Wordfence 报告披露 2026 年 10 月 26 日至 11 月 1 日 549 个 WordPress 漏洞
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026)
Wordfence Intelligence 在 2026 年 10 月 26 日至 11 月 1 日收录 549 个漏洞，涉及 351 个 WordPress 插件和 4 个 WordPress 主题，其中 508 个已修复、41 个未修复。
报告汇总了当周插件、主题和核心漏洞的受影响版本、补丁状态及严重等级，便于站点管理员核查暴露面并安排升级。
译文尚不完整，完整内容请切换到原文。
上周，共披露了 351 个 WordPress 插件和 4 个 WordPress 主题中的 549 个漏洞，这些漏洞均已添加至 Wordfence Intelligence Vulnerability Database；上周共有 222 位漏洞研究员为 WordPress Security 作出贡献。现在立即查看这些漏洞的报告，确保您的网站未受影响。
Wordfence Intelligence 的使命是让每个人都能轻松获取有价值的漏洞信息，例如 WordPress 社区，从而让个人和组织都能利用这些数据实施分层安全，与我们保护 WordPress、采用纵深防御策略的总体使命保持一致。正因如此，Wordfence Intelligence 用户界面、漏洞 API 和 webhook 集成 均可完全免费供个人及商业用途使用，我们也会每周发布这份漏洞报告。作为全球领先的 WordPress 高质量漏洞数据库提供商，网站所有者可以安心，因为 Wordfence 始终在背后支持您。
企业、托管服务商乃至个人都可以 利用漏洞数据库 API 获取我们超过 40,000 个漏洞的完整数据库，然后利用 webhook 集成实时掌握新添加的漏洞以及对数据库所做的任何更新，全部免费。
点击此处注册我们的邮件列表，即可每周收到此类漏洞报告，并在重要的 WordPress Security 报告发布后第一时间收件箱。
上周部署的新防火墙规则
Wordfence Threat Intelligence 团队会审查每个漏洞，以确定其影响和严重程度，同时评估被利用的可能性，从而验证 Wordfence Firewall 是否能够提供充分保护。
上周，该团队通过防火墙规则为以下漏洞实时推出增强保护，适用于我们的 Premium、 Care 和 Response 客户：
-
- WordPress Core 4.7.0 – 7.1.3 – 未认证升级窗口分阶段安装器远程代码执行
- The Grid <= 2.8.1 – 未认证远程代码执行
- YOOtheme Pro 5.0.0 – 5.0.52 – 未认证任意文件上传
- WAF-RULE-968 – 在我们与供应商合作修补期间，数据已隐去。
- WAF-RULE-972 – 在我们与供应商合作修补期间，数据已隐去。
Wordfence Premium、 Care 和 Response 客户立即获得了这项保护，而仍使用免费版 Wordfence 的用户将在延迟 30 天后获得这项增强保护。
上周未修补及已修补漏洞总数
| 修补状态 | 漏洞数量 |
|---|---|
| 已修补 | 508 |
| 未修补 | 41 |
按 CVSS 严重程度划分的上周漏洞总数
| 严重程度评级 | 漏洞数量 |
|---|---|
| 低严重程度 | 6 |
| 中严重程度 | 394 |
| 高严重程度 | 132 |
| 严重 | 17 |
按 CWE 类型划分的上周漏洞总数
| 按 CWE 划分的漏洞类型 | 漏洞数量 |
|---|---|
| 生成网页期间输入未正确净化 | 209 |
| 缺少授权 | 128 |
| 反序列化不可信数据 | 35 |
| SQL 命令中使用特殊元素未正确净化 | 31 |
| 向未授权主体暴露敏感信息 | 28 |
| 身份验证不当 | 16 |
| 跨站请求伪造 | 14 |
| 权限管理不当 | 14 |
| 路径名未正确限制在受限目录内 | 12 |
| 上传危险类型文件不受限制 | 12 |
| 代码生成控制不当 | 11 |
| 通过用户可控密钥绕过授权 | 9 |
| 在客户端强制执行服务器端安全控制 | 3 |
| 外部控制文件名或路径 | 2 |
| PHP 程序中对 include/require 语句所用文件名的不当控制 | 2 |
| 数据真实性验证不足 | 2 |
| 服务器端请求伪造 | 2 |
| 使用共享资源并发执行时同步不当 | 1 |
| 不当访问控制 | 1 |
| 输出编码或转义不当 | 1 |
| 对行为工作流的执行不当 | 1 |
| 不当输入验证 | 1 |
| CRLF 序列中和不当 | 1 |
| CSV 文件中公式元素中和不当 | 1 |
| 网页中与脚本相关的 HTML 标签中和不当 | 1 |
| 输出中被下游组件使用的特殊元素中和不当 | 1 |
| 过度限制认证尝试 | 1 |
| 对已渲染 UI 层或框架的限制不当 | 1 |
| 对象原型属性的修改控制不当 | 1 |
| 授权错误 | 1 |
| 关键功能缺少身份验证 | 1 |
| 保护机制失效 | 1 |
| 检查时间与使用时间（TOCTOU）竞态条件 | 1 |
| 未捕获异常 | 1 |
| 重定向 URL 至不受信任的站点 | 1 |
| 使用包含敏感信息的缓存 | 1 |
上周为 WordPress 安全作出贡献的研究人员
| 研究人员姓名 | 漏洞数量 |
|---|---|
|
|
59 |
|
|
29 |
|
|
17 |
|
|
14 |
|
|
13 |
|
|
12 |
|
|
12 |
|
|
9 |
|
|
8 |
|
|
8 |
|
|
8 |
|
|
8 |
|
|
7 |
|
|
7 |
|
|
7 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
您是一名安全研究人员，并希望在我们的每周漏洞报告中 featured 吗？您可以向我们负责任地披露您发现的 WordPress 漏洞，并通过我们的漏洞赏金计划获得范围内漏洞的赏金。负责任地向我们披露您发现的漏洞，还会将您的姓名添加到 Wordfence Intelligence 排行榜上，并使您在我们每周的漏洞报告中得到提及。
上周报告存在漏洞的 WordPress 插件
| 软件名称 | 软件 Slug |
|---|---|
| 10WebSocial | wd-instagram-feed |
| Acadlix LMS – 用于 WordPress 的 AI 测验制作器、在线考试与课程插件 | acadlix |
| 手风琴 | accordions |
| Ad Inserter – 广告管理器与 AdSense 广告 | ad-inserter |
| Advanced Ads – 跟踪 | advanced-ads-tracking |
| Advanced Custom Fields: Extended | acf-extended |
| Advanced Post Block – 完全按照您想要的方式显示文章 | advanced-post-block |
| Advanced Views – 显示框架 – Gutenberg/Elementor/短代码 | acf-views |
| Affiliate Program Suite — SliceWP Affiliates | slicewp |
| affiliate-toolkit – 多网络联盟营销与 Amazon 商品展示 | affiliate-toolkit-starter |
| AI 替代文本生成器 | ai-alt-text-generator |
| WooCommerce AI 聊天机器人 – WoowBot | woowbot-woocommerce-chatbot |
| AI Engine – WordPress 的 MCP 服务器与 AI 聊天机器人，支持 Claude、ChatGPT 和 Gemini | ai-engine |
| AI 营销专家 — AI 电子邮件营销、AI 内容生成器、SEO 分析器、AI 工作流自动化、社交媒体与 AI 聊天机器人 | ai-marketing-expert |
| Ak Framework | ak-framework |
| All In One Lightbox – 在精美弹窗中显示任何媒体 | lightbox-block |
| All In One Login | change-wp-admin-login |
| All in One SEO – AI SEO 插件，用于提升 SEO 排名与流量（结构化数据、本地 SEO、站点地图与 SEO 洞察） | all-in-one-seo-pack |
| All-In-One Security (AIOS) – 安全与防火墙 | all-in-one-wp-security-and-firewall |
| All-in-One 视频库 – 适用于 YouTube、Vimeo 与自托管视频的视频播放器和视频库 | all-in-one-video-gallery |
| WP AMP – 加速移动页面 | 加速移动页面 |
| Analytics Insights – WordPress 的 Google Analytics 仪表板 | analytics-insights |
| 动画文本区块 – 添加打字和循环文本效果 | animated-text-block |
| 预约预订日历 | appointment-booking-calendar |
| 预约预订插件 – LatePoint | WordPress 日历与排程 | latepoint |
| 自动将商品导入购物车 | auto-import-products-cart-dragdropfile |
| Avada（Fusion）构建器 | fusion-builder |
| Awesome Support – WordPress 服务台与支持插件 | awesome-support |
| BA Book Everything | ba-book-everything |
| 适用于 Elementor 的更佳文章与筛选小工具 | better-post-filter-widgets-for-elementor |
| BeyondSEO – AI SEO，提升排名、列表展示与在线可见度 | beyondseo |
| Bit Flows：AI 智能体自动化与集成，适用于表单、CRM、eCommerce、Google Sheets 等 | bit-pi |
| Blocksy Companion | blocksy-companion |
| 适用于自行车、汽车、度假村、预约、服装、设备的 WooCommerce 预订与租赁管理器 | booking-and-rental-manager-for-woocommerce |
| 预约与活动日历预订 – Amelia | ameliabooking |
| 预订套餐 | booking-package |
| Bookit — 预订与预约日历 | bookit |
| Booktics – 面向服务型企业的预约预订日历 | booktics |
| Bopo – WooCommerce 商品捆绑构建器 | bopo-woo-product-bundle-builder |
| 适用于 WooCommerce 的 Telegram 机器人 | bot-for-telegram-on-woocommerce |
| Brave – 创建弹窗、订阅表单、线索生成、调查、固定元素与互动内容 | brave-popup-builder |
| Bricks 构建器 | bricksbuilder |
| Bricks 主题 | UNKNOWN-CVE-2026-119325 |
| 直播视频 – 直播流媒体：WebRTC、HLS、RTSP、RTMP | videowhisper-live-streaming-integration |
| bSlider – 构建让内容焕发生命的幻灯片轮播 | b-slider |
| BuddyBoss 平台 | buddyboss-platform |
| BuddyForms | buddyforms |
| BuddyPress | buddypress |
| BuddyPress Xprofile 自定义字段类型 | bp-xprofile-custom-field-types |
| 批量媒体登记 | bulk-media-register |
| 按钮区块 – 获得更多点击的精美按钮 | button-block |
| Casso Flow – 自动确认银行转账支付 | casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang |
| CF7 Mate – Contact Form 7 样式定制器、多步骤表单与条件逻辑 | cf7-styler-for-divi |
| 与调度员聊天的 AI 助手 | chat-ai-with-dispatcher |
| WooCommerce 结账时上传文件 | checkout-files-upload-woocommerce |
| 简洁登录 | clean-login |
| CMB2 | cmb2 |
| 通过 PublishPress Authors 在作者框中支持共同作者、多作者和客座作者 | publishpress-authors |
| 社区活动 | community-events |
| Contact Form 7 | contact-form-7 |
| Supsystic 联系表单 – 拖放式表单构建器，附带模板与表单统计 | contact-form-by-supsystic |
| 联系人管理器 | contact-manager |
| Content Egg – 联盟商品导入器与价格比较 | content-egg |
| Content Pilot – 自动博客与联盟营销套件 | wp-content-pilot |
| 内容滑块区块 – 通过幻灯片让内容焕发生命 | content-slider-block |
| Cool FormKit Lite – 适用于 Elementor 的高级表单构建器 | extensions-for-elementor-form |
| 为 WordPress 将任何内容复制到剪贴板 – 复制按钮、文本与代码 | copy-the-code |
| 球场预订 – 网球、板式网球与运动球场预订 | court-reservation |
| Cozy Blocks – 网站构建器与业务增长工具包 | 弹窗、线索表单与收件箱 | cozy-addons |
| CP 多视图活动日历 | cp-multi-view-calendar |
| CryptoCloud – 加密支付网关 | cryptocloud-crypto-payment-gateway |
| WooCommerce 自定义价格 | custom-price-for-woocommerce |
| WooCommerce 客户优惠券 | woo-customer-coupons |
| WooCommerce 客户电子邮件验证 – OTP 验证、阻止虚假注册 | customer-email-verification-for-woocommerce |
| 客户互动系统 – 弹窗构建器、表单、CRM 和电子邮件营销自动化 | popup-by-supsystic |
| 数据库清理工具：清理、优化和修复 | database-cleaner |
| 调试日志管理器 – 便捷监控和检查错误 | debug-log-manager |
| DEPART – Woo 定金和分期付款 | depart-deposit-and-part-payment-for-woo |
| DesignSetGo | designsetgo |
| 讨论板 – WordPress 论坛插件 | wp-discussion-board |
| 文档嵌入工具 – 让访客无需下载即可阅读文件 | document-emberdder |
| Document Library Lite | document-library-lite |
| Dokan：AI 驱动的 WooCommerce 多供应商市场解决方案 – 构建您自己的 Amazon、eBay、Etsy | dokan-lite |
| 适用于 WP 的 DSGVO 一体化插件 | dsgvo-all-in-one-for-wp |
| DT Directory Lite 附加插件 | dt-directory-lite-addon |
| DXP ToolKit | dxp-toolkit |
| 动态二维码生成器 | dynamic-qr-code |
| WooCommerce E-cab 出租车预订管理器 | ecab-taxi-booking-manager |
| 简单预约与日程安排插件 – Webba 预订日历 | webba-booking-lite |
| Easy Digital Downloads – 轻松实现电商支付和订阅 | easy-digital-downloads |
| easy.jobs – AI 驱动的职位列表、招聘板、职业生涯页面、招聘与雇佣解决方案 | easyjobs |
| Echo 知识库 – 文档、常见问题、聊天和智能搜索 | echo-knowledge-base |
| 电商产品目录 | ecommerce-product-catalog |
| WordPress 和 WooCommerce 电子邮件模板定制器与设计器 | email-templates |
| 启用媒体替换 | enable-media-replace |
| 启用 SVG、WebP 和 ICO 上传 | enable-svg-webp-ico-upload |
| ERP：为 WooCommerce 打造的完整人力资源、会计和 CRM 套件 | erp |
| Elementor 实用附加插件 – 热门 Elementor 模板和小组件 | essential-addons-for-elementor-lite |
| WooCommerce Eupago 网关 | eupago-gateway-for-woocommerce |
| WooCommerce 活动预订管理器 – 销售门票、活动报名、RSVP 和活动日历 | mage-eventpress |
| 活动门票与报名 | event-tickets |
| EventPrime – 活动日历、预订、门票和 AI | eventprime-event-calendar-management |
| 轻松创建活动 | events-made-easy |
| Everest Forms – 具备 AI 功能的联系表单、支付表单、测验、调查和自定义表单构建器 | everest-forms |
| 导出和导入用户与客户 | users-customers-import-export-for-wp-woocommerce |
| Leaflet 地图扩展 | extensions-leaflet-map |
| WooCommerce 额外费用 | woo-conditional-product-fees-for-checkout |
| Fast Velocity Minify | fast-velocity-minify |
| FeedWordPress | feedwordpress |
| Filter Everything — WordPress 和 WooCommerce 过滤器 | filter-everything |
| Finale Lite – WooCommerce 销售倒计时和折扣 | finale-woocommerce-sales-countdown-timer-discount |
| Firelight Lightbox | easy-fancybox |
| Flexible Chat – 适用于 WordPress 和 WooCommerce 的 AI 聊天机器人插件 | flexible-chat |
| WooCommerce 灵活数量与价格计算器 | flexible-quantity-measurement-price-calculator-for-woocommerce |
| FlexStock – 通过 Google Sheets 为 WooCommerce 同步产品库存 | stock-sync-with-google-sheet-for-woocommerce |
| FluentCRM – 邮件简报、自动化、邮件营销、邮件活动、订阅用户、潜在客户及 CRM 解决方案 | fluent-crm |
| Food Store – 在线餐食配送与自取 | food-store |
| Formidable Forms – 联系表单、调查、测验、支付、计算器表单及自定义表单构建器 | formidable |
| Forminator Forms – 联系表单、支付表单及自定义表单构建器 | forminator |
| WooCommerce 和 EDD 欺诈防范 | woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers |
| Frisbii Pay | reepay-checkout-gateway |
| 前端仪表板 | frontend-dashboard |
| FunnelKit Automations – 适用于 WordPress 和 WooCommerce 的邮件营销自动化与 CRM | wp-marketing-automations |
| FV Flowplayer 视频播放器 | fv-wordpress-flowplayer |
| 图库 PhotoBlocks | photoblocks-grid-gallery |
| Geo Mashup | geo-mashup |
| GEO my WP | geo-my-wp |
| GeoDirectory – WP 商业目录插件和分类信息目录 | geodirectory |
| WooCommerce Germanized | woocommerce-germanized |
| GIFTiT – WooCommerce 免费赠品 | ithemeland-free-gifts-for-woo |
| GiveWP – 捐赠插件和筹款平台 | give |
| WooCommerce 全球支付网关提供商 | global-payments-woocommerce |
| GoSMTP – WordPress 的 SMTP 服务 | gosmtp |
| Gravity Forms | gravityforms |
| Greenshift – 动画和页面构建器区块 | greenshift-animation-and-page-builder-blocks |
| HANDMADE – 面向 Etsy 和 WooCommerce 的 dropshipping | handmade-dropshipping-for-etsy-and-woo |
| HappyAddons for Elementor – 160 个 Elementor 小部件、GSAP 动画及模板 | happy-elementor-addons |
| 登录后显示价格 | hide-price-until-login |
| HivePress 认领信息 | hivepress-claim-listings |
| 酒店预订 | nd-booking |
| HT Mega Addons for Elementor – Elementor 小部件及模板构建器 | ht-mega-for-elementor |
| HTML5 视频播放器 – 轻松嵌入快速、响应式的视频 | html5-video-player |
| HUSKY – WooCommerce 专业版产品筛选器。MCP 已上线 | woocommerce-products-filter |
| Hustle – 邮件营销、潜在客户生成、订阅用户、弹窗 | wordpress-popup |
| If-So Dynamic Content – Elementor 及所有页面构建器的个性化功能 | if-so |
| 图库区块 – 以精美的响应式网格展示照片 | 3d-image-gallery |
| 导入和导出用户与客户 | import-users-from-csv-with-meta |
| Independent Analytics Pro | independent-analytics-pro |
| InstaWP Connect – 一键式 WP 暂存与迁移 | instawp-connect |
| Iptanus 文件上传 | wp-file-upload |
| JetElements | jet-elements |
| JetEngine | jet-engine |
| JetFormBuilder — 动态区块表单构建器 | jetformbuilder |
| JetSmartFilters | jet-smart-filters |
| Joinchat – 增强版“点击聊天” | creame-whatsapp-me |
| JoomSport – 运动管理：团队与联赛、足球、冰球等 | joomsport-sports-league-results-management |
| JS Help Desk – AI 驱动的支持与工单系统 | js-support-ticket |
| Jupiter X Core | jupiterx-core |
| Kadence Blocks — Gutenberg 编辑器页面构建工具包 | kadence-blocks |
| Kali Forms — 联系表单及拖放式构建器 | kali-forms |
| Kirki – 自由形式页面构建器、网站构建器及自定义工具 | kirki |
| Kit（原 ConvertKit）– 邮件订阅者、邮件简报、邮件营销、落地页及会员服务 | convertkit |
| 视频延迟加载 | lazy-load-for-videos |
| LeadSnap | leadsnap |
| LearnPress – 用于创建和销售在线课程的 WordPress LMS 插件 | learnpress |
| LetterPress – 电子邮件营销、SMTP、简报与多品牌订户管理器 | letterpress |
点赞按钮评分  LikeBtn |
likebtn-like-button |
| 链接库 | link-library |
| LiteSpeed Cache | litespeed-cache |
| LogixFast Auth | logixfast-auth |
| Logo Slider – 标志轮播、标志展示、标志库与客户标志 | gs-logo-slider |
| 邮件记录与捕获 | wp-mail-catcher |
| MailPoet – 简报、电子邮件营销与自动化 | mailpoet |
| Majestic Support – 领先业界的帮助台与客户支持插件 | majestic-support |
| Mang Board | mangboard |
| MapPress – 用于 Google Maps 与 OpenStreetMap 的免费地图插件 | mappress-google-maps-for-wordpress |
| Mapster WP Maps | mapster-wp-maps |
| Masteriyo LMS – LMS 课程构建器、测验与证书 | learning-management-system |
| MasterStudy LMS WordPress 插件 – 面向在线课程与教育 | masterstudy-lms-learning-management-system |
| 媒体库助手 | media-library-assistant |
| Elementor 媒体播放器附加组件 – Elementor 的音频和视频小部件 | media-player-addons-for-elementor |
| Memberpress | memberpress |
| MembershipWorks – 会员、活动与目录 | memberfindme |
| WooCommerce 菜单购物车 | woocommerce-menu-bar-cart |
| Meow Gallery | meow-gallery |
| Meow Lightbox | meow-lightbox |
| Meta Box – 动态网站框架 | meta-box |
| Motors – 汽车经销与分类信息插件 | motors-car-dealership-classified-listings |
| MP3 音频播放器 – Sonaar 的音乐播放器、播客播放器与收音机 | mp3-music-player-by-sonaar |
| MPG – 多页面生成器、批量落地页与程序化 SEO | multiple-pages-generator-by-porthas |
| MultiVendorX – WooCommerce 多供应商市场 AI 驱动解决方案 | dc-woocommerce-multi-vendor |
| MW WP Form | mw-wp-form |
| MxChat – 适用于 WordPress 的 AI 聊天机器人与内容生成 | mxchat-basic |
| 我的 Allegro 拍卖 | my-auctions-allegro-free-edition |
| My Calendar – 无障碍活动管理器 | my-calendar |
| myPOS 结账 | mypos-virtual-for-woocommerce |
| Elementor 新闻套件附加组件 | news-kit-elementor-addons |
| 简报 | newsletters-lite |
| NewsmanApp | newsmanapp |
| NEX-Forms – WordPress 的终极表单插件 | nex-forms-express-wp-form-builder |
| Ninja Forms – 带有计算器、测验、签名与 AI 表单构建器的联系表单构建器 | ninja-forms |
| OpenStation – 管理后台便签、自定义仪表板、AI 助手与 PWA | desktop-mode |
| Optima Express IDX | optima-express |
| 使用电话号码和 OTP 验证登录 | login-with-phone-number |
| 页面和文章访问限制 | page-and-post-restriction |
| SiteOrigin 页面构建器 | siteorigin-panels |
| Panorama – 将照片转换为沉浸式虚拟游览 | panorama |
| 密码保护 | password-protected |
