Wordfence 披露 2026 年 10 月 5 日至 11 日 654 个 WordPress 漏洞
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Wordfence 披露 2026 年 10 月 5 日至 11 日新增的 654 个 WordPress 漏洞，涉及 405 个插件和 100 个主题，其中 369 个已修复、285 个尚未修复。
报告汇总了 654 个漏洞及受影响版本、修复状态和 CVE 编号，便于站点维护者核对插件与主题并安排升级。
Last week, there were 654 vulnerabilities disclosed in 405 WordPress Plugins and 100 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 236 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WordPress Core 7.1 – 7.1.2 – Unauthenticated Stored Cross-Site Scripting via Pending Comments
- Abandoned Cart Pro for WooCommerce <= 10.8.0 – Unauthenticated SQL Injection via Guest Persistent Cart meta_value
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 369 |
| Unpatched | 285 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 8 |
| Medium Severity | 377 |
| High Severity | 248 |
| Critical Severity | 21 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 198 |
| Missing Authorization | 112 |
| Deserialization of Untrusted Data | 67 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 61 |
| Exposure of Sensitive Information to an Unauthorized Actor | 45 |
| Improper Privilege Management | 30 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 24 |
| Authorization Bypass Through User-Controlled Key | 21 |
| Unrestricted Upload of File with Dangerous Type | 18 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 15 |
| Improper Control of Generation of Code ('Code Injection') | 10 |
| Improper Authentication | 9 |
| Cross-Site Request Forgery (CSRF) | 8 |
| Client-Side Enforcement of Server-Side Security | 7 |
| Incorrect Authorization | 6 |
| Server-Side Request Forgery (SSRF) | 5 |
| Missing Authentication for Critical Function | 3 |
| Uncontrolled Resource Consumption | 3 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Protection Mechanism Failure | 2 |
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 1 |
| Files or Directories Accessible to External Parties | 1 |
| Improper Authorization | 1 |
| Improper Input Validation | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 |
| Insertion of Sensitive Information Into Sent Data | 1 |
| Loop with Unreachable Exit Condition ('Infinite Loop') | 1 |
| Use of Cache Containing Sensitive Information | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
|
|
61 |
|
|
42 |
|
|
26 |
|
|
26 |
|
|
19 |
|
|
18 |
|
|
16 |
|
|
16 |
|
|
15 |
|
|
13 |
|
|
12 |
|
|
10 |
|
|
8 |
|
|
7 |
|
|
7 |
|
|
7 |
|
|
7 |
|
|
7 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | tenweb-speed-optimizer |
| 10WebSocial | wd-instagram-feed |
| 3D Product configurator for WooCommerce | expivi |
| aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder | ablocks |
| Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning | academy |
| Accept PayPal Payments using Contact Form 7 | contact-form-7-paypal-extension |
| ACF Frontend Admin by DynamiApps | acf-frontend-form-element |
| ACPT (Premium) | advanced-custom-post-type |
| AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | acymailing |
| Additional Order Filters for WooCommerce | additional-order-filters-for-woocommerce |
| Advanced Classifieds & Directory Pro | advanced-classifieds-and-directory-pro |
| Advanced Form Integration — Connect Forms to 300+ Apps | advanced-form-integration |
| Advanced Google reCAPTCHA | advanced-google-recaptcha |
| Advanced IP Blocker | advanced-ip-blocker |
| Advanced Posts Listing – Show Post List Easily | advanced-posts-listing |
| Adwised Web Push Notification | adwised |
| AFFI – Affiliate Marketing for WooCommerce | affi-affiliate-marketing-for-woo |
| affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | affiliate-toolkit-starter |
| AI Content Generator Marketing | ai-content-generator-marketing |
| AI Copilot – Content Generator | ai-copilot-content-generator |
| AI Puffer – AI Chatbot & MCP Server for Claude and ChatGPT | gpt3-ai-content-generator |
| Airwallex Online Payments Gateway | airwallex-online-payments-gateway |
| ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce | woo-alidropship |
| All Bootstrap Blocks | all-bootstrap-blocks |
| Animated Number Counters | animated-number-counters |
| Ansar Import – One Click Starter Sites – for WordPress Themes | ansar-import |
| Anton Extensions | 4nton-extensions |
| App for Cloudflare® | app-for-cf |
| Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | latepoint |
| Appointment Bookings for Zoom GoogleMeet and more – Wappointment | wappointment |
| ARforms | arforms |
| ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup | armember |
| Asgaros Forum | asgaros-forum |
| ASPL Product Quotation | aspl-product-quotation |
| Aurora Heatmap | aurora-heatmap |
| AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI | automatorwp |
| AutoPoly – AI Translation For Polylang | automatic-translations-for-polylang |
| Autoship Cloud for WooCommerce Subscription Products | autoship-cloud |
| Avada (Fusion) Builder | fusion-builder |
| AWP Classifieds | another-wordpress-classifieds-plugin |
| BackWPup – WordPress Backup & Restore Plugin | backwpup |
| Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) | barcode-scanner-lite-pos-to-manage-products-inventory-and-orders |
| Bayarcash WooCommerce | bayarcash-wc |
| bBlocks – Essential Gutenberg Blocks & Patterns Collection | b-blocks |
| Before After Image Comparison – Visual Comparison for Two Images | before-after-image-compare |
| Blocksy Companion | blocksy-companion |
| Blog, Posts and Category Filter for Elementor | blog-posts-and-category-for-elementor |
| Booking Calendar | booking |
| Booking Package | booking-package |
| Booknetic | booknetic |
| Booktics – Appointment Booking Calendar for Service Businesses | booktics |
| Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools | woocommerce-jetpack |
| Bricksforge | bricksforge |
| Brizy – Page Builder | brizy |
| BuddyBoss Platform | buddyboss-platform |
| BuddyPress Instant Chat | bp-instant-chat |
| Builderius – Landing Page Builder + Dynamic Templates | builderius |
| Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms | captcha-bws |
| CF7 Views – Complete Entry Management for Contact Form 7 | cf7-views |
| Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) | charitable |
| Church Admin | church-admin |
| CleanTalk Anti-Spam – Complete Spam Protection | cleantalk-spam-protect |
| click5 CRM add-on to Contact Form 7 | cf7-add-on-by-click5 |
| click5 CRM add-on to Gravity Forms | gf-add-on-by-click5 |
| click5 CRM add-on to Ninja Forms | click5-crm-add-on-to-ninja-forms |
| click5 CRM add-on to WPForms | wpf-add-on-by-click5 |
| Code Snippets | code-snippets |
| CodeBard Help Desk | codebard-help-desk |
| Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress | contact-form-to-db |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| CP Media Player – Audio Player and Video Player | audio-and-video-player |
| Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators | creatorlms |
| Crowdfundly | crowdfundly |
| CURCY – Multi Currency for WooCommerce | woo-multi-currency |
| Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation | popup-by-supsystic |
| Dashboard Notes | dashboard-notes |
| Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables | data-tables-generator-by-supsystic |
| Database Addon For WPForms ( wpforms entries ) – WPFormsDB | database-for-wpforms |
| Database for CF7 | database-for-cf7 |
| Datalist it | datalistit |
| Directory Listings WordPress plugin – uListing | ulisting |
| DirectoryPress – Business Directory And Classified Ad Listing | directorypress |
| Disable Users | disable-users |
| Divi Plus | divi-plus |
| Doctreat Core | doctreat_core |
| Document Embedder – let visitors read files without downloading | document-emberdder |
| Document Gallery | document-gallery |
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | dokan-lite |
| Download Manager | download-manager |
| DTX – Dynamic Text Extension for Contact Form 7 | contact-form-7-dynamic-text-extension |
| Dynamic User Directory | dynamic-user-directory |
| E-cab Taxi Booking Manager for Woocommerce | ecab-taxi-booking-manager |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| eCommerce Product Catalog | ecommerce-product-catalog |
| Edwiser Bridge – WordPress Moodle Integration | edwiser-bridge |
| Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) | elex-bulk-edit-products-prices-attributes-for-woocommerce-basic |
| Email Marketing for WordPress and WooCommerce – Retainful | retainful |
| Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files | embed-any-document |
| Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | envira-gallery-lite |
| eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eroom-zoom-meetings-webinar |
| Event Tickets and Registration | event-tickets |
| Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| Events Manager – Calendar, Bookings, Tickets, Appointments and more! | events-manager |
| Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | everest-backup |
| Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) | extensions-for-cf7 |
| Fastcache by Host.it | fastcache-by-host-it |
| Favicon Rotator | favicon-rotator |
| Filter Everything — WordPress & WooCommerce Filters | filter-everything |
| FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment | firebox |
| Fluent Affiliate Pro | fluent-affiliate-pro |
| Fluent Booking Pro | fluent-booking-pro |
| Fluent Forms Pro Add On Pack | fluentformpro |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| Food Menu – Restaurant Menu & Online Ordering for WooCommerce | tlp-food-menu |
| FooSales – Point of Sale (POS) for WooCommerce | foosales |
| Form Block | form-block |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Freeton WP | freeton-wp |
| Front End PM | front-end-pm |
| Frontend Dashboard | frontend-dashboard |
| Fundiin cho WooCommerce | fundiin |
| FunnelKit – Funnel Builder Plugin for WooCommerce Checkout | funnel-builder |
| FV Flowplayer Video Player | fv-wordpress-flowplayer |
| FV Player 8 | fv-player |
| Gallery PhotoBlocks | photoblocks-grid-gallery |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| GDPR Data Request Form | gdpr-data-request-form |
| Geliver Akıllı Kargo Pazaryeri | geliver-akilli-kargo-pazaryeri |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Getwid – Gutenberg Blocks | getwid |
| GIFT4U – Gift Cards All in One for Woo | gift4u-gift-cards-all-in-one-for-woo |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| Gloria Admin Panel | gloria-admin-panel |
| Gmedia Photo Gallery | grand-media |
| GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI | gptranslate |
| Graphina – Charts and Graphs For Elementor | graphina-elementor-charts-and-graphs |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates | happy-elementor-addons |
| Hello Plus | hello-plus |
| HireZoot – Job Listings, Career Page & Recruitment Tool | wp-job-openings |
| HivePress – Business Directory, Listings & Classified Ads Plugin | hivepress |
| HollerBox — Fast & Effective Popups & Lead-Generation | holler-box |
| HootBoard – Bulletin Board For Your Organization & Team Communication | hootboard |
| Hotel Booking | nd-booking |
| HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player | html5-audio-player |
| HTTP Requests Manager | http-requests-manager |
| Hustle – Email Marketing, Lead Generation, Optins, Popups | wordpress-popup |
| If-So Dynamic Content – Elementor & All Page Builders Personalization | if-so |
| Image Optimizer, Resizer and CDN – Sirv | sirv |
| Image Photo Gallery Final Tiles Grid | final-tiles-grid-gallery-lite |
| Image Slider | image-slider-widget |
| Import and export users and customers | import-users-from-csv-with-meta |
| Instapage Plugin | instapage |
| Insurify – Order & Shipping Protection | insurify |
| Integration for Epos Now and WooCommerce | woo-epos-now-integration |
| JetBlocks for Elementor | jet-blocks |
| JetElements | jet-elements |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| Jetpack VideoPress | jetpack-videopress |
| Jetpack – AI Agents & MCP, Security, Backup & Analytics | jetpack |
| Job Postings | job-postings |
| Jotform – AI Chatbot | jotform-ai-chatbot |
| JS Help Desk – AI-Powered Support & Ticketing System | js-support-ticket |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| KeyWord Collector | keyword-collector |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Kit (formerly ConvertKit) for WooCommerce | convertkit-for-woocommerce |
| Koinonia Link | koinonia-link |
| LazyLoad Plugin – Lazy Load Images, Videos, and Iframes | rocket-lazy-load |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Leyka | leyka |
| LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes | lifterlms |
| Listdom: AI-powered Business Directory with Classifieds Ads Listings | listdom |
| ListingPro Plugin | listingpro-plugin |
| Livees Checkout | livees-checkout |
| Llavero.io | llavero-io |
| Login Lockdown & Protection | login-lockdown |
| Logo Showcase – Logo Slider, Carousel & Sponsors Gallery | logo-showcase |
| Loja Automática | loja-automatica |
| LTL Freight Quotes – ODFL Edition | ltl-freight-quotes-odfl-edition |
| Magee Shortcodes | magee-shortcodes |
| Mailjet Email Marketing | mailjet-for-wordpress |
| MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | mainwp-child |
| Mapster WP Maps | mapster-wp-maps |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| Media Library Assistant | media-library-assistant |
| Memberful – Membership Plugin | memberful-wp |
| MemberHero – Simple User Registration & Login | wp-registration |
| Meta Box AIO | meta-box-aio |
| MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet | paid-membership |
| Midtrans-WooCommerce | midtrans-woocommerce |
| Mindstien Quick Login | mindstien-quick-login |
| miniOrange OTP Login, Verification and SMS Notifications | miniorange-otp-verification |
| Mobile builder | mobile-builder |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress | molongui-authorship |
| Morning for WooCommerce | wc-gateway-greeninvoice |
| Motors – Car Dealership & Classified Listings Plugin | motors-car-dealership-classified-listings |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | multiple-pages-generator-by-porthas |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| Museder RestoreOne | museder-restoreone |
| Music Store – WordPress eCommerce | music-store |
| Name Directory | name-directory |
| Newsletter Subscription Form – User Subscriptions Form, Capture Email | newsletter-subscription-form |
| Nexi XPay Build | nexi-xpay-build |
| Noptin – Newsletter, New Post Notifications & Email Automation | newsletter-optin-box |
| Norvis Backup | norvis-backup |
| Ocean eComm Treasure Box | ocean-ecommerce |
| Ocean Pro Demos | ocean-pro-demos |
| OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | host-webfonts-local |
| Online Scheduling and Appointment Booking System – Bookly | bookly-responsive-appointment-booking-tool |
| Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | optimole-wp |
| Order Export & Order Import for WooCommerce | order-import-export-for-woocommerce |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway | cryptocurrency-payments-using-metamask-for-woocommerce |
| payever Checkout – Composable Payment Gateway | payever-woocommerce-gateway |
| paymendo – Bank Transfer (Lite) | paymendo-bank-transfer |
| Payment Plugins for Stripe WooCommerce | woo-stripe-payment |
| PayPlug for WooCommerce (Official) | payplug |
| PDF Invoices & Packing Slips for WooCommerce – Challan | webappick-pdf-invoice-for-woocommerce |
| peepso | peepso |
| PeproDev Ultimate Profile Solutions | peprodev-ups |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| picu – Online Photo Proofing Gallery | picu |
| Piotnet Addons For Elementor | piotnet-addons-for-elementor |
| Piotnet Forms | piotnetforms |
| Pix por Piggly (para Woocommerce) | pix-por-piggly |
| Podlove Podcast Publisher | podlove-podcasting-plugin-for-wordpress |
| Polylang | polylang |
| Portfolio Filter Gallery – Photo Gallery | portfolio-filter-gallery |
| Porto Theme - Functionality | porto-functionality |
| Post Export Import with Media | post-export-import-with-media |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | post-smtp |
| Post Snippets – Custom WordPress Code Snippets Customizer | post-snippets |
| Post title marquee scroll | post-title-marquee-scroll |
| Post Voting System | post-voting-system |
| PowerPress Podcasting plugin by Blubrry | powerpress |
| PPOM – Product Addons & Custom Fields for WooCommerce | woocommerce-product-addon |
| Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | premium-addons-for-elementor |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Prenotazioni | prenotazioni |
| Presto Player | presto-player |
| Presto Player Pro | presto-player-pro |
| Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons | bdthemes-prime-slider-lite |
| Product Configurator for WooCommerce | product-configurator-for-woocommerce |
| Product Designer for WooCommerce WordPress | Lumise | lumise |
| Pubjet | پابجت | pubjet |
| QA Assistants – Driven by data | qa-heatmap-analytics |
| Qode Music | qode-music |
| Qode Real Estate | qode-real-estate |
| Qode Tours | qode-tours |
| QR Redirector | qr-redirector |
| Quick quotes – WPSHARE247 | quick-quotes-wpshare247 |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events | radius-booking |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| Real Estate Manager – Property Listing and Agent Management | real-estate-manager |
| Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder | real3d-flipbook-lite |
| Recordbrowser | recordbrowser |
| Redux Framework | redux-framework |
| Responsive Lightbox & Gallery | responsive-lightbox |
| Restrict User Access – Ultimate Membership & Content Protection | restrict-user-access |
| Revopic – Photo Reviews for WooCommerce | woo-photo-reviews |
| Robo Gallery – Photo & Image Slider | robo-gallery |
| RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | feedzy-rss-feeds |
| rtMedia for WordPress, BuddyPress and bbPress | buddypress-media |
| SafeSnap – Verified WordPress Backup & Restore | safesnap |
| Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | salon-booking-system |
| Scripts n Styles | scripts-n-styles |
| Sell Downloads | sell-downloads |
| SendPress Newsletters | sendpress |
| Shipping for Nova Poshta | nova-poshta-ttn |
| ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | shortpixel-image-optimiser |
| Simple File List | simple-file-list |
| Simple JWT Login – Allows you to use JWT on REST endpoints. | simple-jwt-login |
| Simple Membership | simple-membership |
| Simply Schedule Appointments | simply-schedule-appointments |
| Site Setup Wizard | site-setup-wizard |
| Sitemovr | sitemovr |
| SiteOrigin Widgets Bundle | so-widgets-bundle |
| SiteVault – Backup, Restore, Migration & Cloning | sitevault-backup-restore-migration |
| SKU Error Fixer for WooCommerce | sku-error-fixer-for-woocommerce |
| Slider by 10Web – Responsive Image Slider | slider-wd |
| SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery | sms-alert |
| SmugMug Embed | smugmug-embed |
| Snapshotify – All-in-One Backup & Restore & Migrate | snapshotify |
| Social Rocket – Social Sharing Plugin | social-rocket |
| Social Share Icons & Social Share Buttons | ultimate-social-media-plus |
| Social Web Suite – Social Media Auto Post, Social Media Auto Publish | social-web-suite |
| SpeedyCache – Cache, Optimization, Performance | speedycache |
| Squadeno – Club Sports Manager | squadeno-club-sports-manager |
| Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | astra-sites |
| StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce | storegrowth-sales-booster |
| StreamCast – bring live radio to your site with a sleek player | streamcast |
| String locator | string-locator |
| Subscribe to Comments | subscribe-to-comments |
| Super Forms – Drag & Drop Form Builder | super-forms |
| Super Payments – WooCommerce Payment Gateway | super-payments |
| Super Video player – Fully Customizable Video Player with Playlist | super-video-player |
| SureDash – Community, Courses & Member Dashboard | suredash |
| Swish Migrate and Backup | swish-migrate-and-backup |
| Table Field Add-on for ACF and SCF | advanced-custom-fields-table-field |
| Tabs Responsive – With WooCommerce Product Tabs Extension | tabs-responsive |
| Tailored Tools | tailored-tools |
| Tainacan | tainacan |
| Taskbot | taskbot |
| Tcard WP | tcard-wp |
| Team Section Block – Showcase Team Members with Layout Options | team-section |
| Team – Team Members Showcase Plugin | tlp-team |
| Testimonials by BestWebSoft | bws-testimonials |
| Thanko Thank You Page Customizer for WooCommerce | woo-thank-you-page-customizer |
| The GDPR Framework By Data443 | gdpr-framework |
| ThemeStek Extras for LabtechCO Theme | themestek-labtechco-extras |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| Tonda Membership | tonda-membership |
| Topcontent | topcontent |
| Tourfic Pro | tourfic-pro |
| Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping | track-orders-for-woocommerce |
| TrueBooker – Appointment Booking and Scheduler System | truebooker-appointment-booking |
| Tutor LMS – eLearning and online course solution | tutor |
| uDesign | Multipurpose WordPress Theme | u-design-core |
| Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform | ultimate-multisite |
| Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets | ultimate-post-kit |
| Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included | uncanny-automator |
| UnitechPay – Wave & Orange Money Payments | unitechpay-paiements-mobile-money |
| Unlimited Elements for Elementor | unlimited-elements-for-elementor |
| Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration | upcasted-s3-offload |
| User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | wp-user-frontend |
| User Private Files – Secure File Sharing and Client Portal Plugin | user-private-files |
| Veeqo for WooCommerce | veeqo-for-woocommerce |
| Video Background Block – Add Stunning Video Backgrounds to Any Section | video-background-block |
| Video Conferencing with Zoom | video-conferencing-with-zoom-api |
| VikBooking Hotel Booking Engine & PMS | vikbooking |
| VikRentCar Car Rental Management System | vikrentcar |
| VillaTheme Core | villatheme-core |
| Visual Composer Website Builder | visualcomposer |
| Vitepos – Point of Sale (POS) for WooCommerce | vitepos-lite |
| W3 Total Cache | w3-total-cache |
| Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | wallet-system-for-woocommerce |
| WC Fields Factory | wc-fields-factory |
| WCFM – Multivendor Marketplace REST API for WooCommerce | wcfm-marketplace-rest-api |
| Web Plura Backup & Restore – Local Backups, Restore & Recovery | web-plura-backup-restore-manager |
| Web Vitals Tracking | web-vitals-tracking |
| WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels | print-invoices-packing-slip-labels-for-woocommerce |
| WeddingCity Lite – Wedding Directory and Listing | weddingcity-lite |
| Wise Chat | wise-chat |
| WooCommerce | woocommerce |
| WooCommerce Bookings | woocommerce-bookings |
| WooCommerce Simple Auctions | woocommerce-simple-auctions |
| Wordable – Export Google Docs to WordPress | wordable |
| Workreap Core | workreap_core |
| WP 2FA – Two-factor authentication for WordPress | wp-2fa |
| WP Admin Audit | wp-admin-audit |
| WP Associate Post R2 | wp-associate-post-r2 |
| WP Booking System – Booking Calendar | wp-booking-system |
| WP Coder – Insert & Manage Code Snippets | wp-coder |
| WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments | delete-all-comments-of-website |
| WP CV Builder | cv-builder |
| WP Directory Kit | wpdirectorykit |
| WP Dummy Content Generator | wp-dummy-content-generator |
| WP Duplicate – WordPress Migration Plugin | local-sync |
| WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce | wp-event-manager |
| WP File Download | wp-file-download |
| WP Mailster | wp-mailster |
| WP Meteor Website Speed Optimization Addon | wp-meteor |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Plugin Info Card | wp-plugin-info-card |
| WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | wp-post-author |
| WP Posts Password Batch Manager | wp-posts-password-batch-manager |
| WP Rocket | wp-rocket |
| WP Rollback – Rollback Plugins and Themes | wp-rollback |
| WP Store Locator | wp-store-locator |
| WP Synchro – The Ultimate WordPress Migration Tool | wpsynchro |
| WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export | wp-ultimate-csv-importer |
| WP User Profiles | wp-user-profiles |
| WP Verify API | wp-verify-api |
| WP-Invoice – Web Invoice and Billing | wp-invoice |
| WP-Partner | wp-partner |
| WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden | wp2leads |
| WPAdverts – Classifieds Plugin | wpadverts |
| WPBase Cache | wpbase-cache |
| WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | wp-cafe |
| WPCOM Member | wpcom-member |
| WPComplete | wpcomplete |
| WpCues Basic Quiz | wpcues-basic-quiz |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | wpfunnels |
| WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | gdpr-cookie-consent |
| WPML Multilingual & Multicurrency for WooCommerce | woocommerce-multilingual |
| WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | wpo365-login |
| wpsection | wpsection |
| WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress | wpvr |
| WXD Backup Lite | wxd-backup-lite |
| XServer Migrator | xserver-migrator |
| Yaad Sarig Payment Gateway For WC | yaad-sarig-payment-gateway-for-wc |
| YITH WooCommerce Affiliates | yith-woocommerce-affiliates |
| YITH WooCommerce Product Add-Ons | yith-woocommerce-product-add-ons |
| YITH WooCommerce Product Bundles | yith-woocommerce-product-bundles |
| Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress | youzify |
| Zero Spam for WordPress | zero-spam |
| Zotpress | zotpress |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Aalto - Architecture and Interior Design WordPress Theme | aalto |
| Alliance | Intranet & Extranet BuddyPress WordPress Theme | alliance |
| Ambed - Wallpapers & Painting Services WordPress Theme | ambed |
| Ambient - Modern Interior Design and Decoration WordPress Theme | ambient |
| Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme | anesta |
| Angio - Creative Music Theme | angio |
| Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) | armania |
| asia-garden | asia-garden |
| Avada | Website Builder For WordPress & WooCommerce | Avada |
