Wordfence 披露 183 个 WordPress 插件和 15 个主题共 269 个漏洞
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)
Wordfence Intelligence 在 2026 年 10 月 19 日至 25 日收录 183 个 WordPress 插件和 15 个 WordPress 主题的 269 个漏洞，其中 225 个已修补、44 个未修补。
报告汇总了 269 个漏洞的补丁状态、严重等级和受影响版本，便于站点管理员核对自身插件与主题并安排升级。
译文尚不完整，完整内容请切换到原文。
上周，共披露了 269 个漏洞，涉及 183 个 WordPress 插件和 15 个 WordPress 主题，这些漏洞已添加至 Wordfence Intelligence Vulnerability Database；上周还有 124 位漏洞研究员为 WordPress Security 做出了贡献。请立即查看本报告中的这些漏洞，确保您的网站未受到影响。
我们开展 Wordfence Intelligence 项目的使命，是让包括 WordPress 社区在内的所有人都能轻松获取有价值的漏洞信息，从而供个人和组织利用这些数据实施分层安全，并与我们保障 WordPress 安全的总体使命保持一致，即采用纵深防御策略。正因如此，Wordfence Intelligence 用户界面、漏洞 API 和 webhook 集成 均可免费供个人及商业用途访问和使用，这也是我们每周发布漏洞报告的原因。作为全球领先的 WordPress 优质漏洞数据库提供商，网站所有者可以放心，因为 Wordfence 始终在背后支持他们。
企业、托管服务商乃至个人用户都可以 利用 Vulnerability Database API，获取我们包含超过 40,000 个漏洞的数据库完整导出，然后利用 webhook 集成实时了解新加入的漏洞以及对数据库所做的任何更新，全部免费提供。
点击此处注册我们的邮件列表，即可在重要 WordPress 安全报告发布后第一时间将其发送至您的邮箱，并定期接收此类每周漏洞报告。
上周部署的新防火墙规则
Wordfence Threat Intelligence Team 会审查每个漏洞，以确定其影响和严重程度，同时评估被利用的可能性，从而验证 Wordfence Firewall 是否能够提供充分保护。
该团队上周实时为以下漏洞通过防火墙规则推出了加强防护，适用于我们的 Premium、 Care 和 Response 客户：
-
- UpdraftPlus <= 1.26.11 – UDRPC 密钥失陷
使用 Wordfence Premium、 Care 和 Response 的客户会立即获得此防护，而仍使用免费版 Wordfence 的用户将在延迟 30 天后获得这项加强防护。
上周未修补与已修补漏洞总数
| 修补状态 | 漏洞数量 |
|---|---|
| 已修补 | 225 |
| 未修补 | 44 |
上周按 CVSS 严重程度划分的漏洞总数
| 严重程度等级 | 漏洞数量 |
|---|---|
| 低严重程度 | 6 |
| 中严重程度 | 187 |
| 高严重程度 | 69 |
| 严重 | 7 |
上周按 CWE 类型划分的漏洞总数
| 按 CWE 划分的漏洞类型 | 漏洞数量 |
|---|---|
| 缺少授权 | 75 |
| 生成网页期间未正确中和输入 | 69 |
| 反序列化不可信数据 | 20 |
| 通过用户可控密钥绕过授权 | 16 |
| 未正确中和 SQL 命令中使用的特殊元素 | 13 |
| 客户端执行服务器端安全控制 | 12 |
| 向未授权主体暴露敏感信息 | 10 |
| 权限管理不当 | 8 |
| 代码生成控制不当 | 7 |
| 身份验证不当 | 6 |
| 跨站请求伪造 | 5 |
| 授权不正确 | 5 |
| 数据真实性验证不足 | 5 |
| PHP 程序中 Include/Require 语句的文件名控制不当 | 4 |
| 未正确将路径名限制在受限目录内 | 4 |
| 上传具有危险类型的文件时不受限制 | 4 |
| 输入验证不当 | 2 |
| CAPTCHA 可被猜中 | 1 |
| 授权不当 | 1 |
| 文件访问前的不当链接解析 | 1 |
| 不受控的资源消耗 | 1 |
上周为 WordPress 安全作出贡献的研究人员
| 研究人员姓名 | 漏洞数量 |
|---|---|
|
|
22 |
|
|
20 |
|
|
11 |
|
|
10 |
|
|
9 |
|
|
7 |
|
|
6 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
4 |
|
|
4 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
您是一名安全研究员，并希望在我们的每周漏洞报告中 featured 吗？ 您可以负责任地向我们披露发现的 WordPress 漏洞，并通过我们的漏洞赏金计划对范围内的漏洞领取赏金。负责任地向我们披露您发现的漏洞，还将使您的名字出现在 Wordfence Intelligence 排行榜上，并在我们的每周漏洞报告中提及。
上周报告存在漏洞的 WordPress 插件
| 软件名称 | 软件 Slug |
|---|---|
| aBlocks – Gutenberg Blocks、用户仪表板构建器、弹出窗口构建器、表单构建器与动画构建器 | ablocks |
| Academist Core | academist-core |
| Ad Inserter – 广告管理器与 AdSense 广告 | ad-inserter |
| Addon Elements for Elementor（原 Elementor Addon Elements） | addon-elements-for-elementor-page-builder |
| Advanced Custom Fields: Extended | acf-extended |
| Advanced Custom Fields: Extended PRO | acf-extended-pro |
| Advanced File Manager – WordPress 终极文件管理器与文档库解决方案 | file-manager-advanced |
| Advanced Twenty Seventeen | advanced-twenty-seventeen |
| AI Engine – WordPress 的 MCP 服务器与 AI 聊天机器人，支持 Claude、ChatGPT 与 Gemini | ai-engine |
| Ajax Search Lite – 实时搜索与筛选 | ajax-search-lite |
| All-in-One Video Gallery – 面向 YouTube、Vimeo 与自托管视频的视频播放器和图库 | all-in-one-video-gallery |
| Anti-Spam, Spam FireWall by CleanTalk | cleantalk-spam-protect |
| Appointment Booking Plugin – LatePoint｜WordPress 日历与预约 | latepoint |
| asVereinbase – WP 俱乐部与会员管理 | asvereinbase |
| Backup and Staging by WP Time Capsule | wp-time-capsule |
| Better Messages – 聊天室、群聊、私信与 AI 聊天机器人 | bp-better-messages |
| BitPay Gateway for WooCommerce | wc-bitpay-gateway |
| BjornTech Swish for WooCommerce | woo-swish-e-commerce |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Booking Package | booking-package |
| Booktics – 面向服务企业的预约预订日历 | booktics |
| Brizy – 页面构建器 | brizy |
| Broadcast Live Video – 直播：WebRTC、HLS、RTSP、RTMP | videowhisper-live-streaming-integration |
| 支持座位预订的巴士车票预订 | bus-ticket-booking-with-seat-reservation |
| Car Rental Manager – 在线车辆预订系统 | car-rental-manager |
| Cart Abandonment Recovery for WooCommerce – 通过自动发送的电子邮件挽回流失销售额 | woo-cart-abandonment-recovery |
| CCAvenue Payment Gateway for WooCommerce | ccavanue-woocommerce-payment-getway |
| Chikkili- Woocommerce 的 Google Pay India | chikkili-google-pay-for-woocommerce |
| 分类信息列表——AI 驱动的分类广告与商业目录 | classified-listing |
| Click n Chat（聊天小部件集成） | click-n-chat |
| CMP——NiteoThemes 推出的即将推出与维护插件 | cmp-coming-soon-maintenance |
| Supsystic 联系表单——拖放式表单构建器，支持模板与表单统计 | contact-form-by-supsystic |
| 联系表单邮件 | contact-form-to-email |
| Contest Gallery——上传并投票评选照片、媒体，通过 PayPal 与 Stripe 销售 | contest-gallery |
| Datawiza 代理身份验证插件——SSO | reverse-proxy-auth-widget |
| Depicter——弹出窗口与滑块构建器 | depicter |
| DiviGear 轮播图 | dg-divi-carousel |
| 下载管理器 | download-manager |
| 下载监控 | download-monitor |
| Duplicator Pro | duplicator-pro |
| Duplicator——备份与迁移插件，支持云备份、定时备份等更多功能 | duplicator |
| E2Pdf——适用于 WordPress 的 PDF 导出工具 | e2pdf |
| Elementor 网站构建器——不只是页面构建器 | elementor |
| eRoom——适用于 Zoom、Google Meet、Microsoft Teams 的网络研讨会与会议插件 | eroom-zoom-meetings-webinar |
| Escape Room Booking Pro | ettrick-escape-room-booking |
| Elementor 常用插件——热门 Elementor 模板与小部件 | essential-addons-for-elementor-lite |
| Eurobank WooCommerce 支付网关 | woo-payment-gateway-for-eurobank |
| 适用于 WooCommerce 的活动预订管理器——销售门票、活动报名、RSVP 与活动日历 | mage-eventpress |
| 活动门票与报名 | event-tickets |
| Eventer | eventer |
| Eventin——活动日历、门票、报名、预订与 WooCommerce | wp-event-solution |
| EventON - Subscriber | eventon-subscriber |
| 活动管理器——日历、预订、门票、预约等更多功能！ | events-manager |
| Leaflet 地图扩展 | extensions-leaflet-map |
| 适用于 WordPress 的 Falang 多语言插件 | falang |
| Falcon——缓存、性能、安全、清理与优化 | falcon |
| Fluent Forms——可自定义的联系表单、调查、测验与对话式表单构建器 | fluentform |
| FluentCart——在线商店构建器与电子商务结账 | fluent-cart |
| FluentCommunity——超高速高性能社交网络、社区、LMS 与在线课程 | fluent-community |
| Formidable Forms——联系表单、调查、测验、支付、计算器表单与自定义表单构建器 | formidable |
| 前端用户 | front-end-only-users |
| GamiPress——通过积分、徽章与等级为 WordPress 带来游戏化的插件，现已支持 AI | gamipress |
| Geo Mashup | geo-mashup |
| GeoDirectory——WordPress 商业目录插件与分类信息目录 | geodirectory |
| GiveWP——捐赠插件与筹款平台 | give |
| GS Pinterest Portfolio——Pinterest 信息流、Pinterest 看板与图钉小部件 | gs-pinterest-portfolio |
| Happyforms——WordPress 表单构建器：拖放式联系表单、调查、支付与多用途表单 | happyforms |
| HIPAA 表单 | codemonkeys-hipaa-forms |
| HireZoot——职位列表、职业页面与招聘工具 | wp-job-openings |
| Infility Global | infility-global |
| InstaWP Connect——一键式 WordPress 暂存与迁移 | instawp-connect |
| 互动内容——H5P | h5p |
| Jane Menu | jane-menu |
| JetBackup——备份、恢复与迁移 | backup |
| JetElements | jet-elements |
| Kliken：适用于 Meta 的广告与像素 | kliken-ads-pixel-for-meta |
| Knit Pay——Cashfree、Instamojo、Razorpay、PayPal 等 | knit-pay |
| LearnPress – 用于创建和销售在线课程的 WordPress LMS 插件 | learnpress |
| 链接库 | link-library |
| LiteSpeed Cache | litespeed-cache |
| Gravity Forms 实时摘要 | live-summary-for-gravity-forms |
| Majestic Support – 领先的帮助台与客户支持插件 | majestic-support |
| Mang Board | mangboard |
| MarketKing — 终极 WooCommerce 多供应商市场解决方案 | marketking-multivendor-marketplace-for-woocommerce |
| MAS 视频 | masvideos |
| MasterStudy LMS WordPress 插件 – 面向在线课程与教育 | masterstudy-lms-learning-management-system |
| MB 自定义文章类型与自定义分类法 | mb-custom-post-type |
| Meta Box – 动态网站框架 | meta-box |
| MetForm – 适用于 Elementor 的联系表单、调查、测验、条件表单、表单模板与自定义表单构建器 | metform |
| miniOrange 2FA – WordPress 双因素身份验证（Passkey、OTP、短信、电子邮件、Google Authenticator） | miniorange-2-factor-authentication |
| 适用于 WooCommerce 的 Mintpay | mintpay |
| Modern Events Calendar | modern-events-calendar |
| Modern Events Calendar Lite | modern-events-calendar-lite |
| Moloni | moloni |
| ND 短代码 | nd-shortcodes |
| Elementor 新闻套件附加组件 | news-kit-elementor-addons |
| Newsletters | newsletters-lite |
| Ninja Forms – 带有计算器、测验、签名与 AI 表单构建器的联系表单构建器 | ninja-forms |
| 画外侧边栏与菜单（滑动条） | off-canvas-sidebars |
| 通过 iK 支付网关进行在线支付 | ikhokha-payment-gateway |
| 适用于 WooCommerce 的 OPay 支付网关 | opay-payment-gateway-for-woocommerce |
| Otter Blocks – Gutenberg 区块与适用于 Gutenberg 编辑器及 FSE 的页面构建器 | otter-blocks |
| 页面与文章访问限制 | page-and-post-restriction |
| Paid Membership Subscriptions – 轻松管理会员资格、经常性付款与内容限制 | paid-member-subscriptions |
| 付费视频聊天一体化网站 – HTML5 PPV 直播网络摄像头 | ppv-live-webcams |
| 参与者数据库 | participants-database |
| PAYDUNYA WOOCOMMERCE PAR | paydunya-woocommerce-payment-gateway |
| 适用于 WooCommerce 的 Payex 支付网关 | payex-payment-gateway-for-woocommerce |
| Idram 支付网关 | hk-idram-payment-gateway |
| Telcell 支付网关 | payment-gateway-for-telcell |
| 支付网关 – 适用于 WooCommerce 的 nexi Alpha Bank | woo-alpha-bank-payment-gateway |
| Wompi 支付集成 | payment-integration-wompi |
| Paytium：Mollie 支付表单与捐赠 | paytium |
| Photo Engine（媒体整理器与 Lightroom） | wplr-sync |
| 适用于 WooCommerce 的像素标签管理器 – Google Analytics 4、Google Ads 及更多像素 | pixel-manager-for-woocommerce |
| PixelYourSite Pro – 您的智能 PIXEL（TAG）管理器 | pixelyoursite-pro |
| PixelYourSite – 您的智能 PIXEL（TAG）与 API 管理器 | pixelyoursite |
| 用于游戏化、等级、徽章与忠诚奖励计划的积分管理系统 – myCred | mycred |
| Popup Builder – 创建高转化率、移动端友好的营销弹窗。 | popup-builder |
| Elementor 的 PowerPack 附加组件：小工具、表单样式器与模板 | powerpack-lite-for-elementor |
| 定价表 WordPress 插件 – 简易定价表 | easy-pricing-tables |
| Prime Mover – 备份与迁移 | prime-mover |
| WBW 出品的 WooCommerce 产品筛选器 | woo-product-filter |
