patch Status Patched Published Oct 1, 2026 Affected Software ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities] Researcher Zenith More Details > Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-104118 Patch Status Patched Published Oct 2, 2026 Affected Software Razorpay for WooCommerce [woo-razorpay] Researcher Charles Vosburgh More Details > Request a Quote <= 2.5.6 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-90988 Patch Status Unpatched Published Sep 29, 2026 Affected Software Request a Quote – Quote Forms for Any WordPress Site [request-a-quote] Researcher Artus KG More Details > REST API Log <= 1.7.2 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-100514 Patch Status Patched Published Oct 1, 2026 Affected Software REST API Log [wp-rest-api-log] Researcher Nixxies More Details > SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO 3.1.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97280 Patch Status Patched Published Oct 1, 2026 Affected Software SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO [review-schema] Researcher Brobicho More Details > SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.0 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97282 Patch Status Patched Published Sep 30, 2026 Affected Software SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO [review-schema] Researcher Oly Hossen More Details > Sermon'e <= 1.0.2 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-48199 Patch Status Unpatched Published Oct 4, 2026 Affected Software Sermon'e [sermone] Researcher Trương Hữu Phúc More Details > Site Reviews <= 8.3.2 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-103340 Patch Status Patched Published Oct 1, 2026 Affected Software Site Reviews [site-reviews] Researcher Thaer Assfour More Details > Slider Pro <= 1.0.0 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-86786 Patch Status Unpatched Published Oct 3, 2026 Affected Software Slider Pro [slider-pro-wp] Researcher Seongwon Lee More Details > Smart One Click Setup – Complete Demo Import & Export <= 1.4.3 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-32584 Patch Status Unpatched Published Oct 2, 2026 Affected Software Smart One Click Setup – Complete Demo Import & Export [smart-one-click-setup] Researcher Ananda Dhakal More Details > Solace Extra <= 1.7.1 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-80333 Patch Status Patched Published Sep 28, 2026 Affected Software Solace Extra [solace-extra] Researcher Erwan LR More Details > StifLi Backup Tools <= 2.2.7 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97240 Patch Status Patched Published Sep 29, 2026 Affected Software StifLi Backup Tools [stifli-backup-tools] Researcher Ananda Dhakal More Details > Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.6 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-62073 Patch Status Patched Published Oct 1, 2026 Affected Software Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions [wp-full-stripe-free] Researcher Ananda Dhakal More Details > TillKit <= 1.0.4 - Unauthenticated Privileged POS Session Hijacking 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-91078 Patch Status Patched Published Oct 1, 2026 Affected Software TillKit [tillkit] Researcher Pedro Pinho More Details > Timetics – Appointment Booking Calendar & Scheduling <= 1.0.63 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97304 Patch Status Patched Published Oct 3, 2026 Affected Software Timetics – Appointment Booking Calendar & Scheduling [timetics] Researcher dcs More Details > Ultimate CSV Importer <= 9.1 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-80518 Patch Status Patched Published Oct 1, 2026 Affected Software WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer] Researcher Ronny Greenberg More Details > Ultimate Maps by Supsystic <= 1.5.5 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-102397 Patch Status Patched Published Sep 30, 2026 Affected Software Ultimate Maps by Supsystic [ultimate-maps-by-supsystic] Researcher Peter Tang More Details > Ultimate Review <= 2.4.3 - Unauthenticated Persistent Denial of Service 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-101160 Patch Status Patched Published Oct 1, 2026 Affected Software WP Ultimate Review [wp-ultimate-review] Researcher Alban Roche More Details > Ultimate Review <= 2.4.3 - Unauthenticated Persistent Page Denial of Service 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-101161 Patch Status Patched Published Oct 1, 2026 Affected Software WP Ultimate Review [wp-ultimate-review] Researcher Alban Roche More Details > Unlimited Elements for Elementor <= 2.0.20 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-103341 Patch Status Patched Published Oct 1, 2026 Affected Software Unlimited Elements for Elementor [unlimited-elements-for-elementor] Researcher whp-wessel More Details > UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-84169 Patch Status Unpatched Published Oct 2, 2026 Affected Software UPI QR Code Payment Gateway [upi-qr-code-payment-gateway] Researcher Pedro Pinho More Details > User Frontend 2.5.8 - 4.3.11 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-75824 Patch Status Patched Published Sep 28, 2026 Affected Software User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend] Researcher Murad Akhmedov More Details > User Private Files <= 2.1.