| Avala - Wedding & Event WordPress Theme | avala |
| Backhoe - Construction Equipment Rentals WordPress Theme | backhoe |
| Balance | balance |
| Biolife - Organic Food WordPress Theme ( RTL Supported ) | biolife |
| Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL | booklovers |
| Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) | kute-boutique |
| Buzz Stone | Magazine & Viral Blog WordPress Theme | buzzstone |
| Camelia | Floral Studio Florist WordPress Theme | camelia |
| Cardea - Portfolio One Page WordPress Theme | cardea-wp |
| CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor | cleanskin |
| colorit | colorit |
| Convex - Architecture & Interior Design WordPress Theme | convex |
| DK | dk |
| Doctreat - Hospitals and Doctors Directory WordPress Listing Theme | doctreat |
| Drone Media | Aerial Photography & Videography Theme | drone-media |
| Duka Market - Multipurpose eCommerce Template | dukamarket |
| Dwell - Building, Construction & Renovation Theme | dwell |
| Edema | Wellness & Spa WordPress Theme | edema |
| Education Center | LMS & Online Courses WordPress Theme | education |
| Educavo - Education WordPress Theme | educavo |
| EduMall - Professional LMS Education Center WordPress Theme | edumall |
| Equadio | equadio |
| Fabius - One Page Resume WordPress Theme | fabius-wp |
| FC United | Football, Soccer & Sports WordPress Theme + Events & Shop | fcunited |
| Flipmart - MegaOne Multipurpose WordPress Theme | flipmart |
| FoodBakery | Food Delivery Single & Multiple Restaurant Template | foodbakery |
| grandnews | grandnews |
| Graphene | graphene |
| Greeny - Electric Car Dealership WordPress Theme | greeny |
| Grocery Shopping Store | grocery-shopping-store |
| Gutentype | 100% Gutenberg Blog Theme + Elementor | gutentype |
| Hogwords | School, University Education WordPress Theme | hogwords |
| Hygia - Cleaning Services WordPress Theme | hygia |
| Invetex | invetex |
| iPharm - Online Pharmacy Woocommerce Elementor Template Kit | ipharm |
| jacqueline | jacqueline |
| Jannah - Newspaper Magazine News BuddyPress AMP | jannah |
| JobZilla - Job Board WordPress Theme | jobzilla |
| Juno | Kids Toys & Games Store WordPress Theme | junotoys |
| Kalles - Clean, Versatile, Responsive Shopify Theme - RTL support | kalles |
| Kaven - Business One Page WordPress Theme | kaven-wp |
| Kicker - Blog Magazine Theme | kicker |
| Kids Planet - Children Kindergarten and Playgroup WordPress Theme | kidsplanet |
| kidscare | kidscare |
| kuteshop | kuteshop |
| Law Office | law-office |
| Let's Play | Hockey School & Winter Sports WordPress Theme | playhockey |
| LMS - Education WordPress Theme | lms |
| Martfury - Marketplace Mobile App Figma Template | martfury |
| Motors - Car Dealer, Rental & Listing WordPress theme | motors |
| N7 | n7-golf-club |
| Neo | Barber Shop WordPress Theme | neocut |
| Ogency - Web Design Agency WordPress Theme | ogency |
| Original | original |
| Ozeum | Art Gallery and Museum Theme | ozeum |
| Partiso | Political Party & Candidate Elementor Template Kit | partiso |
| Photolia | Photo Company & Supply Store WordPress Theme | photolia |
| Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission | pin-wp |
| Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT | qwery |
| Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme | rosalinda |
| ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme | shift-cv |
| Smart Casa | Home Automation & House Technologies WordPress Theme | smart-casa |
| Smash - Tennis WordPress Theme | smash |
| Splendour | splendour |
| Stargaze | stargaze |
| Tantra | Yoga Studio and Fitness Club WordPress Theme | tantra |
| TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) | techone |
| Teoro - One Page WordPress Theme | teoro-wp |
| Th Shop Mania | th-shop-mania |
| The Voux - A Multipurpose News & Magazine WordPress Theme | thevoux-wp |
| The7 — Website and eCommerce Builder for WordPress | dt-the7 |
| tipsy | tipsy |
| TouchUp - Cosmetic and Plastic Surgery WordPress Theme | touchup |
| Travel Booking WordPress Theme | traveler |
| Travesia | Travel Agency and Tour Booking WordPress Theme | travesia |
| Treck - Immigration and Visa Consulting WordPress Theme | treck |
| TutorStarter | tutorstarter |
| Uminex - Multipurpose WooCommerce Theme | uminex |
| Veto - Politics, Campaign & Candidate WordPress Theme | veto |
| Voldor - Welding & Metal Work WordPress Theme | voldor |
| Volos - One Page Resume WordPress Theme | volos-wp |
| Werkstatt - Creative Portfolio WordPress Theme | werkstatt |
| Whistle - Sports Clothing & Fitness Equipment | whistle-sports-club |
| Windsor - Apartment Complex Single Property WordPress Theme | windsor |
| Wine House | Winery & Restaurant WordPress Theme | wine-house |
| WineShop - Food & Wine Store WordPress Theme | wineshop |
| Woffice CRM | woffice |
| WP Rentals - Booking Accommodation WordPress Theme | wprentals |
| WPLMS Learning Management System for WordPress, WordPress LMS | wplms |
| Yacht Rental - Boat Services WordPress Theme | yacht-rental |
| Zeinet - Internet Provider & Satellite TV | zeinet |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-103889
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
3D Product configurator for WooCommerce [expivi]
Researcher
Osman Hussein
More Details >
Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104732
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Advanced IP Blocker [advanced-ip-blocker]
Researcher
Wordfence PRISM
More Details >
Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104028
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Anton Extensions [4nton-extensions]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-85097
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Bricksforge [bricksforge]
Researcher
d.v4n_s3c
More Details >
Doctreat - Hospitals and Doctors Directory WordPress Listing Theme <= 1.7.0 - Unauthenticated Arbitrary File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-39770
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Doctreat - Hospitals and Doctors Directory WordPress Listing Theme [doctreat]
Researcher
Jamaal ahmed
More Details >
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.13 - Unauthenticated Remote Code Execution
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-39802
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin [everest-backup]
Researcher
Muhammad Sobirov
More Details >
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-94589
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) [extensions-for-cf7]
Researcher
Osman Hussein
More Details >
Freeton WP <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-84737
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Freeton WP [freeton-wp]
Researcher
Naoki Kawahigashi
More Details >
Mindstien Quick Login <= 1.0 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-84734
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Mindstien Quick Login [mindstien-quick-login]
Researcher
Naoki Kawahigashi
More Details >
SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 - Unauthenticated Remote Code Execution
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-42696
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
SiteVault – Backup, Restore, Migration & Cloning [sitevault-backup-restore-migration]
Researcher
Ananda Dhakal
More Details >
SMS Alert <= 4.0.0 - Unauthenticated Arbitrary Account Takeover
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-94256
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]
Researcher
Raphael P. Cigana
More Details >
Tailored Tools <= 3.0.3 - Unauthenticated Arbitrary File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-62025
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Tailored Tools [tailored-tools]
Researcher
V1T
More Details >
Tonda Membership <= 1.0.1 - Unauthenticated Privilege Escalation
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-62022
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Tonda Membership [tonda-membership]
Researcher
Tran Nguyen Bao Khanh
More Details >
Tourfic Pro <= 1.17.3 - Unauthenticated Privilege Escalation
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-39774
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Tourfic Pro [tourfic-pro]
Researcher
Jamaal ahmed
More Details >
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104803
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WPCOM Member [wpcom-member]
Researcher
mamgad (mamgad)
More Details >
Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-97670
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Avada (Fusion) Builder [fusion-builder]
Researchers
Chloe Chamberland
Wordfence Argus
More Details >
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-107645
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Blocksy Companion [blocksy-companion]
Researcher
Sawyer
More Details >
PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-104801
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
PPOM – Product Addons & Custom Fields for WooCommerce [woocommerce-product-addon]
Researcher
whatm
More Details >
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Unauthenticated Arbitrary File Deletion
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-105892
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Dthangws
More Details >
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Deletion
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-39792
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Simple File List [simple-file-list]
Researcher
Philipp Doblhofer
More Details >
Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-17609
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
d.v4n_s3c
More Details >
ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-105701
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
ACPT (Premium) [advanced-custom-post-type]
Researcher
d.v4n_s3c
More Details >
Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-104766
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Wordfence PRISM
More Details >
CodeBard Help Desk <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-62024
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
CodeBard Help Desk [codebard-help-desk]
Researcher
JunHee CHO
More Details >
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Authenticated (Contributor+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-62129
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms]
Researcher
Peter Tang
More Details >
Crowdfundly <= 2.2.2 - Authenticated (Crowdfundly Manager+) Privilege Escalation
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-85126
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Crowdfundly [crowdfundly]
Researcher
Enrico Marcolini
More Details >
FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-77183
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
FooSales – Point of Sale (POS) for WooCommerce [foosales]
Researcher
Supakiad S. (m3ez)
More Details >
FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-83526
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
FV Player 8 [fv-player]
Researcher
Supakiad S. (m3ez)
More Details >
Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-104725
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]
Researcher
Wordfence PRISM
More Details >
LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-104723
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes [lifterlms]
Researcher
Wordfence PRISM
More Details >
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-17196
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
d.v4n_s3c
More Details >
Taskbot <= 6.6 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-39757
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Taskbot [taskbot]
Researcher
Jamaal ahmed
More Details >
Veeqo for WooCommerce <= 2.2.8 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-93550
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Veeqo for WooCommerce [veeqo-for-woocommerce]
Researcher
Naoki Kawahigashi
More Details >
Workreap Core <= 3.4.5 - Authenticated (Employer / Sales Representative+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-39759
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Workreap Core [workreap_core]
Researcher
Jamaal ahmed
More Details >
WP Duplicate – WordPress Migration Plugin <= 1.1.11 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-39755
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WP Duplicate – WordPress Migration Plugin [local-sync]
Researcher
Aurélien BOURDOIS
More Details >
Aalto - Architecture and Interior Design WordPress Theme <= 1.8 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42777
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Aalto - Architecture and Interior Design WordPress Theme [aalto]
Researcher
João Pedro S Alcântara
More Details >
Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104797
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Advanced Form Integration — Connect Forms to 300+ Apps [advanced-form-integration]
Researcher
wachirapong kamphapong (wachiss)
More Details >
AFFI – Affiliate Marketing for WooCommerce <= 1.0.10 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104398