| Productive Commerce – 收藏清单、比较与迷你购物车 | productive-commerce |
| QA 助手 – 由数据驱动 | qa-heatmap-analytics |
| Elementor 的 Qi 附加组件 | Elementor 附加组件 |
| Contact Form 7 重定向 | wpcf7-redirect |
| Relevanssi – 更好的搜索 | relevanssi |
| 餐厅菜单 – 点餐系统 – 餐桌预订 | menu-ordering-reservations |
| Rootblox – 面向全站编辑（FSE）的页眉和页脚构建器 | rootblox |
| Royal Addons for Elementor – Elementor 附加组件和模板套件 | royal-elementor-addons |
| Royal MCP – 通过 MCP 为 Claude、ChatGPT 及任何 LLM 提供安全 AI 连接器 | royal-mcp |
| SchedulePress – 自动发布文章、自动社交分享、使用编辑日历安排帖子及错过的定时帖子发布器 | wp-scheduled-posts |
| Sensei LMS – 在线课程、测验与学习 | sensei-lms |
| Seriously Simple Podcasting | seriously-simple-podcasting |
| ShopMagic – WordPress 邮件自动化 | shopmagic-for-woocommerce |
| Simple Banner – 轻松在网站顶部或底部添加多个横幅/栏/通知/公告 | simple-banner |
| 简易购物车 | wordpress-simple-paypal-shopping-cart |
| SmartyParcel – 面向 WooCommerce 的 DHL Express、GLS、InPost 与 Nova Post | wc-ukr-shipping |
| Snap Finance | snap-finance-checkout |
| 社交媒体动态图库 | insta-gallery |
| Speed Optimizer – 一体化性能提升插件 | sg-cachepress |
| 强力推荐语 | strong-testimonials |
| 评论订阅 | subscribe-to-comments |
| 面向 WooCommerce 的 SUMIT 支付网关 | woo-payment-gateway-officeguy |
| Sunshine Photo Cart – 面向摄影师的客户照片图库与照片校样 | sunshine-photo-cart |
| SureCart – 让实体商品、数字下载、订阅、捐赠与支付销售变得简单 | surecart |
| SureDash – 社区、课程与会员仪表盘 | suredash |
| Surfer – WordPress 插件 | surferseo |
| Swift Performance Lite | swift-performance-lite |
| Synchrony 融资 | synchrony-payments |
| 定制工具 | tailored-tools |
| 团队成员 – 团队展示、团队滑块、网格、表格与员工目录 | gs-team-members |
| ThemeHunk Customizer | themehunk-customizer |
| TI WooCommerce 收藏夹 | ti-woocommerce-wishlist |
| 面向 WooCommerce 的 TiendaCrypto | tienda-crypto-woo |
| 使用 Weglot 2.0 翻译 WordPress – 多语言 AI 翻译 | weglot |
| Travelly – 面向 WooCommerce 的旅游与旅行预订管理器 | tour-booking-manager |
| 适用于 LearnDash 的 Uncanny Toolkit | uncanny-learndash-toolkit |
| 面向 WooCommerce 的 UPI QR 码支付网关 | upi-qr-code-payment-for-woocommerce |
| 用户资料构建器 – 精美的用户注册表单、用户资料与用户角色编辑器 | profile-builder |
| VikRentCar 租车管理系统 | vikrentcar |
| VOD Infomaniak | vod-infomaniak |
| W3 Total Cache | w3-total-cache |
| WooCommerce 等候名单（到货通知） | waitlist-woocommerce |
| Wava 支付插件 | wava-payment |
| WebP Express | webp-express |
| weForms – 适用于 WordPress 的简易拖放式联系表单构建器 | weforms |
| 我们已营业！ | opening-hours |
| WholesaleX – 批发定价与 B2B 解决方案 | wholesalex |
| Workreap Core | workreap_core |
| WP Booking System – 预订日历 | wp-booking-system |
| WP Mailster | wp-mailster |
| WP Stripe Checkout | wp-stripe-checkout |
| WP Ultimate Review | wp-ultimate-review |
| WP User Manager – 注册表单、登录表单、用户资料构建器与会员目录 | wp-user-manager |
| WPMobile.App – Android 和 iOS 应用构建器 | wpappninja |
| WPVR – 适用于 WordPress 的 360 全景查看器和虚拟导览构建器 | wpvr |
| WPZOOM Portfolio Lite – 可筛选作品集插件 | wpzoom-portfolio |
| Xpro Addons — 为 Elementor 提供的 150+ 个小工具 | xpro-elementor-addons |
| YITH WooCommerce Product Bundles | yith-woocommerce-product-bundles |
| YITH WooCommerce Wishlist | yith-woocommerce-wishlist |
| 适用于 WooCommerce 的 ЮKassa | yookassa |
上周报告存在漏洞的 WordPress 主题
| 软件名称 | 软件标识 |
|---|---|
| Hallelujah | 宗教与教会慈善 WordPress 主题 | hallelujah |
| Helion | 个人作品集与代理 WordPress 主题 | helion |
| Holistic Center | 健康养生与水疗沙龙 PSD 模板 | holistic-center |
| Hostme v2 - 响应式 WordPress 主题 | hostmev2 |
| HotLock | 锁匠与安防系统 WordPress 主题 + RTL | hotlock |
| kallyas | kallyas |
| Little Birdies | 多用途儿童 PSD 模板 | little-birdies |
| redy | redy |
| Reprizo - 珠宝与手表商店 Shopify 主题 | reprizo |
| Rhodos - 商业作品集 Elementor 区块与模板套件 | rhodos |
| Save Life | 非营利、慈善与捐赠 WordPress 主题 | save-life |
| Vagabonds - 旅行博客 Elementor 模板套件 | vagabonds |
| YOOtheme Pro | yootheme |
| Your Dress | 礼服租赁与服装商店 WordPress 主题 + 商店 | your-dress |
| ZenSoul - 水疗沙龙与健康养生 WordPress 主题 + 商店 + AI | zensoul |
漏洞详情
请注意，如果你在 WordPress 网站上运行 Wordfence 插件并启用了扫描器，那么如果你的网站受到其中任何漏洞的影响，你应该已经收到通知。如果希望在每次向 Wordfence Intelligence Vulnerability Database 添加漏洞时都能收到实时通知，请查看我们的 Slack 和 HTTP Webhook Integration，这些功能均可免费使用。
Advanced Custom Fields: Extended <= 0.9.2.7 - 未授权远程代码执行
9.8
CVSS 评级
9.8（严重）
CVE-ID
CVE-2026-94267
补丁状态
已修补
发布日期
2026 年 10 月 23 日
受影响的软件
Advanced Custom Fields: Extended [acf-extended]
Advanced Custom Fields: Extended PRO [acf-extended-pro]
研究人员
Jakub Herman
更多详情 >
Advanced Custom Fields: Extended 0.9.2.7 - 通过账户接管实现未授权权限提升
9.8
CVSS 评级
9.8（严重）
CVE-ID
CVE-2026-94268
补丁状态
已修补
发布日期
2026 年 10 月 23 日
受影响的软件
Advanced Custom Fields: Extended [acf-extended]
Advanced Custom Fields: Extended PRO [acf-extended-pro]
研究人员
Jakub Herman
更多详情 >
Prime Mover <= 2.2.1 - 在迁移搜索替换期间通过 Base64 编码的评论注入未授权 PHP 对象
9.8
CVSS 评级
9.8（严重）
CVE-ID
CVE-2026-115806
补丁状态
已修补
发布日期
2026年10月22日
受影响的软件
Prime Mover – 备份与迁移 [prime-mover]
研究人员
Civitasmass
更多详情 >
WP Mailster <= 1.9.1.0 - 未认证任意文件上传
9.8
CVSS 评分
9.8（严重）
CVE-ID
CVE-2026-111832
补丁状态
已修补
发布日期
2026年10月19日
受影响的软件
WP Mailster [wp-mailster]
研究人员
Peter Tang
更多详情 >
YOOtheme Pro 5.0.0 - 5.0.52 - 未认证任意文件上传
9.8
CVSS 评分
9.8（严重）
CVE-ID
CVE-2026-102785
补丁状态
已修补
发布日期
2026年10月22日
受影响的软件
YOOtheme Pro [yootheme]
研究人员： 未知
更多详情 >
Advanced Custom Fields: Extended <= 0.9.2.7 - 未认证任意文件删除
9.1
CVSS 评分
9.1（严重）
CVE-ID
CVE-2026-112311
补丁状态
已修补
发布日期
2026年10月20日
受影响的软件
Advanced Custom Fields: Extended [acf-extended]
研究人员
furkan.araspro
更多详情 >
weForms – Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.28 - 未认证任意文件删除
9.1
CVSS 评分
9.1（严重）
CVE-ID
CVE-2026-111833
补丁状态
已修补
发布日期
2026年10月19日
受影响的软件
weForms – Easy Drag & Drop Contact Form Builder For WordPress [weforms]
研究人员
Peter Tang
更多详情 >
aBlocks <= 2.17.0 - 已认证（贡献者+）权限提升至 'roleSlug' 区块属性
8.8
CVSS 评分
8.8（高危）
CVE-ID
CVE-2026-110018
补丁状态
已修补
发布日期
2026年10月23日
受影响的软件
aBlocks – Gutenberg 区块、用户仪表板构建器、弹出窗口构建器、表单构建器和动画构建器 [ablocks]
研究人员
Wordfence PRISM
更多详情 >
Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.5 - 已认证（订阅者+）任意 PHP 代码执行
8.8
CVSS 评级
8.8（高危）
CVE 编号
CVE-2026-111828
补丁状态
已修补
发布日期
2026 年 10 月 19 日
受影响的软件
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
研究人员
changsheng
更多详情 >
CM HIPAA Forms <= 3.3.1 - 已认证（hipaa_forms+）权限提升
8.8
CVSS 评级
8.8（高危）
CVE 编号
CVE-2026-109927
补丁状态
已修补
发布日期
2026 年 10 月 20 日
受影响的软件
HIPAA Forms [codemonkeys-hipaa-forms]
研究人员
Enrico Marcolini
Claudio Marchesini
Dottor Marc
更多详情 >
Duplicator <= 1.5.17 和 Duplicator Pro <= 4.6.10 - 未认证 PHP 对象注入
8.8
CVSS 评级
8.8（高危）
CVE 编号
CVE-2026-82814
补丁状态
已修补
发布日期
2026 年 10 月 20 日
受影响的软件
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator]
Duplicator Pro [duplicator-pro]
研究人员
Alex Thomas
Wordfence Argus
更多详情 >
Mang Board <= 2.4.4 - 已认证（订阅者+）任意文件上传
8.8
CVSS 评级
8.8（高危）
CVE 编号
CVE-2026-111834
补丁状态
已修补
发布日期
2026 年 10 月 19 日
受影响的软件
Mang Board [mangboard]
研究人员
Nixxies
更多详情 >
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1068 - 已认证（贡献者+）远程代码执行
8.8
CVSS 评级
8.8（高危）
CVE 编号
CVE-2026-111851
补丁状态
已修补
发布日期
2026 年 10 月 20 日
受影响的软件
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
研究人员
Intrudify
更多详情 >
Uncanny Toolkit for LearnDash < 3.8.2 - 跨站请求伪造
8.8
CVSS 评级
8.8（高危）
CVE-ID
CVE-2026-107127
补丁状态
已修补
发布日期
Oct 19, 2026
受影响软件
Uncanny Toolkit for LearnDash [uncanny-learndash-toolkit]
研究人员
Ryan Fabella
More Details >
Academist Core <= 1.4.1 - 未身份验证的本地文件包含
8.1
CVSS 评分
8.1（高危）
CVE-ID
CVE-2026-112820
补丁状态
未修补
发布日期
Oct 20, 2026
受影响软件
Academist Core [academist-core]
研究人员
Tran Nguyen Bao Khanh
More Details >
Hallelujah <= 1.1.1 - 未身份验证的 PHP 对象注入
8.1
CVSS 评分
8.1（高危）
CVE-ID
CVE-2026-112853
补丁状态
未修补
发布日期
Oct 21, 2026
受影响软件
Hallelujah | Religion & Church Charity WordPress Theme [hallelujah]
研究人员
João Pedro S Alcântara
More Details >
Helion | Personal Portfolio & Agency WordPress Theme <= 1.1.12 - 未身份验证的 PHP 对象注入
8.1
CVSS 评分
8.1（高危）
CVE-ID
CVE-2026-112852
补丁状态
未修补
发布日期
Oct 21, 2026
受影响软件
Helion | Personal Portfolio & Agency WordPress Theme [helion]
研究人员
João Pedro S Alcântara
More Details >
Holistic Center <= 1.2.6 - 未身份验证的 PHP 对象注入
8.1
CVSS 评分
8.1（高危）
CVE-ID
CVE-2026-112854
补丁状态
未修补
发布日期
Oct 21, 2026
受影响软件
Holistic Center | Wellness & Spa Salon PSD Template [holistic-center]
研究人员
João Pedro S Alcântara
More Details >
Hostme v2 - Responsive WordPress Theme <= 7.0 - 未身份验证的 PHP 对象注入
8.1
CVSS 评分
8.1（高危）
CVE-ID
CVE-2026-112848
补丁状态
未修补
发布日期
Oct 21, 2026
受影响软件
Hostme v2 - Responsive WordPress Theme [hostmev2]
研究人员
João Pedro S Alcântara
更多详情 >
HotLock | 锁匠与安防系统 WordPress 主题 + RTL <= 1.3.9 - 未认证 PHP 对象注入
8.1
CVSS 评级
8.1（高危）
CVE-ID
CVE-2026-112851
补丁状态
未修复
发布日期
2026 年 10 月 21 日
受影响的软件
HotLock | 锁匠与安防系统 WordPress 主题 + RTL [hotlock]
研究员
João Pedro S Alcântara
更多详情 >
Little Birdies | 多用途儿童 PSD 模板 <= 1.3.16 - 未认证 PHP 对象注入
8.1
CVSS 评级
8.1（高危）
CVE-ID
CVE-2026-112859
补丁状态
未修复
发布日期
2026 年 10 月 21 日
受影响的软件
Little Birdies | 多用途儿童 PSD 模板 [little-birdies]
研究员
João Pedro S Alcântara
更多详情 >
Newsletters <= 4.18.1 - 未认证 PHP 对象注入
8.1
CVSS 评级
8.1（高危）
CVE-ID
CVE-2026-94075
补丁状态
已修复
发布日期
2026 年 10 月 22 日
受影响的软件
Newsletters [newsletters-lite]
研究员
Ananda Dhakal
更多详情 >
Participants Database <= 2.7.8.5 - 未认证 PHP 对象注入
8.1
CVSS 评级
8.1（高危）
CVE-ID
CVE-2026-112862
补丁状态
未修复
发布日期
2026 年 10 月 21 日
受影响的软件
Participants Database [participants-database]
研究员
Tarcísio Luchesi
更多详情 >
Paytium：Mollie 付款表单与捐赠 <= 5.0.5 - 未认证 PHP 对象注入
8.1
CVSS 评级
8.1（高危）
CVE-ID
CVE-2026-114196
补丁状态
已修复
发布日期
2026 年 10 月 22 日