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97332 Patch Status Patched Published Oct 2, 2026 Affected Software User Private Files – Secure File Sharing and Client Portal Plugin [user-private-files] Researcher Akshat Parikh More Details > User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96334 Patch Status Patched Published Oct 4, 2026 Affected Software User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration] Researcher Ananda Dhakal More Details > WebToffee Gift Cards for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary Gift Card Price Manipulation 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-91020 Patch Status Patched Published Sep 28, 2026 Affected Software WebToffee Gift Cards for WooCommerce [wt-gift-cards-woocommerce] Researcher berke bodur More Details > WebToffee WP Backup and Migration <= 1.6.0 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97197 Patch Status Patched Published Sep 28, 2026 Affected Software WebToffee WP Backup and Migration [wp-migration-duplicator] Researcher c4st1e More Details > WP Express Checkout (Fast Payments via PayPal & Stripe) <= 2.4.9 - Missing Authorization 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96818 Patch Status Patched Published Sep 29, 2026 Affected Software WP Express Checkout (Fast Payments via PayPal & Stripe) [wp-express-checkout] Researcher Morato Antoine More Details > WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-92548 Patch Status Patched Published Sep 30, 2026 Affected Software WP Popular Posts [wordpress-popular-posts] Researcher mad4cyber More Details > WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.1 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-103336 Patch Status Patched Published Oct 1, 2026 Affected Software WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer] Researcher Ananda Dhakal More Details > WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-11601 Patch Status Patched Published Oct 2, 2026 Affected Software WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe] Researcher Niv Kochan More Details > WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Insecure Direct Object Reference 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-97269 Patch Status Patched Published Oct 1, 2026 Affected Software WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels] Researcher Supakiad S. More Details > WPMobile.App – Android and iOS App Builder <= 11.83 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-96342 Patch Status Patched Published Sep 28, 2026 Affected Software WPMobile.App – Android and iOS App Builder [wpappninja] Researcher Peter Tang More Details > WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`… 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-100149 Patch Status Patched Published Oct 2, 2026 Affected Software WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons [social-icons-widget-by-wpzoom] Researcher walid213 More Details > YayReviews 1.0.4 - 1.4.0 - Unauthenticated Information Exposure 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-94274 Patch Status Patched Published Sep 28, 2026 Affected Software YayReviews – Advanced Customer Reviews for WooCommerce [yay-customer-reviews-woocommerce] Researchers Pablo González PérezFrancisco José Ramírez VicenteIñigo Sánchez Enciso More Details > 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.5.17 - Missing Authorization to Unauthenticated Settings Update 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-95597 Patch Status Patched Published Oct 3, 2026 Affected Software 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 [pgall-for-woocommerce] Researcher Mor Golan More Details > Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.27 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-62097 Patch Status Patched Published Sep 30, 2026 Affected Software Business Directory Plugin – Easy Listing & Member Directories for WordPress [business-directory-plugin] Researcher Ananda Dhakal More Details > Captivate Sync <= 3.3.2 - Authenticated (Editor+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-62060 Patch Status Patched Published Oct 1, 2026 Affected Software Captivate Sync [captivatesync-trade] Researcher Ananda Dhakal More Details > MPG <= 4.2.2 - Authenticated (Editor+) Arbitrary File Read 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-103293 Patch Status Patched Published Oct 1, 2026 