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
AFFI – Affiliate Marketing for WooCommerce [affi-affiliate-marketing-for-woo]
Researcher
V1T
More Details >
Alliance | Intranet & Extranet BuddyPress WordPress Theme <= 3.11 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-78529
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Alliance | Intranet & Extranet BuddyPress WordPress Theme [alliance]
Researcher
Bonds
More Details >
Ambient <= 1.7 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66566
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Ambient - Modern Interior Design and Decoration WordPress Theme [ambient]
Researcher
Tran Nguyen Bao Khanh
More Details >
Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme <= 1.5.3 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66567
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme [anesta]
Researcher
João Pedro S Alcântara
More Details >
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62092
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) [armania]
Researcher
João Pedro S Alcântara
More Details >
Asia Garden <= 1.3.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62125
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
asia-garden [asia-garden]
Researcher
johska
More Details >
Avala <= 1.1.4 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62077
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Avala - Wedding & Event WordPress Theme [avala]
Researcher
João Pedro S Alcântara
More Details >
Backhoe <= 2.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62075
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Backhoe - Construction Equipment Rentals WordPress Theme [backhoe]
Researcher
João Pedro S Alcântara
More Details >
Balance <= 1.12.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93945
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Balance [balance]
Researcher
Bonds
More Details >
Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62096
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Biolife - Organic Food WordPress Theme ( RTL Supported ) [biolife]
Researcher
João Pedro S Alcântara
More Details >
Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL <= 2.13.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62045
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL [booklovers]
Researcher
João Pedro S Alcântara
More Details >
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.4.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42718
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools [woocommerce-jetpack]
Researcher
John Ryan Albon
More Details >
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62099
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) [kute-boutique]
Researcher
João Pedro S Alcântara
More Details >
Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-81797
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Buzz Stone | Magazine & Viral Blog WordPress Theme [buzzstone]
Researcher
daroo
More Details >
Camelia | Floral Studio Florist WordPress Theme <= 1.2.15 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93944
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Camelia | Floral Studio Florist WordPress Theme [camelia]
Researcher
Bonds
More Details >
Cardea <= 2.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62065
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Cardea - Portfolio One Page WordPress Theme [cardea-wp]
Researcher
João Pedro S Alcântara
More Details >
CleanSkin <= 1.5.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42724
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor [cleanskin]
Researcher
Tran Nguyen Bao Khanh
More Details >
CleanSkin <= 1.5.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42723
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor [cleanskin]
Researcher
João Pedro S Alcântara
More Details >
Convex - Architecture & Interior Design WordPress Theme <= 1.16.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93943
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Convex - Architecture & Interior Design WordPress Theme [convex]
Researcher
Bonds
More Details >
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.27 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62032
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
DirectoryPress – Business Directory And Classified Ad Listing [directorypress]
Researcher
0xzenko
More Details >
Drone Media | Aerial Photography & Videography Theme <= 2.2.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66482
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Drone Media | Aerial Photography & Videography Theme [drone-media]
Researcher
João Pedro S Alcântara
More Details >
Duka Market - Multipurpose eCommerce Template <= 1.3.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-48194
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Duka Market - Multipurpose eCommerce Template [dukamarket]
Researcher
João Pedro S Alcântara
More Details >
Dwell - Building, Construction & Renovation Theme <= 1.16.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93942
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Dwell - Building, Construction & Renovation Theme [dwell]
Researcher
Bonds
More Details >
Edema | Wellness & Spa WordPress Theme <= 1.2.2.2 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93941
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Edema | Wellness & Spa WordPress Theme [edema]
Researcher
Bonds
More Details >
Education Center <= 3.6.12 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66483
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Education Center | LMS & Online Courses WordPress Theme [education]
Researcher
Bonds
More Details >
Equadio <= 1.1.4 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62087
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Equadio [equadio]
Researcher
johska
More Details >
Fabius - One Page Resume WordPress Theme <= 1.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62069
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Fabius - One Page Resume WordPress Theme [fabius-wp]
Researcher
João Pedro S Alcântara
More Details >
FC United <= 1.1.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66565
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
FC United | Football, Soccer & Sports WordPress Theme + Events & Shop [fcunited]
Researcher
João Pedro S Alcântara
More Details >
Flipmart - MegaOne Multipurpose WordPress Theme <= 2.8 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62070
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Flipmart - MegaOne Multipurpose WordPress Theme [flipmart]
Researcher
João Pedro S Alcântara
More Details >
FoodBakery <= 4.6 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-78530
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
FoodBakery | Food Delivery Single & Multiple Restaurant Template [foodbakery]
Researcher
Tran Nguyen Bao Khanh
More Details >
GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104899
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Wordfence PRISM
More Details >
Greeny - Electric Car Dealership WordPress Theme <= 2.10.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93940
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Greeny - Electric Car Dealership WordPress Theme [greeny]
Researcher
Bonds
More Details >
Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-92975
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]
Researcher
Wordfence PRISM
More Details >
Gutentype | 100% Gutenberg Blog Theme + Elementor <= 2.1.12 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62046
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Gutentype | 100% Gutenberg Blog Theme + Elementor [gutentype]
Researcher
João Pedro S Alcântara
More Details >
Hogwords | School, University Education WordPress Theme <= 1.2.7 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93938
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Hogwords | School, University Education WordPress Theme [hogwords]
Researcher
Bonds
More Details >
Hygia - Cleaning Services WordPress Theme <= 1.21.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93937
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Hygia - Cleaning Services WordPress Theme [hygia]
Researcher
Bonds
More Details >
Invetex <= 2.18 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62123
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Invetex [invetex]
Researcher
johska
More Details >
iPharm - Online Pharmacy Woocommerce Elementor Template Kit <= 1.2.4 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93936
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
iPharm - Online Pharmacy Woocommerce Elementor Template Kit [ipharm]
Researcher
Bonds
More Details >
Jacqueline | Spa & Massage Salon Beauty Theme <= 2.22 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-78531
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
jacqueline [jacqueline]
Researcher
Bonds
More Details >
Job Postings <= 2.8.2 - Authenticated (Contributor+) Arbitrary File Deletion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-39752
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Job Postings [job-postings]
Researcher
hhhai
More Details >
Juno <= 2.25 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62086
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Juno | Kids Toys & Games Store WordPress Theme [junotoys]
Researcher
johska
More Details >
Kalles <= 1.1.7.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62076
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Kalles - Clean, Versatile, Responsive Shopify Theme - RTL support [kalles]
Researcher
João Pedro S Alcântara
More Details >
Kaven <= 1.2 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62067
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Kaven - Business One Page WordPress Theme [kaven-wp]
Researcher
João Pedro S Alcântara
More Details >
Kicker - Blog Magazine Theme <= 2.2.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66569
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Kicker - Blog Magazine Theme [kicker]
Researcher
João Pedro S Alcântara
More Details >
Kids Care <= 3.2.4 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42704
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
kidscare [kidscare]
Researcher
Tran Nguyen Bao Khanh
More Details >
KuteShop <= 4.2.9 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62115
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
kuteshop [kuteshop]
Researcher
João Pedro S Alcântara
More Details >
Law Office <= 3.20 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62120
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Law Office [law-office]
Researcher
johska
More Details >
Let's Play | Hockey School & Winter Sports WordPress Theme <= 1.1.15 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93935
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Let's Play | Hockey School & Winter Sports WordPress Theme [playhockey]
Researcher
Bonds
More Details >
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-105436
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child]
Researcher
Rafie Muhammad
More Details >
N7 <= 2.21 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62124
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
N7 [n7-golf-club]
Researcher
johska
More Details >
Original <= 1.9.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66568
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Original [original]
Researcher
Bonds
More Details >
Ozeum | Art Gallery and Museum Theme <= 1.3.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62074
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Ozeum | Art Gallery and Museum Theme [ozeum]
Researcher
João Pedro S Alcântara
More Details >
Partiso | Political Party & Candidate Elementor Template Kit <= 1.1.13 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93934
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Partiso | Political Party & Candidate Elementor Template Kit [partiso]
Researcher
Bonds
More Details >
payever – WooCommerce Gateway <= 4.8.2 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42716
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
payever Checkout – Composable Payment Gateway [payever-woocommerce-gateway]
Researcher
Lee chul woong
More Details >
PeepSo <= 9.0.5.4 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-40805
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
peepso [peepso]
Researcher
Ayoub MOUHATTA
More Details >
Photolia | Photo Company & Supply Store WordPress Theme <= 1.0.3 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-78535
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Photolia | Photo Company & Supply Store WordPress Theme [photolia]
Researcher
daroo
More Details >
Presto Player Pro <= 3.0.1 - Authenticated (Author+) Arbitrary File Deletion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66481
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Presto Player Pro [presto-player-pro]
Researcher
0xd4rk5id3
More Details >
Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT <= 3.6.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-78533
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT [qwery]