受影响的软件
Paytium：Mollie 付款表单与捐赠 [paytium]
研究员
Tarcísio Luchesi
更多详情 >
Redy <= 1.3.5 - 未认证 PHP 对象注入
8.1
CVSS 评级
8.1（高危）
CVE-ID
CVE-2026-112855
补丁状态
未修复
发布日期
2026 年 10 月 21 日
受影响的软件
redy [redy]
研究人员
João Pedro S Alcântara
More Details >
Reprizo - 珠宝与手表商店 Shopify 主题 <= 1.0.8 - 未认证 PHP 对象注入
8.1
CVSS 评分
8.1（高危）
CVE ID
CVE-2026-112857
补丁状态
未修补
发布日期
2026 年 10 月 21 日
受影响的软件
Reprizo - 珠宝与手表商店 Shopify 主题 [reprizo]
研究人员
João Pedro S Alcântara
More Details >
Rhodos - 商业作品集 Elementor 区块与模板套件 <= 1.3.3 - 未认证 PHP 对象注入
8.1
CVSS 评分
8.1（高危）
CVE ID
CVE-2026-112858
补丁状态
未修补
发布日期
2026 年 10 月 21 日
受影响的软件
Rhodos - 商业作品集 Elementor 区块与模板套件 [rhodos]
研究人员
João Pedro S Alcântara
More Details >
Rootblox – 适用于全站点编辑 (FSE) 的页眉与页脚构建器 <= 1.0.6 - 未认证本地文件包含
8.1
CVSS 评分
8.1（高危）
CVE ID
CVE-2026-112832
补丁状态
已修补
发布日期
2026 年 10 月 20 日
受影响的软件
Rootblox – 适用于全站点编辑 (FSE) 的页眉与页脚构建器 [rootblox]
研究人员
Peter Tang
More Details >
Save Life | 非营利、慈善与捐赠 WordPress 主题 <= 1.2.14 - 未认证 PHP 对象注入
8.1
CVSS 评分
8.1（高危）
CVE ID
CVE-2026-112846
补丁状态
未修补
发布日期
2026 年 10 月 21 日
受影响的软件
Save Life | 非营利、慈善与捐赠 WordPress 主题 [save-life]
研究人员
johska
More Details >
Vagabonds - 旅行博客 Elementor 模板套件 <= 1.3.10 - 未认证 PHP 对象注入
8.1
CVSS 评分
8.1（高危）
CVE ID
CVE-2026-112856
补丁状态
未修补
发布日期
2026 年 10 月 21 日
受影响的软件
Vagabonds - 旅行博客 Elementor 模板套件 [vagabonds]
研究人员
João Pedro S Alcântara
更多详情 >
Your Dress <= 1.4.1 - 未授权本地文件包含
8.1
CVSS 评级
8.1（高危）
CVE 编号
CVE-2026-112850
补丁状态
尚未修补
发布日期
2026 年 10 月 21 日
受影响软件
Your Dress | 礼服租赁与服装商店 WordPress 主题 + 商店 [your-dress]
研究员
Tran Nguyen Bao Khanh
更多详情 >
ZenSoul <= 1.13 - 未授权 PHP 对象注入
8.1
CVSS 评级
8.1（高危）
CVE 编号
CVE-2026-112847
补丁状态
尚未修补
发布日期
2026 年 10 月 21 日
受影响软件
ZenSoul - 水疗美容院与健康 WordPress 主题 + 商店与 AI [zensoul]
研究员
johska
更多详情 >
Ajax Search Lite – 实时搜索与筛选 <= 4.14.6 - 未授权 SQL 注入
7.5
CVSS 评级
7.5（高危）
CVE 编号
CVE-2026-111852
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Ajax Search Lite – Live Search & Filter [ajax-search-lite]
Researcher
Jacek Sowiński (dzaku)
More Details >
Booking for Appointments and Events Calendar – Amelia <= 2.4.11 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-112327
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
SVO
More Details >
Click n Chat <= 1.1.2 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-92997
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Click n Chat (Chat Widget Integration) [click-n-chat]
Researcher
Ryan Fabella
More Details >
Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-92998
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Click n Chat (Chat Widget Integration) [click-n-chat]
Researcher
Erwan LR
More Details >
EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-93300
Patch Status
Unpatched
Published
Oct 19, 2026
Affected Software
EventON - Subscriber [eventon-subscriber]
Researcher
Austin Ginder
More Details >
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder < 7.0 - Unauthenticated Denial of Service
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-85642
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable]
Researcher
Naoki Kawahigashi
More Details >
GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets <= 1.9.2 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-110370
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
GS Pinterest Portfolio – Pinterest Feed, Pinterest Board & Pin Widgets [gs-pinterest-portfolio]
Researcher
Ananda Dhakal
More Details >
Newsletters <= 4.18.1 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-111402
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Newsletters [newsletters-lite]
Researcher
Noverdi Anugrah Ramadhan
More Details >
Participants Database <= 2.7.8.5 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-112860
Patch Status
Unpatched
Published
Oct 21, 2026
Affected Software
Participants Database [participants-database]
Researcher
Tarcísio Luchesi
More Details >
Product Filter for WooCommerce by WBW <= 3.4.6 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-112866
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Product Filter for WooCommerce by WBW [woo-product-filter]
Researcher
Yuto Hyakumoto
More Details >
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP < 1.5.7 - Authentication Bypass
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-111958
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp]
Researcher
Raphael P. Cigana
More Details >
Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More <= 2.8.2 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-110369
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Team Members – Team Showcase, Team Slider, Grid, Table & Staff Directory [gs-team-members]
Researcher
Ananda Dhakal
More Details >
WP Mailster <= 1.9.1.0 - Authenticated (Contributor+) Local File Inclusion
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-111829
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
WP Mailster [wp-mailster]
Researcher
V1T
More Details >
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Arbitrary Non-Admin Account Takeover
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-94262
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Advanced Custom Fields: Extended PRO [acf-extended-pro]
Researcher
Karthik Ramakrishnan
More Details >
Datawiza Proxy Auth <= 1.1.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-115214
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Datawiza Proxy Auth Plugin – SSO [reverse-proxy-auth-widget]
Researcher
Naoki Kawahigashi
More Details >
User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-110523
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]
Researcher
Charles Vosburgh
More Details >
Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-112313
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Asim Alshaya
More Details >
Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109198
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Anti-Spam, Spam FireWall by CleanTalk [cleantalk-spam-protect]
Researcher
daroo
More Details >
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-114179
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]
Researcher
John Ryan Albon
More Details >
Contact Form Email <= 1.3.68 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-112379
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Contact Form Email [contact-form-to-email]
Researcher
AndrewN
More Details >
Depicter — Popup & Slider Builder 4.0.5 - 4.8.1 - Authenticated (Editor+) Arbitrary File Upload
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-113472
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Depicter — Popup & Slider Builder [depicter]
Researcher
Karthik Ramakrishnan
More Details >
Duplicator <= 1.5.17 - Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-115251
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator]
Researcher
Charles Vosburgh
More Details >
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-112844
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Dthangws
More Details >
GeoDirectory <= 2.8.193 - Authenticated (Administrator+) Remote Code Execution
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-113673
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Karthik Ramakrishnan
More Details >
Hostme v2 - Responsive WordPress Theme <= 7.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-112849
Patch Status
Unpatched
Published
Oct 21, 2026
Affected Software
Hostme v2 - Responsive WordPress Theme [hostmev2]
Researcher
João Pedro S Alcântara
More Details >
Jane Menu <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-85683
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Jane Menu [jane-menu]
Researcher
Naoki Kawahigashi
More Details >
KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme <= 4.25.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-112863
Patch Status
Unpatched
Published
Oct 21, 2026
Affected Software
kallyas [kallyas]
Researcher
Rafie Muhammad
More Details >
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-113500
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Jakub Herman
More Details >
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-113499
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Jakub Herman
More Details >
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-110899
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]
Researcher
Kwak Do Hun
More Details >
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109936
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]
Researcher
Jakub Herman
More Details >
PixelYourSite (Pro + Free) – Your smart PIXEL (TAG) Manager (plugin) < 11.4.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109987
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite]
PixelYourSite Pro – Your smart PIXEL (TAG) Manager [pixelyoursite-pro]
Researcher
Jakub Herman
More Details >
QA Assistants – Driven by data <= 5.3.0.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-114697
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
QA Assistants – Driven by data [qa-heatmap-analytics]
Researcher