| WooCommerce Payable 支付网关 | payable-payment-gateway-for-woocommerce |
| 适用于 WooCommerce 的 PAYCOMET | paytpv-for-woocommerce |
| Payconiq | wc-payconiq |
| PayHere 支付网关 | payhere-payment-gateway |
| Paystack 支付表单 | payment-forms-for-paystack |
| 支付表单、立即购买按钮与开票系统 | GetPaid | invoicing |
| 适用于 WooCommerce 的 PayPal Brasil | paypal-brasil-para-woocommerce |
| PayPlug for WooCommerce（官方） | payplug |
| 适用于 WooCommerce 的 PDF 发票 + 拖放式模板构建器 | pdf-for-woocommerce |
| 适用于 WooCommerce 的 PDF 发票与装箱单 | woocommerce-pdf-invoices-packing-slips |
| 适用于 WooCommerce 的 PDF 发票与装箱单 | pdf-invoices-for-woocommerce |
| PDF Poster – 让访客无需离开页面即可阅读 PDF | pdf-poster |
| Perfect Images：重新生成缩略图、图像尺寸、WebP 和 AVIF | wp-retina-2x |
| Phoenix Media Rename | phoenix-media-rename |
| Photo Engine（媒体整理器与 Lightroom） | wplr-sync |
| 照片库、滑块、样片确认和主题 – NextGEN Gallery | nextgen-gallery |
| Pie Register Premium | pie-register-premium |
| PiWeb 为 WooCommerce 禁用支付方式／支持部分付款 | disable-payment-method-for-woocommerce |
| 游戏化积分管理系统、等级、徽章和忠诚度奖励计划 – myCred | mycred |
| Popup Builder – 创建高转化率、对移动端友好的营销弹窗。 | popup-builder |
| Post Snippets – WordPress 自定义代码片段定制器 | post-snippets |
| Postie | postie |
| PPWP – 密码保护页面 | password-protect-page |
| Premium Packages – 安全销售数字产品 | wpdm-premium-packages |
| Prime Slider – Elementor 的主视觉滑块、轮播、WooCommerce 和文章滑块扩展 | bdthemes-prime-slider-lite |
| WooCommerce 产品附加项 – 使用自定义字段添加产品选项 | woo-custom-product-addons |
| PixelYourSite 提供的商品目录信息源 | product-catalog-feed |
| WooCommerce WordPress 产品设计器 | Lumise | lumise |
| WooCommerce 产品信息源管理器 – RexFeed – 在 200+ 购物渠道销售 | best-woocommerce-feed |
| WBW 提供的 WooCommerce 产品筛选器 | woo-product-filter |
| WooCommerce 产品导入导出 – CSV 产品导入器和导出器 | product-import-export-for-woo |
| ProfileGrid – 用户资料、群组和社区 | profilegrid-user-profiles-groups-and-communities |
| Project Manager – AI 驱动的项目管理、任务管理、看板和时间追踪 | wedevs-project-manager |
| Qode Membership | qode-membership |
| Quick Event Manager | quick-event-manager |
| Rank Math SEO – 助您占据 SEO 排名的 AI SEO 工具 | seo-by-rank-math |
| Recipe Card Blocks Lite | recipe-card-blocks-by-wpzoom |
| Redux Framework | redux-framework |
| WordPress 相关文章 | related-posts-for-wp |
| Relevanssi – 更好的搜索 | relevanssi |
| Revopic – WooCommerce 照片评价 | woo-photo-reviews |
| Google Reviews 丰富展示 | widget-google-reviews |
| Rox Appointment Booking – 活动、日历和预约安排 | rox-appointment-booking |
| Royal Addons for Elementor – Elementor 扩展和模板套件 | royal-elementor-addons |
| Royal MCP – 通过 MCP 安全连接 Claude、ChatGPT 和任意 LLM | royal-mcp |
| Feedzy 提供的 RSS 聚合器 – 文章转自动发布、新闻和 YouTube 视频源聚合 | feedzy-rss-feeds |
| s2Member – 适用于各种会员体系、内容限制付费墙和会员访问订阅 | s2member |
| Schema App 结构化数据 | schema-app-structured-data-for-schemaorg |
| Security Optimizer – 一体化安全防护插件 | sg-security |
| 安全插件、防火墙和恶意软件扫描器，支持自动移除 | security-malware-firewall |
| SendPress 新闻通讯 | sendpress |
| SEO Engine – 面向 WordPress 的智能 SEO，支持 AI、结构化数据和重定向 | seo-engine |
| SEOPress – AI SEO 插件和站内 SEO | wp-seopress |
| WooCommerce 顺序订单编号 | sequential-order-numbers-for-woocommerce |
| Seraphinite 加速器 | seraphinite-accelerator |
| Shield Security – 智能机器人拦截、暴力登录保护与文件扫描 | wp-simple-firewall |
| 通过绘图定义配送区域的 WooCommerce 插件 | shipping-zones-by-drawing-for-woocommerce |
| ShopBuilder – 适用于 Elementor 的 WooCommerce 页面构建器 | shopbuilder |
| 基于 Cloudflare Turnstile 的简单验证码 | simple-cloudflare-turnstile |
| SimpleForm – 表单创建器，可将表单发送到聊天应用，并支持测验、投票和多线索通知 | simple-form |
| 站点评论 | site-reviews |
| Smart Post – 用于博客和新闻网站的文章网格、文章轮播、文章滑块 Gutenberg 区块 | post-carousel |
| SMS Alert – SMS 通知与 OTP 登录、货到付款验证、弃购挽回 | sms-alert |
| Social Snap — 社交分享按钮与点击发推 | socialsnap |
| Social Web Suite – 社交媒体自动发帖、自动发布 | social-web-suite |
| Solid Testimonials – 评价滑块、视频评价与客户评论 | gs-testimonial |
| Spectra Legacy – Gutenberg 区块 | ultimate-addons-for-gutenberg |
| Spexo Addons for Elementor – Elementor 小工具、超级菜单、弹窗构建器、模板套件和入门模板 | sastra-essential-addons-for-elementor |
| SSL Wireless 短信通知 | ssl-wireless-sms-notification |
| StreamCast – 通过时尚播放器将广播电台直播带到您的网站 | streamcast |
| Strong Testimonials | strong-testimonials |
| SureCart – 让实体商品、数字下载、订阅、捐赠和支付的销售变得简单 | surecart |
| SureDash – 社区、课程与会员仪表盘 | suredash |
| SureForms – 联系表单构建器、AI 表单、支付表单、调查与测验 | sureforms |
| TableOn – 可筛选的 WordPress 文章表格 | posts-table-filterable |
| Tainacan | tainacan |
| Text Typing – 通过动态打字标题吸引注意力 | text-typing |
| The Events Calendar | the-events-calendar |
| 创新型表单构建器 – IvyForms | ivyforms |
| The Plus Addons for Elementor – 超级菜单、页眉页脚、文章网格、AI 小工具与模板 | the-plus-addons-for-elementor-page-builder |
| The Post Grid – 用于文章网格的短代码、Gutenberg 区块和 Elementor 附加组件 | the-post-grid |
| Themify Builder | themify-builder |
| ThirstyAffiliates – 联盟链接、链接品牌化、链接追踪与营销插件 | thirstyaffiliates |
| Thrive Automator | thrive-automator |
| Timetics – 预约预订日历与排程 | timetics |
| Transliterator – 多语言和多文字系统文本转换 | serbian-transliteration |
| Travelly – 适用于 WooCommerce 的旅游与旅行预订管理器 | tour-booking-manager |
| 双因素身份验证 | tokenizer-two-factor-authentication |
| UiChemy – 将 Figma、提示词和 AI 构建成果转换为 Elementor、Gutenberg 和 Bricks 页面 | uichemy |
| Ultimate Addons for Elementor – 小工具、模板、WooCommerce 与页眉页脚构建器 | header-footer-elementor |
| Ultimate Member – 用户资料、注册、登录、会员目录、内容限制与会员资格插件 | ultimate-member |
| 适用于 LearnDash 的 Uncanny Toolkit | uncanny-learndash-toolkit |
| 适用于 WooCommerce 的 UniPAY 支付网关 | unipay-payment-gateway-for-woocommerce |
| 适用于 Elementor 的 Unlimited Elements | unlimited-elements-for-elementor |
| 适用于 WooCommerce 的追加销售漏斗构建器 – 创建追加销售、交叉销售、订单增购、经常购买商品和弹窗。 | upsell-order-bump-offer-for-woocommerce |
| 用户前端 – 会员、用户注册、用户资料、用户目录及内容限制与前端文章提交 | wp-user-frontend |
| 用户资料构建器 – 漂亮的用户注册表单、用户资料及用户角色编辑器 | profile-builder |
| 用户注册与会员 – 免费及付费会员、订阅、内容限制、用户资料、自定义用户注册与登录构建器 | user-registration |
| 用户提交文章 – 允许用户从前端提交文章 | user-submitted-posts |
| UsersWP – WP 前端登录表单、用户注册、用户资料及会员目录插件 | userswp |
| 视频图库区块 – 在可筛选的图库中展示您的视频 | video-gallery-block |
| YouTube 视频播放器 – 嵌入您的访客会喜欢的视频 | yt-player |
| VikRentCar 汽车租赁管理系统 | vikrentcar |
| vTables – CSV、Excel 与 JSON 数据表构建器 | vtables |
| W3 Total Cache | w3-total-cache |
| WooCommerce 等待名单（到货通知） | waitlist-woocommerce |
| WooCommerce 钱包系统 – 数字钱包、立即付款、即时返现、推荐计划、部分及订阅付款 | wallet-system-for-woocommerce |
| WC Shop Sync – WooCommerce 的 Square 支付网关与产品同步 | woosquare |
| WordPress Web 2.0 目录插件 | w2dc |
| Webheadcoder Contact Form 7 多步骤表单 | contact-form-7-multi-step-module |
| Webmention | webmention |
| Welcart 电子商务 | usc-e-shop |
| Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets | widget-options |
| Wild Apricot Login | wild-apricot-login |
| WooCommerce Extra Product Options Pro | woocommerce-extra-product-options-pro |
| WP Activity Log | wp-security-audit-log |
| WP BASE Booking of Appointments, Services and Events | wp-base-booking-of-appointments-services-and-events |
| WP Booking System – Booking Calendar | wp-booking-system |
| WP Crowdfunding | wp-crowdfunding |
| WP Customer Area | customer-area |
| WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | wp-data-access |
| WP Directory Kit | wpdirectorykit |
| WP Easy Pay – Payment and Donation Form Builder for Square | wp-easy-pay |
| WP Inventory Manager | wp-inventory-manager |
| WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | wp-job-portal |
| WP Media folders | wp-media-folders |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | wp-post-author |
| WP REST Cache | wp-rest-cache |
| WP Roster | wp-roster |
| Wp Social Login and Register Social Counter | wp-social |
| WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory | wp-user-manager |
| WP Visitor Statistics (Real Time Traffic) | wp-stats-manager |
| WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden | wp2leads |
| WPCargo Track & Trace | wpcargo |
| WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | wpfunnels |
| WPO365 | MICROSOFT 365 GRAPH MAILER | wpo365-msgraphmailer |
| WPOrLogin – Custom Login, Social Login, CAPTCHA & Security | wporlogin |
| YITH PayPal Express Checkout for WooCommerce | yith-paypal-express-checkout-for-woocommerce |
| YITH WooCommerce Product Add-Ons | yith-woocommerce-product-add-ons |
| Zippy | zippy |
| Zoho Flow – No-Code Workflow Automation | zoho-flow |
| افزونه پیامک ووکامرس | Persian WooCommerce SMS | persian-woocommerce-sms |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Avada | Website Builder For WordPress & WooCommerce | Avada |
| Newsmatic | newsmatic |
| OceanWP | oceanwp |
| Royal Event | Catering & Wedding Chef Wordpress Theme | royal-event |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-109516
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Bot for Telegram on WooCommerce [bot-for-telegram-on-woocommerce]
Researcher
agr0chal
More Details >
Chat AI with Dispatcher <= 2.3 - Unauthenticated Arbitrary File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-115245
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Chat AI with Dispatcher [chat-ai-with-dispatcher]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-103688
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Checkout Files Upload for WooCommerce [checkout-files-upload-woocommerce]
Researcher
Josef Azizov
More Details >
Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload
9.8
CVSS Rating
9.8 (Critical)
Patch Status
Patched
Published
Oct 31, 2026
Affected Software
Contact Form 7 [contact-form-7]
Researchers
Jakub Herman
Shinya Murakami
More Details >
Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-109218
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Contact Manager [contact-manager]
Researcher
sermsak
More Details >
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-103039
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Gravity Forms [gravityforms]
Researchers
Tin Pham (TF1T)
Hao Ngo
Trong Pham
More Details >
Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-106013
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Jupiter X Core [jupiterx-core]
Researcher
daroo
More Details >
LogixFast Auth <= 1.0.3 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-113616
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
LogixFast Auth [logixfast-auth]
Researcher
Naoki Kawahigashi
More Details >
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-109220
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
PDF Invoice for WooCommerce + Drag and Drop Template Builder [pdf-for-woocommerce]
Researcher
Osman Hussein
More Details >
Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-84999
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Pie Register Premium [pie-register-premium]
Researcher
Chu Thao Mai
More Details >
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-116512
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]
Researcher
Osman Hussein
More Details >
Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-92885
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Qode Membership [qode-membership]
Researcher
0xwackydawg
More Details >
SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-118235
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications [simple-form]
Researcher
whysocscs
More Details >
Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-119096
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Uncanny Toolkit for LearnDash [uncanny-learndash-toolkit]
Researcher
Kuba
More Details >
Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-103882
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress [acadlix]
Researcher
antaloaalonso
More Details >
Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-89270
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Popup Builder – Create highly converting, mobile friendly marketing popups. [popup-builder]
Researcher
braintx
More Details >
WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-116557
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Mohamed Amgad Khater (mamgad)
More Details >
Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-105894
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Ak Framework [ak-framework]
Researcher
lhking
More Details >
BuddyBoss Platform <= 3.5.0 - Authenticated (Subscriber+) Privilege Escalation
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-118082
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
BuddyBoss Platform [buddyboss-platform]
Researcher
Hung Bach Ngoc
More Details >
Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-104368
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Export and Import Users and Customers [users-customers-import-export-for-wp-woocommerce]
Researcher
Sebastian Albrecht (mySebbe)
More Details >
Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-89435
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable]
Researcher
Supakiad S. (m3ez)
More Details >
Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-75891
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
daroo
More Details >
Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-92797
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Memberpress [memberpress]
Researcher
Matthew Cowan
More Details >
OTP Login With Phone Number, OTP Verification <= 1.8.78 - Authenticated (Subscriber+) Account Takeover
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-115967
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
OTP Login With Phone Number, OTP Verification [login-with-phone-number]
Researcher
Peter Tang
More Details >
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-76010
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]
Researcher
khanhnv
More Details >
Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-1928
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
moochi
More Details >
Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-104012
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Rox Appointment Booking – Event, Calendar & Appointment Scheduling [rox-appointment-booking]