Affected Software MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas] Researcher ieuns More Details > SEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-101357 Patch Status Patched Published Oct 2, 2026 Affected Software SEOPress – AI SEO Plugin & On-site SEO [wp-seopress] Researcher braintx More Details > Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-62059 Patch Status Patched Published Oct 1, 2026 Affected Software Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] Researcher Ananda Dhakal More Details > WP Activity Log <= 5.6.6 - Authenticated (Administrator+) SQL Injection 4.9 CVSS Rating 4.9 (Medium) CVE-ID CVE-2026-62085 Patch Status Patched Published Sep 30, 2026 Affected Software WP Activity Log [wp-security-audit-log] Researcher Ananda Dhakal More Details > WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field 4.9 CVSS Rating 4.9 (Medium) Patch Status Patched Published Sep 30, 2026 Affected Software WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual] Researcher Muni Nitish Kumar Yaddala (Stranger825) More Details > Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-100184 Patch Status Patched Published Sep 30, 2026 Affected Software Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form] Researcher UKO More Details > EWWW Image Optimizer <= 8.7.0 - Authenticated (Administrator+) Cross-Site WebP File Deletion or Rename 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-91072 Patch Status Patched Published Sep 28, 2026 Affected Software EWWW Image Optimizer [ewww-image-optimizer] Researcher Karthik Ramakrishnan More Details > Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Open Redirect 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-97318 Patch Status Patched Published Sep 30, 2026 Affected Software Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers [rafflepress] Researcher Dick Snel More Details > Mail Logging <= 1.16.0 - Cross-Site Scripting to Unauthenticated Arbitrary HTML Content Injection in Admin Log 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-1661 Patch Status Patched Published Sep 28, 2026 Affected Software WP Mail Logging [wp-mail-logging] Researcher Kasia Sok More Details > MetForm <= 4.3.0 - Unauthenticated Arbitrary HTML Injection in Notification Emails 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-86833 Patch Status Patched Published Oct 1, 2026 Affected Software MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] Researcher vuxvinh More Details > Safe Redirect Manager <= 2.2.0 - Unauthenticated Open Redirect 4.7 CVSS Rating 4.7 (Medium) CVE-ID CVE-2026-88791 Patch Status Patched Published Sep 28, 2026 Affected Software Safe Redirect Manager [safe-redirect-manager] Researcher berke bodur More Details > If-So Dynamic Content 1.9.9 - 1.10.1 - Authenticated (Editor+) Stored Cross-Site Scripting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-87973 Patch Status Patched Published Sep 29, 2026 Affected Software If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so] Researcher Kaan Özbek More Details > Prime Mover – Backup and Migration <= 2.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-101890 Patch Status Patched Published Oct 1, 2026 Affected Software Prime Mover – Backup and Migration [prime-mover] Researcher Sarvar Eshboyev More Details > Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Editor+) Stored Cross-Site Scripting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-82127 Patch Status Patched Published Sep 28, 2026 Affected Software Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] Researcher Thomas Valadez More Details > Simple Shopping Cart <= 5.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-104119 Patch Status Patched Published Oct 2, 2026 Affected Software Simple Shopping Cart [wordpress-simple-paypal-shopping-cart] Researcher Krugov Artyom More Details > Tabs Responsive <= 2.5 - Authenticated (Shop Manager+) Stored Cross-Site Scripting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-13718 Patch Status Unpatched Published Sep 29, 2026 Affected Software Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive] Researcher j4ck13ch4n More Details > Ultimate CSV Importer 7.17 - 9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting 4.4 CVSS Rating 4.4 (Medium) CVE-ID CVE-2026-80517 Patch Status Patched Published Oct 1, 2026 Affected Software WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer] Researcher kawagishi kouhei More Details > 2FA <= 4.0.0 - Unauthenticated Two-Factor Authentication Bypass 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-103514 Patch Status Patched Published Oct 1, 2026 Affected Software WP 2FA – Two-factor authentication for WordPress [wp-2fa] Researcher Suhayb Ahmed More Details > Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route 4.3 CVSS Rating 4.3 (Medium) Patch Status Patched Published Oct 2, 2026 Affected Software Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy] Researcher Wordfence PRISM More Details > Advanced Ads – Ad Manager & AdSense <= 2.0.26 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-94180 Patch Status Unpatched Published Oct 2, 2026 Affected Software Advanced Ads – Ad Manager & AdSense [advanced-ads] Researcher Ananda Dhakal More Details > Advanced Partial Payment or Deposit for WooCommerce <= 4.0.1 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-95589 Patch Status Patched Published Oct 4, 2026 Affected Software Advanced Partial Payment or Deposit for WooCommerce [advanced-partial-payment-or-deposit-for-woocommerce] Researcher sungbyeongchan More Details > Airano MCP Bridge <= 2.11.