leon figueira
More Details >
Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-111574
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Redirection for Contact Form 7 [wpcf7-redirect]
Researcher
Dmitrii Ignatyev
More Details >
Strong Testimonials <= 3.3.12 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107435
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
jydae
More Details >
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-112221
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
Deva Parekh
More Details >
VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-112835
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Ayukiab
More Details >
VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-112838
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
leon figueira
More Details >
VOD Infomaniak <= 1.5.14 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-114695
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
VOD Infomaniak [vod-infomaniak]
Researcher
Peter Tang
More Details >
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-114178
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
fcc
More Details >
WebP Express <= 0.25.15 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-97328
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
WebP Express [webp-express]
Researcher
Jakub Herman
More Details >
Weglot <= 6.4.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-88784
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Translate WordPress with Weglot 2.0 – Multilingual AI Translation [weglot]
Researcher
Jakub Herman
More Details >
WP Mailster <= 1.9.1.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-111830
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
WP Mailster [wp-mailster]
Researcher
V1T
More Details >
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
7.1
CVSS Rating
7.1 (High)
CVE-ID
CVE-2026-115807
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
pb>sec
More Details >
Relevanssi – A Better Search <= 4.28.4 - Authenticated (Editor+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-114704
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Relevanssi – A Better Search [relevanssi]
Researcher
Ananda Dhakal
More Details >
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-94263
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Karthik Ramakrishnan
More Details >
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.7 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-112837
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]
Researcher
leon figueira
More Details >
GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Arbitrary Media File Read
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-113491
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
vuxvinh
More Details >
GiveWP <= 4.19.0.0 - Authenticated (Give Manager+) Path Traversal
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-111978
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Karthik Ramakrishnan
More Details >
Modern Events Calendar < 7.37.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-102499
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Modern Events Calendar [modern-events-calendar]
Modern Events Calendar Lite [modern-events-calendar-lite]
Researcher
Wes Ring
More Details >
Modern Events Calendar < 7.37.0 - Authenticated (Subscriber+) SQL Injection via mec_fes_csv_export
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-96534
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Modern Events Calendar [modern-events-calendar]
Modern Events Calendar Lite [modern-events-calendar-lite]
Researcher
Sanjar Tulkinov
More Details >
Swift Performance Lite <= 2.3.7.3 - Authenticated (Author+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-110651
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Swift Performance Lite [swift-performance-lite]
Researcher
Naoki Kawahigashi
More Details >
Ultimate Review <= 2.4.4 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-103234
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Erwan LR
More Details >
Workreap Core < 3.4.4 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-112822
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Workreap Core [workreap_core]
Researcher
Phat RiO
More Details >
Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114184
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Addon Elements for Elementor (formerly Elementor Addon Elements) [addon-elements-for-elementor-page-builder]
Researcher
Intrudify
More Details >
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-94264
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Advanced Custom Fields: Extended PRO [acf-extended-pro]
Researcher
Karthik Ramakrishnan
More Details >
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution < 6.0.0 - Authenticated (Custom Role+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-79627
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Karthik Ramakrishnan
More Details >
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114693
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery]
Researcher
beopseong.kim
More Details >
Brizy – Page Builder 2.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111844
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Brizy – Page Builder [brizy]
Researcher
Ayukiab
More Details >
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 34.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111837
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
beopseong.kim
More Details >
DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-93878
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
DiviGear Carousel [dg-divi-carousel]
Researcher
Austin Ginder
More Details >
E2Pdf – Export Pdf Tool for WordPress <= 1.32.57 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111410
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
E2Pdf – Export Pdf Tool for WordPress [e2pdf]
Researcher
V1T
More Details >
Elementor <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-81812
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Elementor Website Builder – more than just a page builder [elementor]
Researcher
Nguyễn Đức Hòa
More Details >
Elementor <= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-81813
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Elementor Website Builder – more than just a page builder [elementor]
Researcher
Mohammed Abd Alrahman
More Details >
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110510
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Karthik Ramakrishnan
More Details >
Extensions for Leaflet Map <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114703
Patch Status
Unpatched
Published
Oct 22, 2026
Affected Software
Extensions for Leaflet Map [extensions-leaflet-map]
Researcher
Ananda Dhakal
More Details >
Falang multilanguage for WordPress <= 1.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105262
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Falang multilanguage for WordPress [falang]
Researcher
Seongwon Lee
More Details >
GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-113493
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Jacek Sowiński
More Details >
GiveWP <= 4.19.0.0 - Authenticated (Give Worker+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111979
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Karthik Ramakrishnan
More Details >
Interactive Content – H5P <= 1.17.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-112867
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Interactive Content – H5P [h5p]
Researcher
Intrudify
More Details >
JetElements <= 2.9.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111414
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
JetElements [jet-elements]
Researcher
nh4tvd
More Details >
Job Openings <= 4.1.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107790
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
HireZoot – Job Listings, Career Page & Recruitment Tool [wp-job-openings]
Researcher
Md Mehedi Hasan
More Details >
Link Library <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-78392
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Link Library [link-library]
Researcher
Karthik Ramakrishnan
More Details >
ND Shortcodes <= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114702
Patch Status
Unpatched
Published
Oct 22, 2026
Affected Software
ND Shortcodes [nd-shortcodes]
Researcher
Ananda Dhakal
More Details >
Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-112845
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Off-Canvas Sidebars & Menus (Slidebars) [off-canvas-sidebars]
Researcher
Ihsan Saddan
More Details >
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109933
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]
Researcher
Karthik Ramakrishnan
More Details >
Photo Engine <= 6.5.7 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111971