Researcher
Daryle Minor
More Details >
The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-109384
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
The Innovative Form Builder – IvyForms [ivyforms]
Researcher
Wordfence PRISM
More Details >
User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-120070
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]
Researcher
Kuba
More Details >
VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-111120
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Wordfence PRISM
More Details >
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.5 - Authenticated (Author+) Remote Code Execution
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-116852
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets [widget-options]
Researcher
sanghyeok Kim
More Details >
Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
8.7
CVSS Rating
8.7 (High)
CVE-ID
CVE-2025-8574
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Database Cleaner: Cleanup, Optimization & Repair [database-cleaner]
Researcher
Jonas Benjamin Friedli
More Details >
Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-115346
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Avada | Website Builder For WordPress & WooCommerce [Avada]
Researcher
Muhamad Visat
More Details >
Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-120538
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Yuto Hyakumoto
More Details >
Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-114422
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Enable Media Replace [enable-media-replace]
Researcher
Jakub Herman
More Details >
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-103693
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Frontend Dashboard [frontend-dashboard]
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
sungbyeongchan
More Details >
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.8.6.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-39738
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce [wp-marketing-automations]
Researcher
Shon Bida
More Details >
LeadSnap <= 1.25 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-90888
Patch Status
Unpatched
Published
Oct 30, 2026
Affected Software
LeadSnap [leadsnap]
Researcher
Ananda Dhakal
More Details >
Royal Event <= 2.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-119526
Patch Status
Unpatched
Published
Oct 30, 2026
Affected Software
Royal Event | Catering & Wedding Chef Wordpress Theme [royal-event]
Researcher
Bonds
More Details >
Security by CleanTalk <= 2.190 - Unauthenticated Authentication Bypass
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-114443
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Security Plugin, Firewall & Malware Scanner with Auto Removal [security-malware-firewall]
Researcher
Karthik
More Details >
SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-96228
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
SSL Wireless SMS Notification [ssl-wireless-sms-notification]
Researcher
antaloaalonso
More Details >
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-120574
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
hamachi_jp
More Details >
SureDash – Community, Courses & Member Dashboard <= 1.12.3 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-115604
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
SureDash – Community, Courses & Member Dashboard [suredash]
Researcher
yzx001
More Details >
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-115968
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]
Researcher
Ananda Dhakal
More Details >
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-119977
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
WordPress [wordpress]
Researcher
Umut Bayram
More Details >
Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-103898
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Wp Social Login and Register Social Counter [wp-social]
Researcher
Kumar Atul (Mandarin21)
More Details >
Zoho Flow – No-Code Workflow Automation <= 2.14.5 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62131
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Zoho Flow – No-Code Workflow Automation [zoho-flow]
Researcher
Ananda Dhakal
More Details >
10WebSocial <= 1.5.6 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-118081
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
10WebSocial [wd-instagram-feed]
Researcher
Ananda Dhakal
More Details >
Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-110305
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Sawyer
More Details >
affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-111255
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Wordfence PRISM
More Details >
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-110732
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine]
Researcher
satoshigpt2021-sketch
More Details >
Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-116613
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Animated Text Block – Add Typing and Looping Text Effects [animated-text-block]
Researcher
Wordfence PRISM
More Details >
Bookit — Booking & Appointment Calendar <= 2.6.0.6 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-62048
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Bookit — Booking & Appointment Calendar [bookit]
Researcher
AndrewN
More Details >
BuddyPress Xprofile Custom Field Types <= 1.3.1 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-116868
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
BuddyPress Xprofile Custom Field Types [bp-xprofile-custom-field-types]
Researcher
Ananda Dhakal
More Details >
DXP ToolKit <= 2.0.1 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-115607
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
DXP ToolKit [dxp-toolkit]
Researcher
V1T
More Details >
Dynamic QR Code – generator <= 1.0.1 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-116867
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Dynamic QR Code – generator [dynamic-qr-code]
Researcher
Ananda Dhakal
More Details >
Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-107630
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Email Templates Customizer and Designer for WordPress and WooCommerce [email-templates]
Researcher
Kuba
More Details >
Enable Media Replace <= 4.2.2 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-73186
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Enable Media Replace [enable-media-replace]
Researcher
Asim Alshaya
More Details >
Extra Fees for WooCommerce <= 4.4.0 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-116866
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Extra Fees for WooCommerce [woo-conditional-product-fees-for-checkout]
Researcher
Ananda Dhakal
More Details >
Filter Everything — WordPress & WooCommerce Filters <= 1.9.7 - Authenticated (Author+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-116390
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Filter Everything — WordPress & WooCommerce Filters [filter-everything]
Researcher
Ananda Dhakal
More Details >
Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-97638
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
Wordfence Argus
More Details >
Frisbii Pay <= 1.8.19 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-118076
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Frisbii Pay [reepay-checkout-gateway]
Researcher
Ananda Dhakal
More Details >
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.8.5.2 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-111411
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce [wp-marketing-automations]
Researcher
AndrewN
More Details >
FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-119163
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce [wp-marketing-automations]
Researcher
R3D
More Details >
Logo Slider – Logo Carousel, Logo Showcase, Logo Gallery & Client Logos <= 3.8.9 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-116391
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Logo Slider – Logo Carousel, Logo Showcase, Logo Gallery & Client Logos [gs-logo-slider]
Researcher
Ananda Dhakal
More Details >
Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-120040
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Mail logging & Catcher [wp-mail-catcher]
Researcher
Duc Manh
More Details >
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.55 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-118090
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Siyang Wu
More Details >
Motors – Car Dealership & Classified Listings Plugin <= 1.4.126 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-115964
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
anhdung1329
More Details >
News Kit Addons For Elementor <= 1.5.0 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-118073
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
News Kit Addons For Elementor [news-kit-elementor-addons]
Researcher
Ananda Dhakal
More Details >
Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-110184
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Newsmatic [newsmatic]
Researcher
Kuba
More Details >
Phoenix Media Rename <= 3.13.5 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-116389
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Phoenix Media Rename [phoenix-media-rename]
Researcher
Ananda Dhakal
More Details >
Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-76012
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]
Researcher
khanhnv
More Details >
Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-15323
Patch Status
Unpatched
Published
Oct 27, 2026
Affected Software
Product Designer for WooCommerce WordPress | Lumise [lumise]
Researcher
Bao Le
More Details >
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-93855
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
SendPress Newsletters [sendpress]
Researcher
vulnmode
More Details >
Social Snap — Social Share Buttons & Click to Tweet <= 1.5.4 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-118080
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Social Snap — Social Share Buttons & Click to Tweet [socialsnap]
Researcher
Ananda Dhakal
More Details >
Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-93904
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]
Researcher
nthng
More Details >
Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews <= 3.3.10 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-78527
Patch Status
Unpatched
Published
Oct 30, 2026
Affected Software
Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews [gs-testimonial]
Researcher
Ananda Dhakal
More Details >
Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor <= 1.2.3 - Authenticated (Author+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-118077
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor [sastra-essential-addons-for-elementor]
Researcher
Ananda Dhakal
More Details >
Transliterator – Multilingual and Multi-script Text Conversion <= 2.5.13 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-39732
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Transliterator – Multilingual and Multi-script Text Conversion [serbian-transliteration]
Researcher
Mor Golan
More Details >
Unlimited Elements for Elementor <= 2.0.26 - Authenticated (Contributor+) Local File Inclusion
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-62121
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Siyang Wu
More Details >
vTables <= 0.2 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89216
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
vTables – Data Table Builder for CSV, Excel & JSON [vtables]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-93757
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Wild Apricot Login [wild-apricot-login]
Researcher
zickzick2
More Details >
WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-109197
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Spy0x7
More Details >
WP Easy Pay – Payment and Donation Form Builder for Square <= 4.5.4 - Unauthenticated Path Traversal
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-39734
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WP Easy Pay – Payment and Donation Form Builder for Square [wp-easy-pay]
Researcher
mroccon
More Details >
WP Media folders <= 1.1.10 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-118075
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
WP Media folders [wp-media-folders]
Researcher
Ananda Dhakal
More Details >
WPCargo Track & Trace <= 8.0.5 - Authenticated (Author+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-116864
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
WPCargo Track & Trace [wpcargo]
Researcher
Ananda Dhakal
More Details >
Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
7.4
CVSS Rating
7.4 (High)
CVE-ID
CVE-2026-118205
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
crow
More Details >
Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-110508
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Jashid Sany
More Details >
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.2 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-116386
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]
Researcher
mroccon
More Details >
Ad Inserter – Ad Manager & AdSense Ads <= 2.8.19 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-105077
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Md. Moniruzzaman Prodhan
More Details >
Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109995
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode [acf-views]
Researcher
nguyen viet tin
More Details >
Affiliate Program Suite — SliceWP Affiliates <= 1.2.13 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-115612
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Affiliate Program Suite — SliceWP Affiliates [slicewp]
Researcher
AndrewN
More Details >
affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-111314
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Wordfence PRISM
More Details >
AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109999
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot [ai-marketing-expert]
Researcher
Michael Perla (vizen5)
More Details >
All In One Login <= 2.4.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-94175
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
All In One Login [change-wp-admin-login]
Researcher
Intrudify
More Details >
AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-97019
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages]
Researcher
crow
More Details >
Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-111820
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Analytics Insights – Google Analytics Dashboard for WordPress [analytics-insights]
Researcher
hei
More Details >
BA Book Everything <= 1.8.33 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39786
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
BA Book Everything [ba-book-everything]
Researcher
AndrewN
More Details >
Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-86794
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Community Events [community-events]
Researcher
Yaswanth Reddy Sunkara
More Details >
Contact Form by Supsystic <= 1.11.0 - Authenticated (Administrator+) Remote Code Execution
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-115301
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]
Researcher
Karthik Ramakrishnan
More Details >
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation < 2.0.2 - Authenticated (Administrator+) Remote Code Execution
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-115223
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation [popup-by-supsystic]
Researcher
Karthik Ramakrishnan
More Details >
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation < 2.0.2 - Unauthenticated Server-Side Request Forgery
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-115225
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation [popup-by-supsystic]
Researcher
Karthik Ramakrishnan
More Details >
Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-120114
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Debug Log Manager – Conveniently Monitor and Inspect Errors [debug-log-manager]
Researcher
Josef Azizov (Spoofable)
More Details >
DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96741
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
DSGVO All in one for WP [dsgvo-all-in-one-for-wp]
Researcher
theviper17y
More Details >
DXP ToolKit <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-115606
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
DXP ToolKit [dxp-toolkit]
Researcher
V1T
More Details >
easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-112365
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution [easyjobs]
Researcher
poiri3r
More Details >
eCommerce Product Catalog <= 3.6.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-116851
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
eCommerce Product Catalog [ecommerce-product-catalog]
Researcher
pnn219
More Details >
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96894
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]
Researcher
rpgsec
More Details >
Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109381
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]
Researcher
Wordfence PRISM
More Details >
Fast Velocity Minify <= 3.5.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-48201
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Fast Velocity Minify [fast-velocity-minify]
Researcher
Alpaslan Fatih Sözer
More Details >
FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-110530
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
FeedWordPress [feedwordpress]
Researcher
Adrien Brunner
More Details >
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-116622
Patch Status
Unpatched
Published
Oct 29, 2026
Affected Software
Food Store – Online Food Delivery & Pickup [food-store]
Researcher
GivMeInJ
More Details >
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96669
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Food Store – Online Food Delivery & Pickup [food-store]
Researcher
Supakiad S. (m3ez)
More Details >
GlobalPayments Gateway Provider for WooCommerce <= 1.23.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-118085
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
GlobalPayments Gateway Provider for WooCommerce [global-payments-woocommerce]
Researcher
Sakri Koskimies
More Details >
Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-90437
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Gravity Forms [gravityforms]
Researcher
daroo
More Details >
Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-97645
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Gravity Forms [gravityforms]
Researcher
Supakiad S. (m3ez)
More Details >
Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104744
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Independent Analytics Pro [independent-analytics-pro]
Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
More Details >
Iptanus File Upload <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-66570
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Iptanus File Upload [wp-file-upload]
Researcher
fccsec.dev
More Details >
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Unauthenticated Arbitrary Shortcode Execution
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-119479
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Askar
More Details >
Mang Board <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-116847
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Mang Board [mangboard]
Researcher
John Ryan Albon
More Details >
Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107743
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Mapster WP Maps [mapster-wp-maps]
Researcher
whatm
More Details >
Menu Cart for WooCommerce < 3.2.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-105972
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Menu Cart for WooCommerce [woocommerce-menu-bar-cart]
Researcher
Jakub Herman
More Details >
Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109234
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Meow Lightbox [meow-lightbox]
Researcher
Santh
More Details >
MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-110662
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
MxChat – AI Chatbot & Content Generation for WordPress [mxchat-basic]
Researcher
Wordfence PRISM
More Details >
NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-115821
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
NewsmanApp [newsmanapp]
Researcher
poiri3r
More Details >
NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96767
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
nh4tvd
More Details >
Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109997
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]
Researcher
daroo
More Details >
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-115609
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Payment forms, Buy now buttons, and Invoicing System | GetPaid [invoicing]
Researcher
AndrewN
More Details >
PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107750
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips]
Researcher
churchill11
More Details >
PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-111578
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
PDF Invoices & Packing Slips For WooCommerce [pdf-invoices-for-woocommerce]
Researcher
Karthik Ramakrishnan
More Details >
PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-116520
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
PPWP – Password Protect Pages [password-protect-page]
Researcher
Sawyer
More Details >
Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-111111
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite]
Researcher
crow
More Details >
Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-116522
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Relevanssi – A Better Search [relevanssi]
Researcher
daroo
More Details >
Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96666
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Schema App Structured Data [schema-app-structured-data-for-schemaorg]
Researcher
theviper17y
More Details >
Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-118057
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall]
Researcher
Kevin Whelan
More Details >
Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-119065
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Shipping Zones by Drawing for WooCommerce [shipping-zones-by-drawing-for-woocommerce]
Researcher
Sebastian Albrecht (mySebbe)
More Details >
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107653
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
UKO
More Details >
ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-119089
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin [thirstyaffiliates]
Researcher
Sawyer
More Details >
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-54855
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
mroccon
More Details >
User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-119162
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
User Submitted Posts – Enable Users to Submit Posts from the Front End [user-submitted-posts]
Researcher
UKO
More Details >
VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-28160
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Nguyen Quang Tan
More Details >
VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-116548
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Junbo Zhuo
More Details >
VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-116405
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
methsploit
More Details >
VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-115840
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
whatm
More Details >
Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-117571
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
WP Visitor Statistics (Real Time Traffic) [wp-stats-manager]
Researcher
an7ln
More Details >
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-111254
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Santh
More Details >
Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-118070
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Sawyer
More Details >
WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-120075
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WP Activity Log [wp-security-audit-log]
Researcher(s): Unknown
More Details >
WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107759
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WPO365 | MICROSOFT 365 GRAPH MAILER [wpo365-msgraphmailer]
Researcher
Nick Verhelle (Bulldawg)
More Details >
Accordions <= 2.3.25 - Authenticated (Editor+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-116392
Patch Status
Unpatched
Published
Oct 26, 2026
Affected Software
Accordions [accordions]
Researcher
Ananda Dhakal
More Details >
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.3.1 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-115590
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]
Researcher
Ananda Dhakal
More Details >
Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.21.0 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-118074
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Finale Lite – Sales Countdown Timer & Discount for WooCommerce [finale-woocommerce-sales-countdown-timer-discount]
Researcher
Ananda Dhakal
More Details >
FV Flowplayer Video Player <= 7.5.56.7212 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-118079
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Ananda Dhakal
More Details >
myPOS Checkout <= 1.4.5 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-116869
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
myPOS Checkout [mypos-virtual-for-woocommerce]
Researcher
Ananda Dhakal
More Details >
Product Catalog Feed by PixelYourSite <= 3.1.4 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-118078
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Product Catalog Feed by PixelYourSite [product-catalog-feed]
Researcher
Ananda Dhakal
More Details >
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels <= 7.14.1 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-118089
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels [best-woocommerce-feed]
Researcher
Ananda Dhakal
More Details >
Zippy <= 1.7.0 - Authenticated (Editor+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-116865
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Zippy [zippy]
Researcher
Ananda Dhakal
More Details >
Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-102905
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Kuba
More Details >
Advanced Ads – Tracking < 4.0.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-115603