Researcher
João Pedro S Alcântara
More Details >
Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme <= 1.2.4 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93933
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme [rosalinda]
Researcher
Bonds
More Details >
ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme <= 3.0.14 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66564
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme [shift-cv]
Researcher
Bonds
More Details >
Smart Casa | Home Automation & House Technologies WordPress Theme <= 1.0.12 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93932
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Smart Casa | Home Automation & House Technologies WordPress Theme [smart-casa]
Researcher
Bonds
More Details >
Smash - Tennis WordPress Theme <= 1.12.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93931
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Smash - Tennis WordPress Theme [smash]
Researcher
Bonds
More Details >
Splendour <= 1.23 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62050
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Splendour [splendour]
Researcher
johska
More Details >
Stargaze <= 1.10 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62051
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Stargaze [stargaze]
Researcher
johska
More Details >
String Locator <= 2.6.7 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-97188
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
String locator [string-locator]
Researcher
Raphael P. Cigana
More Details >
Tantra | Yoga Studio and Fitness Club WordPress Theme <= 2.9.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93930
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Tantra | Yoga Studio and Fitness Club WordPress Theme [tantra]
Researcher
Bonds
More Details >
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62094
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) [techone]
Researcher
João Pedro S Alcântara
More Details >
Teoro <= 1.1 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62068
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Teoro - One Page WordPress Theme [teoro-wp]
Researcher
João Pedro S Alcântara
More Details >
The GDPR Framework By Data443 <= 2.5.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-39797
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
The GDPR Framework By Data443 [gdpr-framework]
Researcher
LevinityCyber
More Details >
The Voux <= 6.9.5 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-94067
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
The Voux - A Multipurpose News & Magazine WordPress Theme [thevoux-wp]
Researcher
Tran Nguyen Bao Khanh
More Details >
Tipsy <= 1.6 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62052
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
tipsy [tipsy]
Researcher
johska
More Details >
TouchUp < 1.4 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62020
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
TouchUp - Cosmetic and Plastic Surgery WordPress Theme [touchup]
Researcher
Tran Nguyen Bao Khanh
More Details >
Travesia | Travel Agency and Tour Booking WordPress Theme <= 1.1.16 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93929
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Travesia | Travel Agency and Tour Booking WordPress Theme [travesia]
Researcher
Bonds
More Details >
Uminex - Multipurpose WooCommerce Theme <= 1.0.9 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-48193
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Uminex - Multipurpose WooCommerce Theme [uminex]
Researcher
João Pedro S Alcântara
More Details >
Veto <= 1.6.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93927
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Veto - Politics, Campaign & Candidate WordPress Theme [veto]
Researcher
Bonds
More Details >
Volos <= 1.2 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62066
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Volos - One Page Resume WordPress Theme [volos-wp]
Researcher
João Pedro S Alcântara
More Details >
Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-94062
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Werkstatt - Creative Portfolio WordPress Theme [werkstatt]
Researcher
João Pedro S Alcântara
More Details >
Windsor - Apartment Complex Single Property WordPress Theme <= 2.10 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66563
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Windsor - Apartment Complex Single Property WordPress Theme [windsor]
Researcher
Bonds
More Details >
Wine House | Winery & Restaurant WordPress Theme <= 3.20 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62053
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Wine House | Winery & Restaurant WordPress Theme [wine-house]
Researcher
johska
More Details >
WineShop - Food & Wine Store WordPress Theme <= 3.20 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62090
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
WineShop - Food & Wine Store WordPress Theme [wineshop]
Researcher
johska
More Details >
WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-94538
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP File Download [wp-file-download]
Researcher
t4g0
More Details >
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104759
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]
Researcher
Wordfence PRISM
More Details >
Yacht Rental - Boat Services WordPress Theme <= 2.6 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62054
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Yacht Rental - Boat Services WordPress Theme [yacht-rental]
Researcher
johska
More Details >
Angio <= 1.1.1 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-62021
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Angio - Creative Music Theme [angio]
Researcher
Tran Nguyen Bao Khanh
More Details >
Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-96662
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
zickzick2
More Details >
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.9.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-42417
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup [armember]
Researcher
Rafie Muhammad
More Details >
ASPL Product Quotation <= 1.1.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89287
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
ASPL Product Quotation [aspl-product-quotation]
Researcher
João Ramos Maciel
More Details >
Booknetic <= 4.8.5 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-39746
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Booknetic [booknetic]
Researcher
Bonds
More Details >
ColorFolio <= 1.3 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-94065
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
colorit [colorit]
Researcher
Tran Nguyen Bao Khanh
More Details >
Datalist it <= 0.0.3 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89285
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Datalist it [datalistit]
Researcher
Enrico Marcolini
More Details >
Directory Listings WordPress plugin – uListing <= 2.2.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-62031
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Directory Listings WordPress plugin – uListing [ulisting]
Researcher
endy
More Details >
Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-91136
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Divi Plus [divi-plus]
Researcher
ShinThink
More Details >
Dynamic User Directory <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-42719
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Dynamic User Directory [dynamic-user-directory]
Researcher
Hiro
More Details >
Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-39785
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Gmedia Photo Gallery [grand-media]
Researcher
Coopernicus
More Details >
Llavero.io <= 0.1.4 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89213
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Llavero.io [llavero-io]
Researcher
RIA Labs
More Details >
Loja Automática <= 1.0.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89297
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Loja Automática [loja-automatica]
Researcher
Naoki Kawahigashi
More Details >
LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-87781
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
LTL Freight Quotes – ODFL Edition [ltl-freight-quotes-odfl-edition]
Researcher
achmad sonif
More Details >
Mobile Builder <= 1.4.2 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-103695
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Mobile builder [mobile-builder]
Researcher
Raphael P. Cigana
More Details >
Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-115497
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Music Store – WordPress eCommerce [music-store]
Researcher
Quentin VILLAIN
More Details >
Neo | Barber Shop WordPress <= 3.5 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-94064
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Neo | Barber Shop WordPress Theme [neocut]
Researcher
Tran Nguyen Bao Khanh
More Details >
Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-41555
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Newsletter Subscription Form – User Subscriptions Form, Capture Email [newsletter-subscription-form]
Researcher
dzeusking
More Details >
Paymendo Bank Transfer <= 1.1 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89304
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]
Researcher
Enrico Marcolini
More Details >
Porto Theme - Functionality <= 3.9.3 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-42415
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Porto Theme - Functionality [porto-functionality]
Researcher
Rafie Muhammad
More Details >
Post Voting System <= 1.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89302
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Post Voting System [post-voting-system]
Researcher
Naoki Kawahigashi
More Details >
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-104392
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Ananda Dhakal
More Details >
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.19 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-39764
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events [radius-booking]
Researcher
Pedro "TheZakMan" Araujo
More Details >
RecordBrowser <= 1.1.7 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89232
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Recordbrowser [recordbrowser]
Researcher
Theo Fonseca
More Details >
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89301
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Supakiad S. (m3ez)
More Details >
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-39795
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
SendPress Newsletters [sendpress]
Researcher
Aydan Arabadzha
More Details >
Site Setup Wizard <= 1.5.8 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89195
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Site Setup Wizard [site-setup-wizard]
Researcher
João Ramos Maciel
More Details >
Slider by 10Web – Responsive Image Slider <= 1.2.62 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-105885
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Ananda Dhakal
More Details >
Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-88930
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]
Researcher
Naoki Kawahigashi
More Details >
Tainacan <= 1.3.0 - Authenticated (Custom Role+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-94676
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Tainacan [tainacan]
Researcher
Ananda Dhakal
More Details >
Tcard WP <= 1.8.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-81420
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Tcard WP [tcard-wp]
Researcher
Theo Fonseca
More Details >
Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89235
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Testimonials by BestWebSoft [bws-testimonials]
Researcher
Enrico Marcolini
More Details >
Tickera – Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-105889
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Rasyid Abdi Gantoro
More Details >
Travel Booking WordPress Theme <= 3.2.9 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-93947
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Travel Booking WordPress Theme [traveler]
Researcher
Rafie Muhammad
More Details >
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-82627
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator]
Researcher
0xd4rk5id3
More Details >
Verify API <= 1.0.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89299
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WP Verify API [wp-verify-api]
Researcher
RIA Labs
More Details >
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-93746
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce]
Researcher
Brian Mungai
More Details >
WP Rocket < 3.23.5 - Unauthenticated Denial of Service
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-97076