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Photo Engine (Media Organizer & Lightroom) [wplr-sync]
Researcher
Mahammad Mammadov
More Details >
Pixel Tag Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105199
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels [pixel-manager-for-woocommerce]
Researcher
Suhayb Ahmed
More Details >
Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114700
Patch Status
Unpatched
Published
Oct 22, 2026
Affected Software
Restaurant Menu – Food Ordering System – Table Reservation [menu-ordering-reservations]
Researcher
Ananda Dhakal
More Details >
Rootblox – Header & Footer Builder for Full Site Editing (FSE) <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111843
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Rootblox – Header & Footer Builder for Full Site Editing (FSE) [rootblox]
Researcher
Peter Tang
More Details >
Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-112833
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Seriously Simple Podcasting [seriously-simple-podcasting]
Researcher
Deva Parekh
More Details >
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-112840
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
Deva Parekh
More Details >
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111966
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
Jacek Sowiński
More Details >
VR 8.5.49 - 9.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114429
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]
Researcher
Huseyn Huseynov
More Details >
Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-114701
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Waitlist Woocommerce ( Back in stock notifier ) [waitlist-woocommerce]
Researcher
Ananda Dhakal
More Details >
YITH WooCommerce Wishlist <= 4.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-112199
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
YITH WooCommerce Wishlist [yith-woocommerce-wishlist]
Researcher
Intrudify
More Details >
HIPAA Forms < 3.3.2 - Authenticated (Custom Role+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-109927
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
HIPAA Forms [codemonkeys-hipaa-forms]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Qi Addons For Elementor <= 1.11.1 - Authenticated (Contributor+) Arbitrary HTML Injection
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-115183
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Qi Addons For Elementor [qi-addons-for-elementor]
Researcher
Karthik Ramakrishnan
More Details >
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website < 3.3.3 - Authenticated (Custom Role+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-107506
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website [simple-banner]
Researcher
Jakub Herman
More Details >
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.4 - Authenticated (Author+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-112242
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
Calum Gannon
More Details >
Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-114194
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
yzx001
More Details >
Booking System <= 2.1.0.2 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-109147
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Zahid Abbasi
More Details >
Download Monitor <= 5.3.3 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-112207
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Download Monitor [download-monitor]
Researcher
Karthik Ramakrishnan
More Details >
Eventer - WordPress Event & Booking Manager Plugin <= 0.1.1 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-27394
Patch Status
Unpatched
Published
Oct 20, 2026
Affected Software
Eventer [eventer]
Researcher
Abdulsamad Yusuf (0xVenus)
More Details >
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-114694
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
AndrewN
More Details >
Geo Mashup <= 1.13.22 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-111848
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Geo Mashup [geo-mashup]
Researcher
beopseong.kim
More Details >
Live Summary for Gravity Forms <= 1.2.10 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-110884
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Live Summary for Gravity Forms [live-summary-for-gravity-forms]
Researcher
John Ryan Albon
More Details >
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.14 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-111840
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]
Researcher
Safraz Sears @ Greyield Labs
More Details >
Profile Builder <= 4.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-111948
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
0xBassia
More Details >
ThemeHunk Customizer <= 2.8.7 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-111838
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
ThemeHunk Customizer [themehunk-customizer]
Researcher
Elieve
More Details >
We’re Open! <= 2.6 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-112869
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
We’re Open! [opening-hours]
Researcher
Mor Golan
More Details >
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms < 1.26.15 - Unauthenticated HTML Injection
5.8
CVSS Rating
5.8 (Medium)
CVE-ID
CVE-2026-14556
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms [happyforms]
Researcher
minaruzzaman shovon
More Details >
Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112312
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Peter Tang
More Details >
asVereinbase <= 1.1.7 - Two-Factor Authentication Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110956
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
asVereinbase – Club & Member Management for WP [asvereinbase]
Researcher(s): Unknown
More Details >
BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103313
Patch Status
Unpatched
Published
Oct 25, 2026
Affected Software
BitPay Gateway for WooCommerce [wc-bitpay-gateway]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
BjornTech Swish for WooCommerce <= 3.7.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111835
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
BjornTech Swish for WooCommerce [woo-swish-e-commerce]
Researcher
Alpaslan Fatih Sözer
More Details >
Booking Package < 1.7.31 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105996
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Booking Package [booking-package]
Researcher
emiliano carrizo
More Details >
Booking Package <= 1.7.30 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105998
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Booking Package [booking-package]
Researcher
Md. Minaruzzaman Shovon
More Details >
Booking Package <= 1.7.30 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105999
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Booking Package [booking-package]
Researcher
Revanth Hari Narayana Matte
More Details >
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112829
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Booktics – Appointment Booking Calendar for Service Businesses [booktics]
Researcher
Matthew Lapinski
More Details >
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.7 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111839
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Bus Ticket Booking with Seat Reservation <= 5.9.7 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112824
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Bus Ticket Booking with Seat Reservation [bus-ticket-booking-with-seat-reservation]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails < 2.2.0 - Unauthenticated Abandoned Cart Takeover
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-96901
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails [woo-cart-abandonment-recovery]
Researcher
Usama Arshad
More Details >
CCAvenue Payment Gateway for WooCommerce <= 3.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103298
Patch Status
Unpatched
Published
Oct 23, 2026
Affected Software
CCAvenue Payment Gateway for WooCommerce [ccavanue-woocommerce-payment-getway]
Researcher
Naoki Kawahigashi
More Details >
Chikkili Google Pay for WooCommerce <= 1.0.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94295
Patch Status
Unpatched
Published
Oct 22, 2026
Affected Software
Chikkili- Google Pay India for Woocommerce [chikkili-google-pay-for-woocommerce]
Researcher
Pedro Pinho
More Details >
Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-92999
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Click n Chat (Chat Widget Integration) [click-n-chat]
Researcher
Mokksh Parekh
More Details >
CMP – Coming Soon & Maintenance Plugin by NiteoThemes 4.1.19 - 4.1.20 - Missing Authorization to Unauthenticated Maintenance Mode Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-101138
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]