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-32585 Patch Status Unpatched Published Oct 2, 2026 Affected Software Airano MCP Bridge [airano-mcp-bridge] Researcher Ananda Dhakal More Details > All in One Files Upload for WooCommerce <= 2.0.16 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-85576 Patch Status Patched Published Sep 28, 2026 Affected Software All in One Files Upload for WooCommerce [all-in-one-files-upload-for-woocommerce] Researcher Erwan LR More Details > AllAble Connector <= 0.13.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97243 Patch Status Patched Published Sep 29, 2026 Affected Software AllAble Connector [allable-connector] Researcher Ananda Dhakal More Details > Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-91108 Patch Status Patched Published Oct 2, 2026 Affected Software Alt Text AI – Automatically generate image alt text for SEO and accessibility [alttext-ai] Researcher Webbernaut More Details > Aruba Migration Tool <= 1.0.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97258 Patch Status Patched Published Oct 1, 2026 Affected Software Aruba Migration Tool [aruba-wp-migration-tool] Researcher Ananda Dhakal More Details > Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token' 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97343 Patch Status Patched Published Oct 2, 2026 Affected Software Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) [burst-statistics] Researcher crow More Details > ECPay Ecommerce for WooCommerce <= 1.1.2606090 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-32578 Patch Status Unpatched Published Oct 4, 2026 Affected Software ECPay Ecommerce for WooCommerce [ecpay-ecommerce-for-woocommerce] Researcher TRAN THE LONG More Details > Faktur Pro for WooCommerce <= 3.2.2 - Authenticated (Customer+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-32576 Patch Status Unpatched Published Oct 4, 2026 Affected Software Faktur Pro for WooCommerce [woorechnung] Researcher HieuPenguinnn More Details > Featured Image from URL (FIFU) <= 6.0.7 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-96671 Patch Status Patched Published Oct 3, 2026 Affected Software Featured Image from URL (FIFU) [featured-image-from-url] Researcher ChuongVN More Details > File Media Renamer <= 1.3 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-94278 Patch Status Unpatched Published Oct 3, 2026 Affected Software File Media Renamer [file-media-renamer] Researcher Sebastian Riveros More Details > Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Authenticated (Author+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-86817 Patch Status Patched Published Oct 2, 2026 Affected Software Five Star Business Profile and Schema [business-profile] Researcher Artus KG More Details > Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce <= 1.14.11 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-62081 Patch Status Patched Published Sep 30, 2026 Affected Software Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce [flexible-coupons] Researcher Brobicho More Details > FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.12.2 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-94499 Patch Status Patched Published Sep 29, 2026 Affected Software FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More [formgent] Researcher Zahid Abbasi More Details > Fusion Lite <= 3.47.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-90972 Patch Status Patched Published Sep 29, 2026 Affected Software WP Fusion Lite – Marketing Automation and CRM Integration for WordPress [wp-fusion-lite] Researcher Artus KG More Details > Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program <= 4.6.3 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97297 Patch Status Patched Published Oct 1, 2026 Affected Software Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program [gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce] Researcher SecondGateWP More Details > Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-11399 Patch Status Patched Published Oct 2, 2026 Affected Software Helpdesk Support Ticket System for WooCommerce [support-ticket-system-for-woocommerce] Researcher Saruul More Details > IATO MCP <= 1.12.