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WP Rocket [wp-rocket]
Researcher
sahinyes
More Details >
WP-Partner <= 1.2.1 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89234
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WP-Partner [wp-partner]
Researcher
Raúl Conesa
More Details >
WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89214
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WpCues Basic Quiz [wpcues-basic-quiz]
Researcher
João Ramos Maciel
More Details >
AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-85118
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
AI Content Generator Marketing [ai-content-generator-marketing]
Researcher
Enrico Marcolini
More Details >
Doctreat Core <= 1.7.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-39773
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Doctreat Core [doctreat_core]
Researcher
Jamaal ahmed
More Details >
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-96341
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
elaprendiz1927
More Details >
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-103692
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Frontend Dashboard [frontend-dashboard]
Researcher
Ryan Fabella
More Details >
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-104405
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Filip Kowalski
More Details >
Meta Box AIO <= 3.7.1 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-39761
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Meta Box AIO [meta-box-aio]
Researcher
wackydawg
More Details >
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-106610
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]
Researcher
Aliou Cisse (KevineCharles)
More Details >
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.7 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-105070
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Nixxies
More Details >
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-95594
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]
Researcher
Peter Tang
More Details >
SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-94257
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]
Researcher
Raphael P. Cigana
More Details >
Taskbot <= 6.6 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-39753
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Taskbot [taskbot]
Researcher
Jamaal ahmed
More Details >
Ultimate Multisite <= 2.16.0 - Unauthenticated Arbitrary Account Takeover
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-103646
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform [ultimate-multisite]
Researcher
Erwan LR
More Details >
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107742
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]
Researcher
daroo
More Details >
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder <= 2.16.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-40804
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder [ablocks]
Researcher
Akbarov Rauf
More Details >
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-105318
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]
Researcher
Peter Tang
More Details >
Additional Order Filters for WooCommerce <= 1.24 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39800
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Additional Order Filters for WooCommerce [additional-order-filters-for-woocommerce]
Researcher
Tawatchai Pinsuwan
More Details >
Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-87762
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Adwised Web Push Notification [adwised]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Ansar Import – One Click Starter Sites – for WordPress Themes <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39778
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Ansar Import – One Click Starter Sites – for WordPress Themes [ansar-import]
Researcher
K. Sorrachat
More Details >
ARforms <= 7.1.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39766
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
ARforms [arforms]
Researcher
Jamaal ahmed
More Details >
AWP Classifieds <= 4.4.8 - Authenticated (Administrator+) Arbitrary File Upload
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2025-15700
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
AWP Classifieds [another-wordpress-classifieds-plugin]
Researcher
Khaled Alenazi
More Details >
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62116
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
hhhai
More Details >
Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62034
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]
Researcher
Nguyen Ba Khanh
More Details >
Blog, Posts and Category Filter for Elementor <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-40806
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Blog, Posts and Category Filter for Elementor [blog-posts-and-category-for-elementor]
Researcher
JunHee CHO
More Details >
BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-87764
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
BuddyPress Instant Chat [bp-instant-chat]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Builderius – Landing Page Builder + Dynamic Templates <= 1.4-beta - Unauthenticated Server-Side Request Forgery
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-27350
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Builderius – Landing Page Builder + Dynamic Templates [builderius]
Researcher
Athiwat Tiprasaharn (Jitlada)
More Details >
CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-40807
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
CF7 Views – Complete Entry Management for Contact Form 7 [cf7-views]
Researcher
JunHee CHO
More Details >
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104394
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) [charitable]
Researcher
neurotx
More Details >
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-84261
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]
Researcher
Erwan LR
More Details >
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-84260
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]
Researcher
Erwan LR
More Details >
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-84258
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]
Researcher
Erwan LR
More Details >
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-84259
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to WPForms [wpf-add-on-by-click5]
Researcher
Erwan LR
More Details >
Coder 4.0 - 4.5.1 - Authenticated (Editor+) Remote Code Execution
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104677
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WP Coder – Insert & Manage Code Snippets [wp-coder]
Researcher
Ayush Srivastava
More Details >
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress <= 1.7.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39745
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress [contact-form-to-db]
Researcher
dodoh4t
More Details >
Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39731
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Database for CF7 [database-for-cf7]
Researcher
ParkHyunWoo
More Details >
Document Embedder – let visitors read files without downloading <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62037
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Document Embedder – let visitors read files without downloading [document-emberdder]
Researcher
daroo
More Details >
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39781
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Document Gallery [document-gallery]
Researcher
duna
More Details >
Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-14335
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researchers
skyv3il
AmonRa
More Details >
Educavo - Education WordPress Theme <= 3.4.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-78534
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Educavo - Education WordPress Theme [educavo]
Researcher
dutafi
More Details >
Envira Gallery <= 1.16.1 - Authenticated (Admin+) Arbitrary Plugin Installation
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104680
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Karthik Ramakrishnan
More Details >
Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104021
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Fastcache by Host.it [fastcache-by-host-it]
Researcher
Wordfence PRISM
More Details >
Fluent Forms Pro Add On Pack <= 6.2.13 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-94675
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Tarcísio Luchesi
More Details >
Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42709
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Food Menu – Restaurant Menu & Online Ordering for WooCommerce [tlp-food-menu]
Researcher
John Ryan Albon
More Details >
Form Block <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104814
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Form Block [form-block]
Researcher
V1T
More Details >
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-102388
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
b1ue0cean
More Details >
FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-100147
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout [funnel-builder]
Researcher
crow
More Details >
FV Player 8 <= 8.1.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42699
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
FV Player 8 [fv-player]
Researcher
Ananda Dhakal
More Details >
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104672
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
jydae
More Details >
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI < 2.34.14 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-103309
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI [gptranslate]
Researcher
Guntur Wahyu Ramadhan
More Details >
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107657
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]
Researcher
Adrien Brunner
More Details >
HootBoard <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-86798
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
HootBoard – Bulletin Board For Your Organization & Team Communication [hootboard]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Hotel Booking <= 3.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39784
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Hotel Booking [nd-booking]
Researcher
Coopernicus
More Details >
HTTP Requests Manager <= 1.3.11 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39724
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
HTTP Requests Manager [http-requests-manager]
Researcher
dodoh4t
More Details >
Instapage Plugin <= 3.7.2 - Unauthenticated Server-Side Request Forgery
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39728
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Instapage Plugin [instapage]
Researcher
ParkHyunWoo
More Details >
Jannah - Newspaper Magazine News BuddyPress AMP <= 7.6.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42693
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Jannah - Newspaper Magazine News BuddyPress AMP [jannah]
Researcher
Rafie Muhammad
More Details >
Jotform – AI Chatbot <= 3.8.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-40803
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Jotform – AI Chatbot [jotform-ai-chatbot]
Researcher
daroo
More Details >
KeyWord Collector <= 1.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-88905
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
KeyWord Collector [keyword-collector]
Researcher
Enrico Marcolini
More Details >
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-102173
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
Hippolyte Quéré (Hippie) (Hippie)
More Details >
LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-100196
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes [rocket-lazy-load]
Researcher
theviper17y
More Details >
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104670
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
daroo
More Details >
LMS <= 8.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-78532
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
LMS - Education WordPress Theme [lms]
Researcher
Tran Nguyen Bao Khanh
More Details >
LTL Freight Quotes – Old Dominion Edition <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-87780
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
LTL Freight Quotes – ODFL Edition [ltl-freight-quotes-odfl-edition]
Researcher
achmad sonif
More Details >
Mapster WP Maps <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39720
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Mapster WP Maps [mapster-wp-maps]
Researcher
Ananda Dhakal
More Details >
Midtrans-WooCommerce <= 2.32.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39758
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Midtrans-WooCommerce [midtrans-woocommerce]
Researcher
ParkHyunWoo
More Details >
Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-101920