Researcher
Sanjeev Kumar
More Details >
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe < 34.0.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107447
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Nicat Sultanov
More Details >
Ettrick Escape Room Booking <= 1.3.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105992
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Escape Room Booking Pro [ettrick-escape-room-booking]
Researcher
Ryan Fabella
More Details >
Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103300
Patch Status
Unpatched
Published
Oct 23, 2026
Affected Software
Eurobank WooCommerce Payment Gateway [woo-payment-gateway-for-eurobank]
Researcher
Naoki Kawahigashi
More Details >
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.7.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114192
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]
Researcher
dcs
More Details >
Falcon – Cache, Performance, Security, Cleanup, and Tweaks <= 2.12.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112826
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Falcon – Cache, Performance, Security, Cleanup, and Tweaks [falcon]
Researcher
HAIMIN
More Details >
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.15 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111831
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]
Researcher
fcc
More Details >
FluentCart <= 2.1.0 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-100142
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
FluentCart – Online Store Builder & eCommerce Checkout [fluent-cart]
Researcher
Mutantgun
More Details >
Front End Users <= 3.2.35 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87835
Patch Status
Unpatched
Published
Oct 21, 2026
Affected Software
Front End Users [front-end-only-users]
Researcher
Ahmed Hashim Ismael
More Details >
GeoDirectory <= 2.8.193 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-113674
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Vincent Suen
More Details >
GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-113490
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Karthik Ramakrishnan
More Details >
GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-113492
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Jacek Sowiński
More Details >
GiveWP <= 4.19.0.0 - Unauthenticated Donation Amount Restriction Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111974
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Shirshak
More Details >
GiveWP <= 4.19.0.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111976
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
vuxvinh
More Details >
iKhokha Payment Gateway <= 3.0.3 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103306
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Online Payments with iK Pay Gateway [ikhokha-payment-gateway]
Researcher
Naoki Kawahigashi
More Details >
Infility Global <= 2.16.24 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109931
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Infility Global [infility-global]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Kliken: Ads + Pixel for Meta <= 1.2.2 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111596
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Kliken: Ads + Pixel for Meta [kliken-ads-pixel-for-meta]
Researcher
Huseyn
More Details >
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.6.3.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112821
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more [knit-pay]
Researcher
Ravenska Dhigna Manggala
More Details >
LatePoint <= 5.7.4 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105256
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Filip Kowalski
More Details >
LiteSpeed Cache <= 7.9 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114190
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Ananda Dhakal
More Details >
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112218
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]
Researcher
HAIMIN
More Details >
MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110010
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
MB Custom Post Types & Custom Taxonomies [mb-custom-post-type]
Researcher
RIA Labs
More Details >
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114180
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform]
Researcher
Andrei
More Details >
Mintpay <= 2.2.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103381
Patch Status
Unpatched
Published
Oct 23, 2026
Affected Software
Mintpay for WooCommerce [mintpay]
Researcher
Naoki Kawahigashi
More Details >
nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103299
Patch Status
Unpatched
Published
Oct 23, 2026
Affected Software
Payment Gateway – nexi Alpha Bank for WooCommerce [woo-alpha-bank-payment-gateway]
Researcher
Naoki Kawahigashi
More Details >
OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103319
Patch Status
Unpatched
Published
Oct 23, 2026
Affected Software
OPay Payment Gateway for WooCommerce [opay-payment-gateway-for-woocommerce]
Researcher
Naoki Kawahigashi
More Details >
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109935
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]
Researcher
Karthik Ramakrishnan
More Details >
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 3.1.1 - 3.2.7 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109934
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]
Researcher
whp-wessel
More Details >
Page and Post Restriction <= 1.6.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114696
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Page and Post Restriction [page-and-post-restriction]
Researcher
souparna majumder
More Details >
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112842
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Taegyeong Yun
More Details >
PayDunya WooCommerce Payment Gateway <= 1.1.6 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103359
Patch Status
Unpatched
Published
Oct 24, 2026
Affected Software
PAYDUNYA WOOCOMMERCE PAR [paydunya-woocommerce-payment-gateway]
Researcher
Naoki Kawahigashi
More Details >
Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103332
Patch Status
Unpatched
Published
Oct 24, 2026
Affected Software
Payex Payment Gateway for Woocommerce [payex-payment-gateway-for-woocommerce]
Researcher
Naoki Kawahigashi
More Details >
Payment Gateway for Idram < 2.1.6 - Unauthenticated Arbitrary Order Status Manipulation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103302
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Payment Gateway for Idram [hk-idram-payment-gateway]
Researcher
Naoki Kawahigashi
More Details >
Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Forgery
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103301
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Payment Gateway for Telcell [payment-gateway-for-telcell]
Researcher
Naoki Kawahigashi
More Details >
Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103312
Patch Status
Unpatched
Published
Oct 24, 2026
Affected Software
Payment Integration Wompi [payment-integration-wompi]
Researcher
Naoki Kawahigashi
More Details >
Popup Builder – Create highly converting, mobile friendly marketing popups. < 4.4.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112230
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Popup Builder – Create highly converting, mobile friendly marketing popups. [popup-builder]
Researcher
Raphael P. Cigana
More Details >
Seriously Simple Podcasting <= 3.17.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112834
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Seriously Simple Podcasting [seriously-simple-podcasting]
Researcher
Deva Parekh
More Details >
ShopMagic – email automation for WordPress <= 4.9.1 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114195
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
ShopMagic – email automation for WordPress [shopmagic-for-woocommerce]
Researcher
dcs
More Details >
Simple Shopping Cart <= 5.3.2 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104641
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]
Researcher
Mohammed Abd Alrahman
More Details >
SmartyParcel <= 1.23.3 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107789
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce [wc-ukr-shipping]
Researcher
Ryan Fabella
More Details >
Snap Finance <= 3.12.0 - Unauthenticated Payment Forgery
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94273
Patch Status
Unpatched
Published
Oct 19, 2026
Affected Software
Snap Finance [snap-finance-checkout]
Researcher
Ryan Fabella
More Details >
Social Feed Gallery <= 5.0.13 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114705
Patch Status
Unpatched
Published
Oct 22, 2026
Affected Software
Social Feed Gallery [insta-gallery]
Researcher
Intrudify
More Details >