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-32582 Patch Status Patched Published Oct 2, 2026 Affected Software IATO MCP [iato-mcp] Researcher Ananda Dhakal More Details > Image Optimizer by Elementor <= 1.7.6 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-90953 Patch Status Patched Published Sep 28, 2026 Affected Software Image Optimizer [image-optimizer] Researcher Artus KG More Details > Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Contributor+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-39444 Patch Status Patched Published Oct 2, 2026 Affected Software Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series] Researcher dcs More Details > LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-39717 Patch Status Unpatched Published Oct 2, 2026 Affected Software LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] Researcher Ananda Dhakal More Details > Loco Translate <= 2.8.8 - Authenticated (Translator+) Limited File Read 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-94238 Patch Status Patched Published Oct 1, 2026 Affected Software Loco Translate [loco-translate] Researcher Shivamani Vastrala More Details > Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.0 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-102382 Patch Status Patched Published Oct 1, 2026 Affected Software Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support] Researcher Peter Tang More Details > MakeCommerce for WooCommerce <= 4.1.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-96817 Patch Status Patched Published Sep 28, 2026 Affected Software MakeCommerce for WooCommerce [makecommerce] Researcher Aydan Arabadzha More Details > MCP Content Manager Lite <= 1.1.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97239 Patch Status Patched Published Sep 29, 2026 Affected Software MCP Content Manager Lite [mcp-content-manager-lite] Researcher Ananda Dhakal More Details > Media Library Organizer 2.0.4 - 2.1.3 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-94297 Patch Status Patched Published Sep 28, 2026 Affected Software Media Library Organizer – Folders, File Manager & Media Categories [media-library-organizer] Researcher Jashid Sany More Details > Memberful – Membership Plugin <= 1.81.0 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-103067 Patch Status Patched Published Oct 1, 2026 Affected Software Memberful – Membership Plugin [memberful-wp] Researcher henise More Details > Mindio Magic MCP <= 0.5.6 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-104402 Patch Status Patched Published Oct 2, 2026 Affected Software Mindio Magic MCP [mindio-magic-mcp] Researcher Ananda Dhakal More Details > Motors – Car Dealership & Classified Listings <= 1.4.123 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-91023 Patch Status Patched Published Sep 30, 2026 Affected Software Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings] Researcher Yaswanth Reddy Sunkara More Details > MStore API 4.21.1 - 4.22.0 - Authenticated (Subscriber+) Payment Bypass 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97219 Patch Status Patched Published Sep 30, 2026 Affected Software MStore API – Create Native Android & iOS Apps On The Cloud [mstore-api] Researcher cyberkareem More Details > Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97074 Patch Status Patched Published Sep 30, 2026 Affected Software Newsletters, Email Marketing, SMS and Popups by Omnisend [omnisend] Researcher elaprendiz1927 More Details > Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-102375 Patch Status Patched Published Sep 30, 2026 Affected Software Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp] Researcher Dthangws More Details > Photo Gallery – Responsive Image Galleries by Supsystic <= 1.21.0 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-102399 Patch Status Patched Published Sep 30, 2026 Affected Software Photo Gallery – Responsive Image Galleries by Supsystic [gallery-by-supsystic] Researcher Intrudify More Details > Popup Maker WP <= 1.4.5 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-85004 Patch Status Unpatched Published Sep 29, 2026 Affected Software Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More [popup-maker-wp] Researcher Artus KG More Details > Popup Maker WP 1.2.2.1 - 1.4.5 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-85005 Patch Status Unpatched Published Sep 29, 2026 Affected Software Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More [popup-maker-wp] Researcher Artus KG More Details > Prevent Files / Folders Access <= 2.6.7 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97267 Patch Status Patched Published Sep 30, 2026 Affected Software Prevent Files / Folders Access [prevent-file-access] Researcher gueco More Details > Progress Planner <= 1.10.0 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-62072 