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Advanced Ads – Tracking [advanced-ads-tracking]
Researcher
dutafi
More Details >
Automated Import Products to Cart <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Read
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-113617
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Automated Import Products to Cart [auto-import-products-cart-dragdropfile]
Researcher
Naoki Kawahigashi
More Details >
BuddyPress <= 14.5.2 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-111850
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
BuddyPress [buddypress]
Researcher
Ayukiab
More Details >
BuddyPress <= 14.5.2 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-115965
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
BuddyPress [buddypress]
Researcher
AndrewN
More Details >
Bulk Media Register <= 2.0 - Authenticated (Author+) Path Traversal
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-118043
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Bulk Media Register [bulk-media-register]
Researcher
Rafael Honorato
More Details >
CF7 Mate – Contact Form 7 Styler, Multi-Step Forms & Conditional Logic <= 4.1.0 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-62057
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
CF7 Mate – Contact Form 7 Styler, Multi-Step Forms & Conditional Logic [cf7-styler-for-divi]
Researcher
braintx
More Details >
Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-5461
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
Emiliano Versini
More Details >
GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-118635
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Wordfence PRISM
More Details >
GIFTiT – Free Gifts for WooCommerce <= 4.5 - Unauthenticated Arbitrary Shortcode Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-52710
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
GIFTiT – Free Gifts for WooCommerce [ithemeland-free-gifts-for-woo]
Researcher
Nguyen Quang Tan
More Details >
JetEngine <= 3.9.0 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-115608
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
JetEngine [jet-engine]
Researcher
Ayukiab
More Details >
JetEngine <= 3.9.0.1 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-39736
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
JetEngine [jet-engine]
Researcher
nh4tvd
More Details >
JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-118192
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
JoomSport – for Sports: Team & League, Football, Hockey & more [joomsport-sports-league-results-management]
Researcher
Wordfence PRISM
More Details >
JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-118698
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
JoomSport – for Sports: Team & League, Football, Hockey & more [joomsport-sports-league-results-management]
Researcher
Wordfence PRISM
More Details >
Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-115820
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]
Researcher
sermsak
More Details >
Media Library Assistant <= 3.42 - Authenticated (Author+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-115948
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Khanh Nguyen
More Details >
Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-13747
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Meow Gallery [meow-gallery]
Researcher
Wordfence PRISM
More Details >
My Calendar – Accessible Event Manager 3.8.8 - 3.8.11 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-119714
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
My Calendar – Accessible Event Manager [my-calendar]
Researcher
Andres Poulin Mateos
More Details >
Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-100155
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]
Researcher
Kuba
More Details >
Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-118194
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Page and Post Restriction [page-and-post-restriction]
Researcher
Wordfence PRISM
More Details >
Recipe Card Blocks Lite 3.5.0 - 3.6.3 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-115281
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Recipe Card Blocks Lite [recipe-card-blocks-by-wpzoom]
Researcher
Jasper Weijts
More Details >
Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-103997
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Redux Framework [redux-framework]
Researcher
Kuba
More Details >
Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-110020
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Rich Showcase for Google Reviews [widget-google-reviews]
Researcher
Wordfence PRISM
More Details >
Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-92294
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]
Researcher
AlexHenry
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.0 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-25467
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
Filip Kowalski
More Details >
UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-119980
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp]
Researcher
Kuba
More Details >
VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-116750
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Wordfence PRISM
More Details >
Web 2.0 Directory <= 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_filter' Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-15272
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Web 2.0 Directory plugin for WordPress [w2dc]
Researcher
Rafie Muhammad
More Details >
WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-76005
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
WP Inventory Manager [wp-inventory-manager]
Researcher
Wordfence PRISM
More Details >
WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-116609
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
WP Visitor Statistics (Real Time Traffic) [wp-stats-manager]
Researcher
Wordfence PRISM
More Details >
WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2025-9462
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden [wp2leads]
Researcher
Peter Thaleikis
More Details >
Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118094
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Deva Parekh
More Details >
All In One Lightbox – show any media in beautiful popups <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116395
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
All In One Lightbox – show any media in beautiful popups [lightbox-block]
Researcher
V1T
More Details >
All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109974
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery]
Researcher
Wordfence PRISM
More Details >
All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109209
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery]
Researcher
poiri3r
More Details >
Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111727
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Appointment Booking Calendar [appointment-booking-calendar]
Researcher
Wordfence PRISM
More Details >
Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104729
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Avada (Fusion) Builder [fusion-builder]
Researcher
Wordfence PRISM
More Details >
Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103370
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]
Researcher
Matthew Lapinski
More Details >
Better Post & Filter Widgets for Elementor <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115950
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Better Post & Filter Widgets for Elementor [better-post-filter-widgets-for-elementor]
Researcher
Peter Tang
More Details >
Blocksy Companion <= 2.1.60 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-65444
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Blocksy Companion [blocksy-companion]
Researcher
Jacek Sowiński (dzaku)
More Details >
Booking for Appointments and Events Calendar – Amelia <= 2.4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116396
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Jacek Sowiński (dzaku)
More Details >
bSlider – Build Sliders That Bring Your Content to Life <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115961
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
bSlider – Build Sliders That Bring Your Content to Life [b-slider]
Researcher
V1T
More Details >
BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96554
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
BuddyBoss Platform [buddyboss-platform]
Researcher
Adrien Brunner
More Details >
Button Block – Stylish buttons that get more clicks <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116400
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Button Block – Stylish buttons that get more clicks [button-block]
Researcher
V1T
More Details >
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115610
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors [publishpress-authors]
Researcher
Jacek Sowiński (dzaku)
More Details >
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111592
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors [publishpress-authors]
Researcher
muhammad nizar
More Details >
Content Slider Block – Bring your content to life with slides <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116398
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Content Slider Block – Bring your content to life with slides [content-slider-block]
Researcher
V1T
More Details >
Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118500
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Cool FormKit Lite – Advanced Form Builder for Elementor [extensions-for-elementor-form]
Researcher
Wordfence PRISM
More Details >
Copy Anything to Clipboard for WordPress – Copy Button, Copy Text & Copy Code < 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110524
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Copy Anything to Clipboard for WordPress – Copy Button, Copy Text & Copy Code [copy-the-code]
Researcher
John Ryan Albon
More Details >
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-24533
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox [cozy-addons]
Researcher
V1T
More Details >
Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109975
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox [cozy-addons]
Researcher
Wordfence PRISM
More Details >
Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109978
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox [cozy-addons]
Researcher
Wordfence PRISM
More Details >
CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-119176
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
CP Multi View Events Calendar [cp-multi-view-calendar]
Researcher
mrglwglwgl
More Details >
Discussion Board – WordPress Forum Plugin <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115957
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Discussion Board – WordPress Forum Plugin [wp-discussion-board]
Researcher
Peter Tang
More Details >
Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107765
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Discussion Board – WordPress Forum Plugin [wp-discussion-board]
Researcher
Adrien Brunner
More Details >
Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109370
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Document Embedder – let visitors read files without downloading [document-emberdder]
Researcher
Wordfence PRISM
More Details >
easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-108366
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution [easyjobs]
Researcher
Wordfence PRISM
More Details >
Enable SVG, WebP, and ICO Upload <= 1.1.5 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110505
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Enable SVG, WebP, and ICO Upload [enable-svg-webp-ico-upload]
Researcher
Pierre Rudloff
More Details >
Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110504
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Enable SVG, WebP, and ICO Upload [enable-svg-webp-ico-upload]
Researcher
Shyu Yang
More Details >
Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118634
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Events Made Easy [events-made-easy]
Researcher
Wordfence PRISM
More Details >
Firelight Lightbox <= 2.3.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118165
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Firelight Lightbox [easy-fancybox]
Researcher
Dmitrii Ignatyev
More Details >
Firelight Lightbox <= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118438
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Firelight Lightbox [easy-fancybox]
Researcher
Pierre Rudloff
More Details >
FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107711
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
FlexStock – Product Stock Sync with Google Sheets for WooCommerce [stock-sync-with-google-sheet-for-woocommerce]
Researcher
Morato Antoine
More Details >
FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110533
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
braintx
More Details >
Gallery PhotoBlocks <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114710
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Gallery PhotoBlocks [photoblocks-grid-gallery]
Researcher
Oly Hossen
More Details >
Gallery PhotoBlocks <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116408
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Gallery PhotoBlocks [photoblocks-grid-gallery]
Researcher
Supakiad S.