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress [molongui-authorship]
Researcher
crow
More Details >
Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-81929
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Ocean eComm Treasure Box [ocean-ecommerce]
Ocean Pro Demos [ocean-pro-demos]
Researchers
Alex Thomas
Wordfence Argus
More Details >
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-89417
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. [host-webfonts-local]
Researcher
uhcna
More Details >
Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-12626
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Muni Nitish Kumar Yaddala (Stranger825)
More Details >
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.47 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42715
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
neurotx
More Details >
Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-100161
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Revopic – Photo Reviews for WooCommerce [woo-photo-reviews]
Researcher
Adrien Brunner
More Details >
picu – Online Photo Proofing Gallery <= 3.10.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104395
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
picu – Online Photo Proofing Gallery [picu]
Researcher
Intrudify
More Details >
Piotnet Forms <= 1.0.30 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96227
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Piotnet Forms [piotnetforms]
Researcher
Claude Ndanda
More Details >
Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-93775
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Ivaylo
More Details >
Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96840
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Jacek Sowiński (dzaku)
More Details >
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-75962
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App [post-smtp]
Researcher
Adrien Brunner
More Details >
Prenotazioni <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-103305
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Prenotazioni [prenotazioni]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96682
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Presto Player [presto-player]
Researcher
20kilograma
More Details >
Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39726
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Product Designer for WooCommerce WordPress | Lumise [lumise]
Researcher
dutafi
More Details >
Qode Music <= 2.1.8.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42631
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Qode Music [qode-music]
Researcher
Rafie Muhammad
More Details >
Qode Real Estate <= 1.1.7.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42632
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Qode Real Estate [qode-real-estate]
Researcher
Rafie Muhammad
More Details >
Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96558
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Kuba
More Details >
Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) Arbitrary File Upload
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104752
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Karthik Ramakrishnan
More Details >
Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96667
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Real Estate Manager – Property Listing and Agent Management [real-estate-manager]
Researcher
Morato Antoine
More Details >
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39760
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]
Researcher
João Pedro S Alcântara
More Details >
Slider by 10Web – Responsive Image Slider <= 1.2.63 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42711
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
neurotx
More Details >
SmugMug Embed <= 3.13 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-88826
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
SmugMug Embed [smugmug-embed]
Researcher
Enrico Marcolini
More Details >
Social Rocket – Social Sharing Plugin <= 1.3.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42418
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Social Rocket – Social Sharing Plugin [social-rocket]
Researcher
Zein
More Details >
Social Share Icons & Social Share Buttons <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42697
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Social Share Icons & Social Share Buttons [ultimate-social-media-plus]
Researcher
William Honnér
More Details >
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39750
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]
Researcher
Pedro Pinho
More Details >
StreamCast – bring live radio to your site with a sleek player <= 2.4.5 - Unauthenticated Server-Side Request Forgery
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62030
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
StreamCast – bring live radio to your site with a sleek player [streamcast]
Researcher
Asim Alshaya
More Details >
Tabs Responsive – With WooCommerce Product Tabs Extension <= 2.5 - Authenticated (Editor+) Remote Code Execution
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39776
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]
Researcher
Ananda Dhakal
More Details >
Team Section Block – Showcase Team Members with Layout Options <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62027
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Team Section Block – Showcase Team Members with Layout Options [team-section]
Researcher
Asim Alshaya
More Details >
Topcontent <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-88903
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Topcontent [topcontent]
Researcher
Naoki Kawahigashi
More Details >
Tutor LMS – eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42702
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
Intrudify
More Details >
Video Background Block – Add Stunning Video Backgrounds to Any Section <= 2.0.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42634
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Video Background Block – Add Stunning Video Backgrounds to Any Section [video-background-block]
Researcher
John Ryan Albon
More Details >
VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-95684
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
zickzick2
More Details >
VikRentCar Car Rental Management System <= 1.4.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39790
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
dutafi
More Details >
Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-87760
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Web Vitals Tracking [web-vitals-tracking]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
WooCommerce Simple Auctions <= 3.0.10 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42635
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WooCommerce Simple Auctions [woocommerce-simple-auctions]
Researcher
Nguyen Ba Khanh
More Details >
WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments
7.2
CVSS Rating
7.2 (High)
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
WordPress [wordpress]
Researcher
Thomas Chauchefoin
More Details >
WP Associate Post R2 <= 5.0.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-105870
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WP Associate Post R2 [wp-associate-post-r2]
Researcher
Ananda Dhakal
More Details >
WP File Download <= 6.3.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39799
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
WP File Download [wp-file-download]
Researcher
dutafi
More Details >
WP Mailster <= 1.9.0.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-105061
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WP Mailster [wp-mailster]
Researcher
L4m
More Details >
WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96572
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP Meteor Website Speed Optimization Addon [wp-meteor]
Researcher
theviper17y
More Details >
WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96278
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
nh4tvd
More Details >
WPAdverts – Classifieds Plugin <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-97263
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
neurotx
More Details >
WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-100178
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
Morato Antoine
More Details >
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42636
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]
Researcher
Nguyen Kim Sang
More Details >
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96765
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]
Researcher
Sebastian Albrecht (mySebbe)
More Details >
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39780
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress [youzify]
Researcher
etomixer
More Details >
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
6.8
CVSS Rating
6.8 (Medium)
CVE-ID
CVE-2026-104898
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Wordfence PRISM
More Details >
Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
6.8
CVSS Rating
6.8 (Medium)
CVE-ID
CVE-2025-14123
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Redux Framework [redux-framework]
Researcher
shark3y
More Details >
Product Configurator for WooCommerce <= 1.7.5 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-105872
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Product Configurator for WooCommerce [product-configurator-for-woocommerce]
Researcher
Ananda Dhakal
More Details >
Super Video player – Fully Customizable Video Player with Playlist <= 1.8.14 - Authenticated (Editor+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-62044
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Super Video player – Fully Customizable Video Player with Playlist [super-video-player]
Researcher
johska
More Details >
WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-62130
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]
Researcher
Ananda Dhakal
More Details >
YITH WooCommerce Affiliates <= 3.31.0 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-106606
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
YITH WooCommerce Affiliates [yith-woocommerce-affiliates]
Researcher
Ananda Dhakal
More Details >
Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-104915
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]
Researcher
Wordfence PRISM
More Details >
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-62117
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
she11f
More Details >
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-62098
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) [kute-boutique]
Researcher
João Pedro S Alcântara
More Details >
BuddyBoss Platform <= 3.1.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-39771
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
BuddyBoss Platform [buddyboss-platform]
Researcher
dutafi
More Details >
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) <= 1.5.3 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-40800
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) [elex-bulk-edit-products-prices-attributes-for-woocommerce-basic]
Researcher
Aydan Arabadzha
More Details >
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-42633
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
neurotx
More Details >
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Custom Role+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-104408
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]
Researcher
Ayukiab
More Details >
Image Optimizer, Resizer and CDN – Sirv <= 8.2.5 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-104389
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Image Optimizer, Resizer and CDN – Sirv [sirv]
Researcher
Peter Tang
More Details >
Kirki <= 6.3.1 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-84220
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
Karthik Ramakrishnan
More Details >
ListingPro Plugin <= 2.9.12 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-42414
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
ListingPro Plugin [listingpro-plugin]
Researcher
Rafie Muhammad
More Details >
Name Directory <= 1.34.2 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-104397
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Name Directory [name-directory]
Researcher
changsheng
More Details >
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-105317
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Deva Parekh
More Details >
Paymendo Bank Transfer <= 1.1 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-89305
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]
Researcher
Erwan LR
More Details >
Piotnet Addons For Elementor <= 7.1.71 - Authenticated (Contributor+) Arbitrary File Read
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-39754
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Piotnet Addons For Elementor [piotnet-addons-for-elementor]
Researcher
dutafi
More Details >