Patch Status Patched Published Oct 4, 2026 Affected Software Progress Planner [progress-planner] Researcher Asim Alshaya More Details > Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.7 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97281 Patch Status Patched Published Oct 1, 2026 Affected Software Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager] Researcher Nixxies More Details > Razorpay Payment Links for WooCommerce <= 2.1.5 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97299 Patch Status Patched Published Sep 30, 2026 Affected Software Razorpay Payment Links for WooCommerce [rzp-woocommerce] Researcher Oly Hossen More Details > Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-88999 Patch Status Patched Published Sep 30, 2026 Affected Software Redux Framework [redux-framework] Researcher Eunho Kim More Details > RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1226 - Authenticated (Subscriber+) Information Exposure 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97309 Patch Status Patched Published Oct 3, 2026 Affected Software RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop] Researcher Ananda Dhakal More Details > Robin Image Optimizer <= 2.0.7 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-89190 Patch Status Patched Published Sep 28, 2026 Affected Software Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF [robin-image-optimizer] Researcher Abdullah Kareem More Details > Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more <= 3.0.2 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97303 Patch Status Patched Published Oct 3, 2026 Affected Software Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more [scratch-win-giveaways-for-website-facebook] Researcher SecondGateWP More Details > SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more <= 1.23.2 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-103337 Patch Status Patched Published Oct 3, 2026 Affected Software SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more [wc-ukr-shipping] Researcher Heinrihs Skrodelis More Details > Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more <= 3.6.2 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97277 Patch Status Patched Published Oct 1, 2026 Affected Software Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more [social-boost] Researcher SecondGateWP More Details > The Events Calendar <= 6.17.5 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-97285 Patch Status Patched Published Sep 30, 2026 Affected Software The Events Calendar [the-events-calendar] Researcher Erik Debye More Details > Travelly – Tour & Travel Booking Manager for WooCommerce <= 2.3.1 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-62063 Patch Status Patched Published Oct 1, 2026 Affected Software Travelly – Tour & Travel Booking Manager for WooCommerce [tour-booking-manager] Researcher Ori Ashkenazi More Details > User Frontend <= 4.3.11 - Authenticated (Subscriber+) Subscription-Gated Post Creation 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-79618 Patch Status Patched Published Sep 28, 2026 Affected Software User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend] Researcher Erwan LR More Details > UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.74 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-103086 Patch Status Patched Published Oct 3, 2026 Affected Software UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp] Researcher Md. Moniruzzaman Prodhan More Details > Vayu X <= 1.0.5 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-88797 Patch Status Patched Published Sep 28, 2026 Affected Software Vayu X [vayu-x] Researcher Xanlar Agamalizade More Details > Wallstreet <= 2.8.6 - Cross-Site Request Forgery 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-39718 Patch Status Unpatched Published Oct 2, 2026 Affected Software Wallstreet [wallstreet] Researcher ashv4ni More Details > WDS MCP Content Manager <= 3.10.4 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-39599 Patch Status Unpatched Published Oct 2, 2026 Affected Software WDS MCP Content Manager [wds-mcp-content-manager] Researcher Ananda Dhakal More Details > WebSamurai <= 1.0.7 - Missing Authorization 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-39439 Patch Status Unpatched Published Oct 2, 2026 Affected Software WebSamurai [websamurai] Researcher Ananda Dhakal More Details > Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget 3.1 CVSS Rating 3.1 (Low) CVE-ID CVE-2026-102002 Patch Status Patched Published Oct 1, 2026 Affected Software Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks] Researcher Jakub Herman More Details > As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence. This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can. Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026) appeared first on Wordfence.