Stripe Checkout <= 1.2.2.61 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110285
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
WP Stripe Checkout [wp-stripe-checkout]
Researcher
Naoki Kawahigashi
More Details >
SUMIT Payment Gateway for WooCommerce < 4.0.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111957
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
SUMIT Payment Gateway for WooCommerce [woo-payment-gateway-officeguy]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111842
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
HarshG
More Details >
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112241
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
Deva Parekh
More Details >
SureCart <= 4.9.4 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108073
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
cyberkareem
More Details >
SureDash – Community, Courses & Member Dashboard <= 1.12.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110894
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
SureDash – Community, Courses & Member Dashboard [suredash]
Researcher
yzx001
More Details >
SureDash – Community, Courses & Member Dashboard <= 1.12.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110893
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
SureDash – Community, Courses & Member Dashboard [suredash]
Researcher
yzx001
More Details >
Synchrony Financing 1.0.5 - 1.1.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-100145
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Synchrony Financing [synchrony-payments]
Researcher
Naoki Kawahigashi
More Details >
TI WooCommerce Wishlist <= 2.12.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-15261
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
TI WooCommerce Wishlist [ti-woocommerce-wishlist]
Researcher
Duy Tran
More Details >
TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103325
Patch Status
Unpatched
Published
Oct 24, 2026
Affected Software
TiendaCrypto para WooCommerce [tienda-crypto-woo]
Researcher
Naoki Kawahigashi
More Details >
Travelly – Tour & Travel Booking Manager for WooCommerce <= 2.3.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111849
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Travelly – Tour & Travel Booking Manager for WooCommerce [tour-booking-manager]
Researcher
HAIMIN
More Details >
UPI QR Code Payment Gateway for WooCommerce <= 1.6.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114191
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
UPI QR Code Payment Gateway for WooCommerce [upi-qr-code-payment-for-woocommerce]
Researcher
ssophiz
More Details >
Wava Payment 0.3.1 - 0.3.9 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87837
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Wava Payment Plugin [wava-payment]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Wava Payment 0.3.1 - 0.3.9 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87838
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Wava Payment Plugin [wava-payment]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
WholesaleX – All-in-One B2B Solution with Wholesale Pricing < 3.0.9 - Unauthenticated Account Activation Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111955
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
WholesaleX – Wholesale Pricing & B2B Solution [wholesalex]
Researcher
Naoki Kawahigashi
More Details >
WholesaleX <= 3.0.8 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111956
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
WholesaleX – Wholesale Pricing & B2B Solution [wholesalex]
Researcher
Muni Nitish Kumar Yaddala
More Details >
WPMobile.App – Android and iOS App Builder <= 11.86 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-112359
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
WPMobile.App – Android and iOS App Builder [wpappninja]
Researcher
Peter Tang
More Details >
YITH WooCommerce Product Bundles <= 2.29.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111845
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
YITH WooCommerce Product Bundles [yith-woocommerce-product-bundles]
Researcher
Ratchanon Chamnankit
More Details >
ЮKassa для WooCommerce <= 2.17.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-114699
Patch Status
Unpatched
Published
Oct 22, 2026
Affected Software
ЮKassa для WooCommerce [yookassa]
Researcher
Sanjeev Kumar
More Details >
JetBackup – Backup, Restore & Migrate <= 3.1.24.9 - Authenticated (Admin+) Arbitrary File Write
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-104068
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
JetBackup – Backup, Restore & Migrate [backup]
Researcher
Sarvar Eshboyev
More Details >
Contact Form by Supsystic <= 1.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVSS Rating
4.4 (Medium)
CVE-ID
CVE-2025-15705
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]
Researcher
Hanif Naufal Rahman
More Details >
Speed Optimizer – The All-In-One Performance-Boosting Plugin < 7.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVSS Rating
4.4 (Medium)
CVE-ID
CVE-2026-111737
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Speed Optimizer – The All-In-One Performance-Boosting Plugin [sg-cachepress]
Researcher
Karthik Ramakrishnan
More Details >
Advanced Twenty Seventeen <= 1.3.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107887
Patch Status
Unpatched
Published
Oct 21, 2026
Affected Software
Advanced Twenty Seventeen [advanced-twenty-seventeen]
Researcher
Seongwon Lee
More Details >
Backup and Staging by WP Time Capsule <= 1.22.27 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107237
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Backup and Staging by WP Time Capsule [wp-time-capsule]
Researcher
Het Kalariya
More Details >
Car Rental Manager – Online Vehicle Booking System <= 1.5.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112825
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Car Rental Manager – Online Vehicle Booking System [car-rental-manager]
Researcher
Ravenska Dhigna Manggala
More Details >
Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-86611
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Download Manager [download-manager]
Researcher
Kartik sharma
More Details >
Easy Pricing Tables <= 4.1.2 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111947
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Pricing Table WordPress Plugin – Easy Pricing Tables [easy-pricing-tables]
Researcher
RIA Labs
More Details >
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114176
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Aarush Gaur
More Details >
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization to Authenticated (Subscriber+) Zoom API Credential Modification
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114175
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Aarush Gaur
More Details >
Event Tickets and Registration <= 5.30.1 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110902
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Jacek Sowiński (dzaku)
More Details >
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.11.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111836
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses [fluent-community]
Researcher
Hamza Tlili
More Details >
GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-113489
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Karthik Ramakrishnan
More Details >
GiveWP <= 4.19.0.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111980
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Karthik Ramakrishnan
More Details >
GiveWP <= 4.19.0.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111981
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Hariom Singh
More Details >
InstaWP Connect <= 0.1.4.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114743
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]
Researcher
Meher Sudhakar Abbireddi
More Details >
Interactive Content – H5P <= 1.17.9 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112868
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Interactive Content – H5P [h5p]
Researcher
dcs
More Details >
LatePoint <= 5.7.4 - Authenticated (Agent+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105257
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Karthik Ramakrishnan
More Details >
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.10 - Authenticated (Custom+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-113353
Patch Status
Unpatched
Published
Oct 20, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
Trần Văn Hoàng
More Details >
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-42690
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
Ananda Dhakal
More Details >
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110363
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
MD Mahmidul Hasan
More Details >