More Details >
Geo Mashup <= 1.13.22 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115953
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Geo Mashup [geo-mashup]
Researcher
M. Bal-Ghaoui
More Details >
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-113488
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Karthik Ramakrishnan
More Details >
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-113487
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Karthik Ramakrishnan
More Details >
GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116752
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Mohamed Amgad Khater (mamgad)
More Details >
GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-119113
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
churchill11
More Details >
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116850
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]
Researcher
Ayukiab
More Details >
HTML5 Video Player – embed fast, responsive videos with ease <= 2.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118097
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
HTML5 Video Player – embed fast, responsive videos with ease [html5-video-player]
Researcher
Intrudify
More Details >
Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107710
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Wordfence PRISM
More Details >
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104740
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so]
Researcher
Wordfence PRISM
More Details >
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118164
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so]
Researcher
Wordfence PRISM
More Details >
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103996
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so]
Researcher
Wordfence PRISM
More Details >
Image Gallery Block – Showcase Photos in Stunning Responsive Grids <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115613
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Image Gallery Block – Showcase Photos in Stunning Responsive Grids [3d-image-gallery]
Researcher
Ihsan Saddan
More Details >
Import and export users and customers <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-54862
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Jacek Sowiński (dzaku)
More Details >
JetElements <= 2.9.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114707
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
JetElements [jet-elements]
Researcher
nh4tvd
More Details >
JetElements <= 2.9.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-39737
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
JetElements [jet-elements]
Researcher
nh4tvd
More Details >
JetSmartFilters <= 3.8.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114708
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
JetSmartFilters [jet-smart-filters]
Researcher
nh4tvd
More Details >
JetSmartFilters <= 3.8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116857
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
JetSmartFilters [jet-smart-filters]
Researcher
nh4tvd
More Details >
Joinchat 6.3.2 - 6.4.1 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118071
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Joinchat – Enhanced “click to chat” [creame-whatsapp-me]
Researcher
Qi Qin
More Details >
Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-10511
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Jupiter X Core [jupiterx-core]
Researcher
theviper17y
More Details >
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.8.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115602
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Jacek Sowiński (dzaku)
More Details >
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.8.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-39742
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
fccsec.dev
More Details >
Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-48196
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]
Researcher
mroccon
More Details >
Lazy Load for Videos <= 2.18.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115951
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Lazy Load for Videos [lazy-load-for-videos]
Researcher
Peter Tang
More Details >
LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109215
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Adrien Brunner
More Details >
Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110071
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Mang Board [mangboard]
Researcher
Wordfence PRISM
More Details >
Media Library Assistant <= 3.42 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118095
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Deva Parekh
More Details >
Media Library Assistant <= 3.43 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-113482
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Karthik Ramakrishnan
More Details >
Media Player Addons for Elementor – Audio and Video Widgets for Elementor <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-119365
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Media Player Addons for Elementor – Audio and Video Widgets for Elementor [media-player-addons-for-elementor]
Researcher
Ihsan Saddan
More Details >
Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-9239
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Meow Gallery [meow-gallery]
Researcher
Yat
More Details >
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.9 - 5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111967
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Hexxed BitHeadz
More Details >
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO < 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-119054
Patch Status
Unpatched
Published
Oct 29, 2026
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researcher
pnn219
More Details >
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114711
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
leon figueira
More Details >
Page Builder by SiteOrigin < 2.38.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110506
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Page Builder by SiteOrigin [siteorigin-panels]
Researcher
Mike Gozdiskowski
More Details >
Panorama – Turn Photos into Immersive Virtual Tours <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115956
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Panorama – Turn Photos into Immersive Virtual Tours [panorama]
Researcher
V1T
More Details >
Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-93293
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Password Protected [password-protected]
Researcher
daroo
More Details >
PDF Poster – Let visitors read PDF’s without leaving the page <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-48195
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
PDF Poster – Let visitors read PDF’s without leaving the page [pdf-poster]
Researcher
mroccon
More Details >
Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-120575
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Photo Engine (Media Organizer & Lightroom) [wplr-sync]
Researcher
Wordfence PRISM
More Details >
Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-77871
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Post Snippets – Custom WordPress Code Snippets Customizer [post-snippets]
Researcher
Wordfence PRISM
More Details >
Product Import Export for WooCommerce – CSV Product Importer & Exporter 2.5.1 - 2.6.8 - Authenticated (Shop Manager+) Server-Side Request Forgery
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118989
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Product Import Export for WooCommerce – CSV Product Importer & Exporter [product-import-export-for-woo]
Researcher
Sarvar Eshboyev
More Details >
Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102918
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Redux Framework [redux-framework]
Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
More Details >
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-112865
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Intrudify
More Details >
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97254
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
nh4tvd
More Details >
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1037 - 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107098
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Venkateswara Reddy Challa
More Details >
s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109972
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions [s2member]
Researcher
Wordfence PRISM
More Details >
SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-120552
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress [seo-engine]
Researcher
Wordfence PRISM
More Details >
SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116535
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]
Researcher
Yuto Hyakumoto
More Details >
Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104727
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Sequential Order Numbers for WooCommerce [sequential-order-numbers-for-woocommerce]
Researcher
Wordfence PRISM
More Details >
Site Reviews <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-118087
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Site Reviews [site-reviews]
Researcher
Jacek Sowiński (dzaku)
More Details >
Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-119160
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News [post-carousel]
Researcher
Jacek Sowiński (dzaku)
More Details >
StreamCast – bring live radio to your site with a sleek player <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116849
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
StreamCast – bring live radio to your site with a sleek player [streamcast]
Researcher
V1T
More Details >
Strong Testimonials <= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114706
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
nizar yart
More Details >
SureDash – Community, Courses & Member Dashboard <= 1.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110881
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
SureDash – Community, Courses & Member Dashboard [suredash]
Researcher
yzx001
More Details >
Text Typing – grab attention with animated typing headlines <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115966
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Text Typing – grab attention with animated typing headlines [text-typing]
Researcher
V1T
More Details >
The Events Calendar <= 6.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-119370
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
The Events Calendar [the-events-calendar]
Researcher
fccsec.dev
More Details >
The Events Calendar <= 6.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-119369
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
The Events Calendar [the-events-calendar]
Researcher
fccsec.dev
More Details >
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116848
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates [the-plus-addons-for-elementor-page-builder]
Researcher
Deva Parekh
More Details >
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-56056
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid [the-post-grid]
Researcher
Jacek Sowiński (dzaku)
More Details >
Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-115869
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Themify Builder [themify-builder]
Researcher
Wordfence PRISM
More Details >
Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109590
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Travelly – Tour & Travel Booking Manager for WooCommerce [tour-booking-manager]
Researcher
Wordfence PRISM
More Details >
UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109385
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks [uichemy]
Researcher
Wordfence PRISM
More Details >
Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107625
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]
Researcher
UKO
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-27061
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
Filip Kowalski
More Details >
Video Gallery Block – showcase your videos in a filterable gallery <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-52709
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Video Gallery Block – showcase your videos in a filterable gallery [video-gallery-block]
Researcher
Harry Nguyen
More Details >
VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116749
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Wordfence PRISM
More Details >
Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-77188
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Waitlist Woocommerce ( Back in stock notifier ) [waitlist-woocommerce]
Researcher
Wordfence PRISM
More Details >
WordPress Core 5.0.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Customizer Selective Refresh
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Rafie Muhammad
More Details >
WordPress Core 5.0.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Non-HTML Whitespace in Block Delimiters
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Rafie Muhammad
More Details >
WordPress Core 5.9.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Block Labels
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Alex Concha
More Details >
WordPress Core 6.4.0 - 7.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via Interactivity Router Uploaded Text Files
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Anas cherni
More Details >
WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image and Playlist Blocks
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Ben Bidner
More Details >
WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Prototype Pollution
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
rekter0
More Details >
WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Event Handler Bindings
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Jon Surrell
More Details >
WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API URL Bindings
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Luis Herranz
More Details >
WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity Script Module Data Shadowing
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Weston Ruter
More Details >
WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Unsafe Interactivity API Binding Properties
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researchers
Alex Concha
Jon Surrell
rekter0
Marcel Karlsson
More Details >
WordPress Core 6.7.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Categories Block
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Ben Bidner
More Details >
WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116854
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WP Customer Area [customer-area]
Researcher
j1g3n
More Details >
WP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-116546
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website [wp-job-portal]
Researcher
Adrien Brunner
More Details >
BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-76780
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility [beyondseo]
Researcher
Wordfence PRISM
More Details >
Essential Addons for Elementor 6.6.0 - 6.8.7 - Authenticated (Author+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-110808
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Adam Kahlon (Adkali)
More Details >
GoSMTP – SMTP for WordPress < 1.2.5 - Authenticated (Custom Role+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-111577
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
GoSMTP – SMTP for WordPress [gosmtp]
Researcher
Charles Vosburgh
More Details >
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Authenticated (Contributor+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-54854
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
Dthangws
More Details >
WP BASE Booking of Appointments, Services and Events <= 6.5.2 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-118086
Patch Status
Unpatched
Published
Oct 30, 2026
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
m1ngt
More Details >
Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-114709
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
yzx001
More Details >
Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-101935
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search [echo-knowledge-base]
Researcher
crow
More Details >
eCommerce Product Catalog <= 3.6.4 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-115596
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
eCommerce Product Catalog [ecommerce-product-catalog]
Researcher
Mor Golan
More Details >
Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-91152
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms]
Researcher
Yuto Hyakumoto
More Details >
MailPoet – Newsletters, Email Marketing, and Automation < 5.14.2 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
MailPoet – Newsletters, Email Marketing, and Automation [mailpoet]
Researcher
Mruk
More Details >
Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-100151
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]
Researcher
Kuba
More Details >
OceanWP <= 4.2.7 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-115592
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
OceanWP [oceanwp]
Researcher
Intrudify
More Details >
Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-88942
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Product Filter for WooCommerce by WBW [woo-product-filter]
Researcher
crow
More Details >
TableOn – WordPress Posts Table Filterable <= 1.0.7 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-115611
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
TableOn – WordPress Posts Table Filterable [posts-table-filterable]
Researcher
Oly Hossen
More Details >
Unlimited Elements for Elementor <= 2.0.24 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-115593
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
AndrewN
More Details >
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.7 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-116409
Patch Status
Unpatched
Published
Oct 27, 2026
Affected Software
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. [upsell-order-bump-offer-for-woocommerce]
Researcher
Ananda Dhakal
More Details >
User Frontend <= 4.3.13 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-115277
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]
Researcher
Jasper Weijts
More Details >
User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-103962
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]
Researcher
Dthangws
More Details >
Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-92098
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Webheadcoder Multi-Step Forms for Contact Form 7 [contact-form-7-multi-step-module]
Researcher
Fraudless
More Details >
Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-111109
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Webmention [webmention]
Researcher
poiri3r
More Details >
WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-104926
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WooCommerce Extra Product Options Pro [woocommerce-extra-product-options-pro]
Researcher
theviper17y
More Details >
افزونه پیامک ووکامرس | Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-111021
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
افزونه پیامک ووکامرس | Persian WooCommerce SMS [persian-woocommerce-sms]
Researcher
Zahid Abbasi
More Details >
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters
5.9
CVSS Rating
5.9 (Medium)
CVE-ID
CVE-2026-110185
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More [bit-pi]
Researcher
Wordfence PRISM
More Details >
WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter
5.9
CVSS Rating
5.9 (Medium)
CVE-ID
CVE-2026-110023
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps [wp-data-access]
Researcher
Kuba
More Details >
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated CSV Injection
5.8
CVSS Rating
5.8 (Medium)
CVE-ID
CVE-2026-67187
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]
Researcher
Choriyev Qahramon
More Details >
Advanced Post Block – Display Your Posts Exactly How You Want <= 2.5.1 - Authenticated (Contributor+) Cross-Site Scripting
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-115955
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Advanced Post Block – Display Your Posts Exactly How You Want [advanced-post-block]
Researcher
V1T
More Details >
CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-116761
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
CMB2 [cmb2]
Researcher
Jakub Herman
More Details >
Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-111070
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Content Pilot – Autoblogging & Affiliate Marketing Suite [wp-content-pilot]
Researcher
Adrien Brunner
More Details >
Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-103485
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Extensions for Leaflet Map [extensions-leaflet-map]
Researcher
zickzick2
More Details >
FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-109984
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
satoshigpt2021-sketch
More Details >
FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-110001
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Kuba
More Details >
Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-107627
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]
Researcher
UKO
More Details >
Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-107629
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]
Researcher
UKO
More Details >
HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-111318
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
UKO
More Details >
LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-116763
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Santh
More Details >
Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-101326
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]
Researcher
Iron StrongMan
More Details >
Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-116563
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]
Researcher
UKO
More Details >
Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-110251
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Revopic – Photo Reviews for WooCommerce [woo-photo-reviews]
Researcher
Kuba
More Details >
Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-100175
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Postie [postie]