LiteSpeed Cache < 7.9.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-113501
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Karthik Ramakrishnan
More Details >
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.72 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111847
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
Oly Hossen
More Details >
MAS Videos <= 1.3.4 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107907
Patch Status
Unpatched
Published
Oct 21, 2026
Affected Software
MAS Videos [masvideos]
Researcher
JunHee CHO
More Details >
MasterStudy LMS WordPress Plugin – for Online Courses and Education 3.7.13 - 3.7.54 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-88849
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Arman Kumar
More Details >
MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110011
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
MB Custom Post Types & Custom Taxonomies [mb-custom-post-type]
Researcher
RIA Labs
More Details >
Meta Box – A Framework for Dynamic Websites <= 5.15.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109700
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Meta Box – A Framework for Dynamic Websites [meta-box]
Researcher
Deva Parekh
More Details >
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.9 - 6.3.0 - Two-Factor Authentication Bypass
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111949
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) [miniorange-2-factor-authentication]
Researcher
RIA Labs
More Details >
Moloni <= 5.0.13 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-106932
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Moloni [moloni]
Researcher
Seongwon Lee
More Details >
News Kit Addons For Elementor <= 1.4.7 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-97353
Patch Status
Unpatched
Published
Oct 21, 2026
Affected Software
News Kit Addons For Elementor [news-kit-elementor-addons]
Researcher
Usama Arshad
More Details >
News Kit Addons For Elementor <= 1.4.8 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-97352
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
News Kit Addons For Elementor [news-kit-elementor-addons]
Researcher
Usama Arshad
More Details >
Participants Database <= 2.7.8.5 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112861
Patch Status
Unpatched
Published
Oct 20, 2026
Affected Software
Participants Database [participants-database]
Researcher
Tarcísio Luchesi
More Details >
Photo Engine <= 6.5.7 - Authenticated (Author+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111972
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Photo Engine (Media Organizer & Lightroom) [wplr-sync]
Researcher
Mahammad Mammadov
More Details >
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 4.0.0-beta.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114698
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]
Researcher
MYUNGYONG LEE
More Details >
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114182
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
PowerPack Addons for Elementor: Widgets, Form Styler and Templates [powerpack-lite-for-elementor]
Researcher
yzx001
More Details >
Productive Commerce <= 1.1.48 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109926
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Productive Commerce – Wishlist, Compare & MiniCart [productive-commerce]
Researcher
Daniel Dhaniswara
More Details >
Profile Builder 4.0.0 - 4.0.4 - Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111965
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
Naoki Kawahigashi
More Details >
SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher < 5.3.5 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114120
Patch Status
Unpatched
Published
Oct 21, 2026
Affected Software
SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher [wp-scheduled-posts]
Researcher
buiih
More Details >
Sensei LMS – Online Courses, Quizzes, & Learning <= 4.26.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112328
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Sensei LMS – Online Courses, Quizzes, & Learning [sensei-lms]
Researcher
Ikram-4
More Details >
Sensei LMS – Online Courses, Quizzes, & Learning <= 4.26.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112329
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Sensei LMS – Online Courses, Quizzes, & Learning [sensei-lms]
Researcher
Ikram-4
More Details >
Simple Shopping Cart 5.1.3 - 5.3.2 - Authenticated (Contributor+) Payment Bypass
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104642
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]
Researcher
Haemanth VJ
More Details >
SmartyParcel (WC Ukr Shipping) <= 1.23.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107788
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce [wc-ukr-shipping]
Researcher
Andy Urlep
More Details >
Strong Testimonials <= 3.3.14 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112843
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
mroccon
More Details >
Subscribe to Comments 2.3 - 2.3.2 - Authenticated (Author+) Arbitrary Email Header Injection
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-91831
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
Subscribe to Comments [subscribe-to-comments]
Researcher
Het Kalariya
More Details >
SureDash – Community, Courses & Member Dashboard <= 1.12.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110892
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
SureDash – Community, Courses & Member Dashboard [suredash]
Researcher
yzx001
More Details >
Surfer – WordPress Plugin <= 1.8.0.744 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112222
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Surfer – WordPress Plugin [surferseo]
Researcher
Mor Golan
More Details >
Tailored Tools <= 3.0.3 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111401
Patch Status
Patched
Published
Oct 21, 2026
Affected Software
Tailored Tools [tailored-tools]
Researcher
Oly Hossen
More Details >
VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112836
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Ayukiab
More Details >
VR 8.3.0 - 9.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114742
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]
Researcher
Huseyn Huseynov
More Details >
VR 8.5.55 - 9.1.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114740
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]
Researcher
an7ln
More Details >
VR 9.0.0 - 9.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114741
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]
Researcher
RIA Labs
More Details >
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.25 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-112823
Patch Status
Patched
Published
Oct 20, 2026
Affected Software
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]
Researcher
ssophiz
More Details >
WPZOOM Portfolio <= 1.4.33 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110514
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
WPZOOM Portfolio Lite – Filterable Portfolio Plugin [wpzoom-portfolio]
Researcher
Huseyn
More Details >
Xpro Addons — 150+ Widgets for Elementor <= 1.7.10 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-114177
Patch Status
Patched
Published
Oct 22, 2026
Affected Software
Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons]
Researcher
beopseong.kim
More Details >
AI Engine <= 3.8.5 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-110982
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine]
Researcher
Anatoly Gorbounov
More Details >
Download Monitor < 5.3.5 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-112219
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Download Monitor [download-monitor]
Researcher
Karthik Ramakrishnan
More Details >
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-110537
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Speed Optimizer – The All-In-One Performance-Boosting Plugin < 7.8.5 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-111738
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
Speed Optimizer – The All-In-One Performance-Boosting Plugin [sg-cachepress]
Researcher
Karthik Ramakrishnan
More Details >
Uncanny Toolkit for LearnDash <= 3.8.1 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-107128
Patch Status
Patched
Published
Oct 19, 2026
Affected Software
Uncanny Toolkit for LearnDash [uncanny-learndash-toolkit]
Researcher
Muni Nitish Kumar Yaddala
More Details >
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-111982
Patch Status
Patched
Published
Oct 23, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
Szymon Szymkowiak
More Details >
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026) appeared first on Wordfence.
来源：Wordfence 官方博客 · https://www.wordfence.com/blog/2026/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-october-19-2026-to-october-25-2026/
部分链接为推广/关联链接。