Researcher
Wordfence PRISM
More Details >
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder <= 2.9.5 - Authenticated (Contributor+) Cross-Site Scripting
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-39739
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder [header-footer-elementor]
Researcher
fccsec.dev
More Details >
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-120019
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Santh
More Details >
Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-2839
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Jay
More Details >
AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-120578
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
AI Alt Text Generator [ai-alt-text-generator]
Researcher
Wordfence PRISM
More Details >
All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109367
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack]
Researcher
Santh
More Details >
All-in-One Video Gallery <= 4.0.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118629
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery]
Researcher
vuxvinh
More Details >
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115614
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment [booking-and-rental-manager-for-woocommerce]
Researcher
Sangho Lee
More Details >
Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116388
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
yzx001
More Details >
Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103915
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Kuba
More Details >
Booking Package < 1.7.33 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105997
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Booking Package [booking-package]
Researcher
Pedro Pinho
More Details >
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.31 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62122
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Booktics – Appointment Booking Calendar for Service Businesses [booktics]
Researcher
hera-user
More Details >
Bopo – WooCommerce Product Bundle Builder <= 1.2.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110377
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Bopo – WooCommerce Product Bundle Builder [bopo-woo-product-bundle-builder]
Researcher
Mash
More Details >
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content <= 0.8.8 - Unauthenticated Arbitrary Content Injection
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-48202
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content [brave-popup-builder]
Researcher
Peter Tang
More Details >
Bricks <= 2.4.0 - Missing Authorization to Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-119325
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Bricks Theme [UNKNOWN-CVE-2026-119325]
Researcher(s): Unknown
More Details >
Bricks Builder <= 2.4.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118804
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Bricks Builder [bricksbuilder]
Researcher
Omer Musaddaq
More Details >
BuddyForms <= 2.10.2 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118100
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
BuddyForms [buddyforms]
Researcher
Ryan Fabella
More Details >
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Arbitrary Guest Attachment Deletion
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118437
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
BuddyForms [buddyforms]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng < 4.2.0 - Unauthenticated Arbitrary Order Status Manipulation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103382
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng [casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang]
Researcher
Pedro Pinho
More Details >
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics <= 1.10.5 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115591
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]
Researcher
Oly Hossen
More Details >
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics <= 1.10.7 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115595
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]
Researcher
Mert Ural
More Details >
Contact Form by Supsystic <= 1.11.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115302
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]
Researcher
Md. Moniruzzaman Prodhan
More Details >
Contact Form by Supsystic <= 1.11.0 - Unauthenticated Arbitrary Email Header Injection
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115303
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]
Researcher
Emirhan Sevmez
More Details >
Court Reservation – Tennis, Padel & Sports Court Booking < 1.12.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106003
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Court Reservation – Tennis, Padel & Sports Court Booking [court-reservation]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Court Reservation – Tennis, Padel & Sports Court Booking < 1.12.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106002
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Court Reservation – Tennis, Padel & Sports Court Booking [court-reservation]
Researcher
Daniel Dhaniswara
More Details >
CryptoCloud – Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Status Manipulation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103327
Patch Status
Unpatched
Published
Oct 31, 2026
Affected Software
CryptoCloud – Crypto Payment Gateway [cryptocloud-crypto-payment-gateway]
Researcher
Naoki Kawahigashi
More Details >
Custom Price for WooCommerce <= 1.1.29 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115601
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Custom Price for WooCommerce [custom-price-for-woocommerce]
Researcher
ssophiz
More Details >
Discussion Board – WordPress Forum Plugin <= 2.6.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115958
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Discussion Board – WordPress Forum Plugin [wp-discussion-board]
Researcher
Peter Tang
More Details >
Document Library Lite <= 1.3.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-48200
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Document Library Lite [document-library-lite]
Researcher
Nixxies
More Details >
DT Directory Lite Addon <= 1.1 - Missing Authorization to Unauthenticated Settings Update
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105993
Patch Status
Unpatched
Published
Oct 31, 2026
Affected Software
DT Directory Lite Addon [dt-directory-lite-addon]
Researcher
Usama Arshad
More Details >
E-cab Taxi Booking Manager for Woocommerce <= 2.1.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114181
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]
Researcher
Peter Tang
More Details >
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Unauthenticated Discount Code Limit Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116403
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Ananda Dhakal
More Details >
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110509
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Karthik Ramakrishnan
More Details >
Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-91075
Patch Status
Unpatched
Published
Oct 31, 2026
Affected Software
Eupago Gateway For Woocommerce [eupago-gateway-for-woocommerce]
Researcher
Seongwon Lee
More Details >
Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-91153
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms]
Researcher
muhammad nizar
More Details >
Flexible Chat – AI chatbot plugin for WordPress and WooCommerce <= 1.1.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116861
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Flexible Chat – AI chatbot plugin for WordPress and WooCommerce [flexible-chat]
Researcher
V1T
More Details >
Flexible Quantity & Price Calculator for WooCommerce <= 2.3.24 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116856
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Flexible Quantity & Price Calculator for WooCommerce [flexible-quantity-measurement-price-calculator-for-woocommerce]
Researcher
Peter Tang
More Details >
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62056
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution [fluent-crm]
Researcher
Ayukiab
More Details >
GEO my WP <= 4.5.5.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114193
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
GEO my WP [geo-my-wp]
Researcher
0xdr3n
More Details >
GeoDirectory <= 2.8.196 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114270
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Erwan LR
More Details >
GiveWP – Donation Plugin and Fundraising Platform <= 4.19.0.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116853
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Pablo Alaniz
More Details >
Hide Price Until Login <= 1.1.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110030
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Hide Price Until Login [hide-price-until-login]
Researcher
Naoki Kawahigashi
More Details >
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard <= 1.4.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116401
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard [woocommerce-products-filter]
Researcher
nizar yart
More Details >
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard <= 1.4.6 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115947
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard [woocommerce-products-filter]
Researcher
ssophiz
More Details >
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-119482
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Anatoly Gorbounov
More Details >
Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.27 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39782
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]
Researcher
nizar yart
More Details >
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated reCAPTCHA Validation Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112348
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
Choriyev Qahramon
More Details >
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership <= 3.4.7 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-27063
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership [convertkit]
Researcher
Taegyeong Yun
More Details >
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115598
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
ssophiz
More Details >
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115599
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
MinKhoy
More Details >
Link Library <= 7.9.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-78395
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Link Library [link-library]
Researcher
Daria Golikova
More Details >
Link Library <= 7.9.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-78396
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Link Library [link-library]
Researcher
Osman Hussein
More Details >
MapPress Maps for WordPress <= 2.97.14 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118168
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
MapPress – Free Map Plugin for Google Maps & OpenStreetMap [mappress-google-maps-for-wordpress]
Researcher
vuxvinh
More Details >
Mapster WP Maps <= 2.0.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118638
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Mapster WP Maps [mapster-wp-maps]
Researcher
Usama Arshad
More Details >
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.3 - Unauthenticated Arbitrary Content Deletion
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116410
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Sakri Koskimies
More Details >
MembershipWorks – Membership, Events & Directory <= 6.16 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112355
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
MembershipWorks – Membership, Events & Directory [memberfindme]
Researcher
buiih
More Details >
MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-92086
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
MW WP Form [mw-wp-form]
Researcher
RIA Labs
More Details >
Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-101325
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Newsletters [newsletters-lite]
Researcher
zickzick2
More Details >
Optima Express IDX <= 9.0.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116393
Patch Status
Unpatched
Published
Oct 26, 2026
Affected Software
Optima Express IDX [optima-express]
Researcher
buchan liang
More Details >
Page and Post Restriction <= 1.6.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-54852
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Page and Post Restriction [page-and-post-restriction]
Researcher
mj_404_error
More Details >
PAYable IPG <= 1.3.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94361
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Payable Payment Gateway for WooCommerce [payable-payment-gateway-for-woocommerce]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-88928
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
PAYCOMET for WooCommerce [paytpv-for-woocommerce]
Researcher
JunHee CHO
More Details >
Payconiq <= 1.0.4 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103372
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Payconiq [wc-payconiq]
Researcher
Naoki Kawahigashi
More Details >
PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103310
Patch Status
Unpatched
Published
Oct 29, 2026
Affected Software
PayHere Payment Gateway [payhere-payment-gateway]
Researcher
Naoki Kawahigashi
More Details >
PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-76058
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
PayPal Brasil para WooCommerce [paypal-brasil-para-woocommerce]
Researcher
Wordfence PRISM
More Details >
PayPlug for WooCommerce (Official) 2.8.0 - 3.1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-113813
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
PayPlug for WooCommerce (Official) [payplug]
Researcher
Sakri Koskimies
More Details >
PayPlug for WooCommerce (Official) 2.9.0 - 3.1.0 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110292
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
PayPlug for WooCommerce (Official) [payplug]
Researcher
Filip Kecman
More Details >
PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109217
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips]
Researcher
Santh
More Details >
PiWeb Disable payment method / Partial payment for WooCommerce < 1.1.10.9 - Missing Authorization to Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118757
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
PiWeb Disable payment method / Partial payment for WooCommerce [disable-payment-method-for-woocommerce]
Researcher
pnn219
More Details >
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 4.0.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97073
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]
Researcher
foehn
More Details >
Post Author <= 4.1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108685
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]
Researcher
Mutantgun
More Details >
Post Author <= 4.1.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108686
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]
Researcher
Mutantgun
More Details >
Premium Packages <= 7.2.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118184
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Ryan Fabella
More Details >
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels <= 7.14.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118093
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels [best-woocommerce-feed]
Researcher
mroccon
More Details >
Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-11396
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Product Filter for WooCommerce by WBW [woo-product-filter]
Researcher
pradeep suvarna
More Details >
Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-82214
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Quick Event Manager [quick-event-manager]
Researcher
Shikhali Jamalzade
More Details >
Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115282
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Recipe Card Blocks Lite [recipe-card-blocks-by-wpzoom]
Researcher
Ryan Fabella
More Details >
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1070 - Unauthenticated Unauthorized Email Relay
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106648
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Mohammed Abd Alrahman
More Details >
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1069 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97255
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Anthony Green of Greenhat Security
More Details >
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.71 - 1.7.1069 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107097
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Mohammed Abd Alrahman
More Details >
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.81 - 1.7.1069 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107100
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Maciek Komorowski
More Details >
Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-90960
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Seraphinite Accelerator [seraphinite-accelerator]
Researcher
Sawyer
More Details >
ShopBuilder – WooCommerce Builder For Elementor <= 3.4.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-54871
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
ShopBuilder – WooCommerce Builder For Elementor [shopbuilder]
Researcher
myhappyhoon
More Details >
Simple CAPTCHA with Cloudflare Turnstile <= 1.44.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39741
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Simple CAPTCHA with Cloudflare Turnstile [simple-cloudflare-turnstile]
Researcher
mroccon
More Details >
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116387
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms]
Researcher
Luke Schneider
More Details >
The Events Calendar <= 6.18.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-119368
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
The Events Calendar [the-events-calendar]
Researcher
ngvuthdanh
More Details >
Timetics – Appointment Booking Calendar & Scheduling <= 1.0.65 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116860
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Timetics – Appointment Booking Calendar & Scheduling [timetics]
Researcher
HAIMIN
More Details >
UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Arbitrary Order Status Manipulation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103331
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
UniPAY Payment Gateway For WooCommerce [unipay-payment-gateway-for-woocommerce]
Researcher
Naoki Kawahigashi
More Details >
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.13 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-48884
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]
Researcher
mroccon
More Details >
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-54853
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
Sangho Lee
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-25450
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
elba.code
More Details >
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115959
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce [woosquare]
Researcher
mroccon
More Details >
Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-119166
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
R3D
More Details >
WordPress Core 4.9.0 - 7.1.3 - Unauthenticated Sensitive Information Exposure via Customizer Changesets
5.3
CVSS Rating
5.3 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Antonio Lorensius Silaban
More Details >
WP Crowdfunding <= 2.2.2 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118083
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Ananda Dhakal
More Details >
WP REST Cache <= 2026.3.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116862
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WP REST Cache [wp-rest-cache]
Researcher
Peter Tang
More Details >
WP Roster < 2.35 - Missing Authorization to Unauthenticated Roster Member Deletion
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-115255
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
WP Roster [wp-roster]
Researcher
Erwan LR
More Details >
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-116846
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]
Researcher
mroccon
More Details >
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118088
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]
Researcher
Matthew Lapinski
More Details >
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-118091
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]
Researcher
Je22y
More Details >
WPOrLogin – Custom Login, Social Login, CAPTCHA & Security < 3.1.0 - Unauthenticated Login URL Settings Modification
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110691
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
WPOrLogin – Custom Login, Social Login, CAPTCHA & Security [wporlogin]
Researcher
Naoki Kawahigashi
More Details >
YITH PayPal Express Checkout for WooCommerce <= 1.62.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-27401
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
YITH PayPal Express Checkout for WooCommerce [yith-paypal-express-checkout-for-woocommerce]
Researcher
Luke Schneider
More Details >
YITH WooCommerce Product Add-Ons <= 4.34.0 - Unauthenticated Non-Public Product Data Disclosure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107868
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
YITH WooCommerce Product Add-Ons [yith-woocommerce-product-add-ons]
Researcher
Sebastian Albrecht (mySebbe)
More Details >
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation < 2.0.2 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-115224
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation [popup-by-supsystic]
Researcher
Karthik Ramakrishnan
More Details >
Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-118169
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Wordfence PRISM
More Details >
JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104739
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
Wordfence PRISM
More Details >
Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-109216
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Meta Box – A Framework for Dynamic Websites [meta-box]
Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
More Details >
Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104743
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Tainacan [tainacan]
Researcher
Wordfence PRISM
More Details >
Thrive Automator < 11.2 - Authenticated (Editor+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104694
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Thrive Automator [thrive-automator]
Researcher
Khanh Nguyen
More Details >
Visitor Statistics (Real Time Traffic) <= 8.7 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-117572
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
WP Visitor Statistics (Real Time Traffic) [wp-stats-manager]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Welcart e-Commerce < 2.12.6 - Authenticated (Editor+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-111027
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Karthik Ramakrishnan
More Details >
WordPress Core 4.7.0 - 7.1.3 - Authenticated (Custom+) Stored Cross-Site Scripting via Externally-Supplied User Login Values
4.9
CVSS Rating
4.9 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Anthropic
More Details >
Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
4.8
CVSS Rating
4.8 (Medium)
CVE-ID
CVE-2026-10752
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
normaandersonfrank
More Details >
Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter
4.8
CVSS Rating
4.8 (Medium)
CVE-ID
CVE-2026-109236
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Customer Email Verification for WooCommerce – OTP Verification, Block Fake Signups [customer-email-verification-for-woocommerce]
Researcher
Wordfence PRISM
More Details >
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.7.9 - Unauthenticated HTML Injection
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-116394
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]
Researcher
Askar
More Details >
Like Button Rating LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-116552
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Like Button Rating LikeBtn [likebtn-like-button]
Researcher
GivMeInJ
More Details >
Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-103875
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Kuba
More Details >
RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-110707
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds]
Researcher
hamachi_jp
More Details >
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 -Unauthenticated Arbitrary HTML Injection
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-116402
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms]
Researcher
Filip Kowalski
More Details >
Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-111031
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Osman Hussein
More Details >
DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute
4.4
CVSS Rating
4.4 (Medium)
CVE-ID
CVE-2026-111068
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
DesignSetGo [designsetgo]
Researcher
Wordfence PRISM
More Details >
LatePoint <= 5.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVSS Rating
4.4 (Medium)
CVE-ID
CVE-2026-105258
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Karthik Ramakrishnan
More Details >
LetterPress <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVSS Rating
4.4 (Medium)
CVE-ID
CVE-2024-3586
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
LetterPress – Email Marketing, SMTP, Newsletter & Multi-Brand Subscriber Manager [letterpress]
Researcher
SANU P.L
More Details >
Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter
4.4
CVSS Rating
4.4 (Medium)
CVE-ID
CVE-2026-109988
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Product Addons for Woocommerce – Product Options with Custom Fields [woo-custom-product-addons]
Researcher
Wordfence PRISM
More Details >
WordPress Core 4.9.6 - 7.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Personal Data Erasure Request Email Addresses
4.4
CVSS Rating
4.4 (Medium)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Anthropic
More Details >
AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111372
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
AI ChatBot for WooCommerce – WoowBot [woowbot-woocommerce-chatbot]
Researcher
Wordfence PRISM
More Details >
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.8.6 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112828
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine]
Researcher
Ahmad Naseem
More Details >
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.8.8 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-65566
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine]
Researcher
AndrewN
More Details >
Better Post & Filter Widgets for Elementor <= 1.9.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115949
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Better Post & Filter Widgets for Elementor [better-post-filter-widgets-for-elementor]
Researcher
Oly Hossen
More Details >
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-54850
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment [booking-and-rental-manager-for-woocommerce]
Researcher
ashv4ni
More Details >
Bookit — Booking & Appointment Calendar <= 2.6.0.6 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62019
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Bookit — Booking & Appointment Calendar [bookit]
Researcher
cazy
More Details >
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.31 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104674
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Booktics – Appointment Booking Calendar for Service Businesses [booktics]
Researcher
HAIMIN
More Details >
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.9 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115963
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]
Researcher
Oly Hossen
More Details >
BuddyForms <= 2.10.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-118101
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
BuddyForms [buddyforms]
Researcher
Furkan Arslan
More Details >
Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-116610
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Clean Login [clean-login]
Researcher
Wordfence PRISM
More Details >
Contact Form by Supsystic <= 1.11.0 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115300
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]
Researcher
Karthik Ramakrishnan
More Details >
Contact Form by Supsystic <= 1.11.0 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115299
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]
Researcher
Karthik Ramakrishnan
More Details >
Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-119087
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Content Egg – Affiliate Product Importer & Price Comparison [content-egg]
Researcher
Wordfence PRISM
More Details >
Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-119059
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Content Egg – Affiliate Product Importer & Price Comparison [content-egg]
Researcher
Wordfence PRISM
More Details >
Customer Coupons for WooCommerce <= 1.3.14 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112839
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Customer Coupons for WooCommerce [woo-customer-coupons]
Researcher
Arittro Sarkar
More Details >
DEPART – Deposit and Part payment for Woo <= 1.0.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110376
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
DEPART – Deposit and Part payment for Woo [depart-deposit-and-part-payment-for-woo]
Researcher
cazy
More Details >
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar <= 6.5.4 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-116406
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar [webba-booking-lite]
Researcher
HAIMIN
More Details >
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar <= 6.5.4 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-116407
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar [webba-booking-lite]
Researcher
Ganesh m
More Details >
Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-85655
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Enable Media Replace [enable-media-replace]
Researcher
Duy Tran
More Details >
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-25448
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]
Researcher
Peter Tang
More Details >
Event Tickets and Registration <= 5.30.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62047
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
awebitaL
More Details >
Event Tickets and Registration <= 5.30.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62055
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Elieve
More Details >
EventPrime – Events Calendar, Bookings, Tickets & AI <= 4.3.6.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-42691
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
EventPrime – Events Calendar, Bookings, Tickets & AI [eventprime-event-calendar-management]
Researcher
Peter Tang
More Details >
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.6 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62141
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution [fluent-crm]
Researcher
nizar yart
More Details >
Fraud Prevention For WooCommerce and EDD <= 2.3.5 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-118072
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Fraud Prevention For WooCommerce and EDD [woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers]
Researcher
Usama Arshad
More Details >
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.8.5.2 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111841
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce [wp-marketing-automations]
Researcher
AndrewN
More Details >
Geo Mashup <= 1.13.22 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115954
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Geo Mashup [geo-mashup]
Researcher
M. Bal-Ghaoui
More Details >
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.195 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-113494
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Jacek Sowiński
More Details >
Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109231
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Germanized for WooCommerce [woocommerce-germanized]
Researcher
Sawyer
More Details >
HANDMADE – Dropshipping for Etsy and WooCommerce <= 1.0.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112827
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
HANDMADE – Dropshipping for Etsy and WooCommerce [handmade-dropshipping-for-etsy-and-woo]
Researcher
Oly Hossen
More Details >
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109891
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]
Researcher
Peter Tang
More Details >
HivePress Claim Listings <= 1.1.4 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-42707
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
HivePress Claim Listings [hivepress-claim-listings]
Researcher
mroccon
More Details >
Hotel Booking <= 3.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-118084
Patch Status
Unpatched
Published
Oct 28, 2026
Affected Software
Hotel Booking [nd-booking]
Researcher
Ananda Dhakal
More Details >
Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109386
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Ekene Umegakwe
More Details >
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.4.2 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-116399
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]
Researcher
mroccon
More Details >
JetEngine <= 3.9.0.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39735
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
JetEngine [jet-engine]
Researcher
Ayukiab
More Details >
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Authenticated (Subscriber+) Arbitrary Media Attachment Deletion
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-119480
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
nizar yart
More Details >
Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.27 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-42703
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]
Researcher
Oly Hossen
More Details >
Kali Forms <= 2.4.29 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107342
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]
Researcher
Usama Arshad
More Details >
Kali Forms <= 2.4.29 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107343
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]
Researcher
Sai Praneeth Koti
More Details >
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115597
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
Harry Nguyen
More Details >
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.49 - Authenticated (Custom+) Path Traversal
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-80067
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Jon Bytyçi
More Details >
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.49 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-80069
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Jon Bytyçi
More Details >
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.55 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-118092
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Jayant Kamble
More Details >
Media Library Assistant < 3.42 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-113485
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Karthik Ramakrishnan
More Details >
Media Library Assistant < 3.42 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-113486
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Sobhan Hosseinpour
More Details >
Media Library Assistant <= 3.42 - Authenticated (Contributor+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115594
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Deva Parekh
More Details >
Media Library Assistant <= 3.42 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-97295
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
yzx001
More Details >
Media Library Assistant <= 3.43 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-113481
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Karthik Ramakrishnan
More Details >
My auctions allegro <= 4.0.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-116855
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
My auctions allegro [my-auctions-allegro-free-edition]
Researcher
ashv4ni
More Details >
Newsletters <= 4.18.2 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-116863
Patch Status
Unpatched
Published
Oct 27, 2026
Affected Software
Newsletters [newsletters-lite]
Researcher
wackydawg
More Details >
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109592
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA [desktop-mode]
Researchers
Wordfence PRISM
OpenStation Team
More Details >
Page Builder by SiteOrigin < 2.38.0 - Authenticated (Contributor+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110507
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Page Builder by SiteOrigin [siteorigin-panels]
Researcher
Karthik
More Details >
Payment Forms for Paystack <= 4.0.5 - Authenticated (Contributor+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110042
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Payment Forms for Paystack [payment-forms-for-paystack]
Researcher
Shikhali Jamalzade
More Details >
Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2025-11455
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF [wp-retina-2x]
Researcher
Lucas Montes (NiRoX)
More Details >
Photo Album Plus <= 9.3.04.3 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110983
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Karthik Ramakrishnan
More Details >
Photo Engine <= 6.5.0 - Authenticated (Author+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115259
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Photo Engine (Media Organizer & Lightroom) [wplr-sync]
Researcher
Mahammad Mammadov
More Details >
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 4.0.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115962
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]
Researcher
MYUNGYONG LEE
More Details >
Redux Framework <= 4.5.16 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-116404
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
Redux Framework [redux-framework]
Researcher
Aarush Gaur
More Details >
Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109979
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Related Posts for WordPress [related-posts-for-wp]
Researcher
Wordfence PRISM
More Details >
Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109980
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Related Posts for WordPress [related-posts-for-wp]
Researcher
Wordfence PRISM
More Details >
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.68 - 1.7.1069 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-106647
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Mohammed Abd Alrahman
More Details >
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP < 1.5.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111961
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp]
Researcher
Usama Arshad
More Details >
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP 1.4.38 - 1.5.9 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111960
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp]
Researcher
Vincent Cassiau
More Details >
Security Optimizer <= 1.6.8 - Two-Factor Authentication via Brute Force
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-118185
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Security Optimizer – The All-In-One Protection Plugin [sg-security]
Researcher
Karthik Ramakrishnan
More Details >
SureDash – Community, Courses & Member Dashboard <= 1.12.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115605
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
SureDash – Community, Courses & Member Dashboard [suredash]
Researcher
yzx001
More Details >
The Events Calendar <= 6.18.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-119367
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
The Events Calendar [the-events-calendar]
Researcher
fccsec.dev
More Details >
Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111213
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Travelly – Tour & Travel Booking Manager for WooCommerce [tour-booking-manager]
Researcher
Wordfence PRISM
More Details >
Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) <= 5.4.0 - Authenticated (Subscriber+) Two-Factor Authentication Bypass
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111739
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Two Factor Authentication [tokenizer-two-factor-authentication]
All-In-One Security (AIOS) – Security and Firewall [all-in-one-wp-security-and-firewall]
Researcher
Karol Czubernat
More Details >
Unlimited Elements for Elementor <= 2.0.26 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62023
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
yzx001
More Details >
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.13 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-52708
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]
Researcher
elba.code
More Details >
Wallet System for WooCommerce <= 2.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-108763
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Marcial Diaz
More Details >
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.5 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-119466
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce [woosquare]
Researcher
Oly Hossen
More Details >
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.5 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-115960
Patch Status
Patched
Published
Oct 26, 2026
Affected Software
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce [woosquare]
Researcher
mroccon
More Details >
Welcart e-Commerce < 2.12.6 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111032
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Usama Arshad
More Details >
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.7.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-22386
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website [wp-job-portal]
Researcher
black
More Details >
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-27062
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]
Researcher
mamgad
More Details >
YT Player <= 2.1.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-85007
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch [yt-player]
Researcher
achmad sonif
More Details >
AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
4.2
CVSS Rating
4.2 (Medium)
CVE-ID
CVE-2026-107745
Patch Status
Patched
Published
Oct 27, 2026
Affected Software
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine]
Researcher
Sawyer
More Details >
WordPress Core 6.9.0 - 7.1.3 - Authenticated (Custom+) Incorrect Authorization to Read, Modify, and Delete Notes via REST API
3.8
CVSS Rating
3.8 (Low)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Ramon
More Details >
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.4.0 - Authenticated (Subscriber+) Arbitrary Page Content Injection
3.5
CVSS Rating
3.5 (Low)
CVE-ID
CVE-2026-42694
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
nh4tvd
More Details >
WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Denial of Service via Malformed Interactivity API Bindings
3.5
CVSS Rating
3.5 (Low)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
Jon Surrell
More Details >
WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Clickjacking via Interactivity API Object Bindings
3.5
CVSS Rating
3.5 (Low)
Patch Status
Patched
Published
Oct 29, 2026
Affected Software
WordPress [wordpress]
Researcher
rekter0
More Details >
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.4.0 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-112347
Patch Status
Patched
Published
Oct 30, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
Choriyev Qahramon
More Details >
Security by CleanTalk <= 2.190 - Authenticated (Administrator+) Information Exposure
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-114444
Patch Status
Patched
Published
Oct 28, 2026
Affected Software
Security Plugin, Firewall & Malware Scanner with Auto Removal [security-malware-firewall]
Researcher
Karthik
More Details >
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026) appeared first on Wordfence.
来源：Wordfence 官方博客 · https://www.wordfence.com/blog/2026/11/wordfence-intelligence-weekly-wordpress-vulnerability-report-october-26-2026-to-november-1-2026/
部分链接为推广/关联链接。