Qode Tours <= 3.1.3.2 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-42712
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Qode Tours [qode-tours]
Researcher
Rafie Muhammad
More Details >
SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-97348
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
SiteOrigin Widgets Bundle [so-widgets-bundle]
Researcher
Wordfence PRISM
More Details >
Slider by 10Web – Responsive Image Slider <= 1.2.63 - Authenticated (Author+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-42710
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Ananda Dhakal
More Details >
Thanko Thank You Page Customizer for WooCommerce <= 1.2.3 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-103071
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Thanko Thank You Page Customizer for WooCommerce [woo-thank-you-page-customizer]
Researcher
cazy
More Details >
uDesign | Multipurpose WordPress Theme <= 4.15.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-42416
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
uDesign | Multipurpose WordPress Theme [u-design-core]
Researcher
Rafie Muhammad
More Details >
Vitepos – Point of Sale (POS) for WooCommerce <= 3.6.1 - Authenticated (Custom Role+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-105076
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]
Researcher
Peter Tang
More Details >
W3 Total Cache <= 2.10.5 - Authenticated (Author+) Path Traversal
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-107321
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Karthik Ramakrishnan
More Details >
Woffice CRM <= 5.4.35 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-39747
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Woffice CRM [woffice]
Researcher
Bonds
More Details >
WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-107712
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Spy0x7
More Details >
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-96653
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Tarcísio Luchesi De Almeida Silva (Poystick)
More Details >
WP Post Author 4.0.0 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-108125
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]
Researcher
Joshua Martinelle
More Details >
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-25434
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden [wp2leads]
Researcher
johska
More Details >
WPBase Cache <= 5.5.6 - Authenticated (Subscriber+) Denial of Service
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-39767
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WPBase Cache [wpbase-cache]
Researcher
dodoh4t
More Details >
Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-93883
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Advanced Classifieds & Directory Pro [advanced-classifieds-and-directory-pro]
Researcher
Ivaylo
More Details >
Adwised Web Push Notification <= 2.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-87761
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Adwised Web Push Notification [adwised]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97340
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Avada | Website Builder For WordPress & WooCommerce [Avada]
Researcher
Muhamad Visat
More Details >
bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104400
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
bBlocks – Essential Gutenberg Blocks & Patterns Collection [b-blocks]
Researcher
V1T
More Details >
Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-14882
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Brizy – Page Builder [brizy]
Researcher
Webbernaut
More Details >
Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-94421
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Church Admin [church-admin]
Researcher
刀 妖
More Details >
Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-14877
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables [data-tables-generator-by-supsystic]
Researcher
Webbernaut
More Details >
Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96648
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables [data-tables-generator-by-supsystic]
Researcher
braintx
More Details >
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-9696
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Download Manager [download-manager]
Researcher
theviper17y
More Details >
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102401
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Download Manager [download-manager]
Researcher
Wordfence PRISM
More Details >
eCommerce Product Catalog <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105056
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
eCommerce Product Catalog [ecommerce-product-catalog]
Researcher
Ananda Dhakal
More Details >
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105871
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
nh4tvd
More Details >
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105873
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Intrudify
More Details >
Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97396
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Email Marketing for WordPress and WooCommerce – Retainful [retainful]
Researcher
Trithem
More Details >
Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-18558
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files [embed-any-document]
Researcher
Deva Parekh
More Details >
Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104652
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
John Ryan Albon
More Details >
Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104653
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Karthik Ramakrishnan
More Details >
Front End PM <= 11.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-39788
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Front End PM [front-end-pm]
Researcher
Ananda Dhakal
More Details >
Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-6243
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
ACF Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Muhammad Yudha - DJ
More Details >
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-42695
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Supakiad S.
More Details >
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97630
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Thaer Assfour
More Details >
Gallery PhotoBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107323
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Gallery PhotoBlocks [photoblocks-grid-gallery]
Researcher
Andy Urlep
More Details >
GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-14379
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]
Researcher
Supakiad S. (m3ez)
More Details >
GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104993
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Tai Ha (superx)
More Details >
Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-91862
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Getwid – Gutenberg Blocks [getwid]
Researcher
nthng
More Details >
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104404
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Intrudify
More Details >
GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97643
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Wordfence PRISM
More Details >
Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-17025
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Graphene [graphene]
Researcher
stealthcopter
More Details >
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104393
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]
Researcher
Intrudify
More Details >
HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103520
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]
Researcher
zickzick2
More Details >
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-62039
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player [html5-audio-player]
Researcher
Ananda Dhakal
More Details >
Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104409
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Nguyen Ba Khanh
More Details >
Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104646
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Karthik Ramakrishnan
More Details >
Image Slider <= 1.1.130 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-42700
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Image Slider [image-slider-widget]
Researcher
Ananda Dhakal
More Details >
JetBlocks for Elementor <= 1.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-62049
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
JetBlocks for Elementor [jet-blocks]
Researcher
nh4tvd
More Details >
JetElements <= 2.9.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105879
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
JetElements [jet-elements]
Researcher
nh4tvd
More Details >
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105890
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Intrudify
More Details >
Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104762
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Wordfence PRISM
More Details >
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105884
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes [rocket-lazy-load]
Researcher
Intrudify
More Details >
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Instructor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105397
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
HunterSploit
More Details >
Logo Showcase – Logo Slider, Carousel & Sponsors Gallery <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105060
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Logo Showcase – Logo Slider, Carousel & Sponsors Gallery [logo-showcase]
Researcher
Ananda Dhakal
More Details >
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105079
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Deva Parekh
More Details >
Media Library Assistant <= 3.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97294
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
yzx001
More Details >
Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96563
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Kamil B.
More Details >
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104673
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Ananda Dhakal
More Details >
MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-16776
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Wordfence PRISM
More Details >
Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104396
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Name Directory [name-directory]
Researcher
Masaya Morita
More Details >
PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-4791
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
PeproDev Ultimate Profile Solutions [peprodev-ups]
Researcher
zaim
More Details >
Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-12980
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Post Snippets – Custom WordPress Code Snippets Customizer [post-snippets]
Researcher
Philipp Doblhofer
More Details >
PowerPress 11.13.12 - 11.17.9 - Authenticated (Contributor+) Server-Side Request Forgery
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97354
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Raj Ukani
More Details >
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.109 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103084
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]
Researcher
nh4tvd
More Details >
Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103478
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Wordfence PRISM
More Details >
Presto Player <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102914
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Presto Player [presto-player]
Researcher
Intrudify
More Details >
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105875
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite]
Researcher
Intrudify
More Details >
QR Redirector <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105069
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
QR Redirector [qr-redirector]
Researcher
Ananda Dhakal
More Details >
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104391
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Intrudify
More Details >
Robo Gallery – Photo & Image Slider <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105887
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Ananda Dhakal
More Details >
Robo Gallery <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-81153
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Kenneth Billones
More Details >
Robo Gallery <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-81155
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Yaswanth Reddy Sunkara
More Details >
Robo Gallery <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-81154
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Yaswanth Reddy Sunkara
More Details >
Robo Gallery <= 5.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-81156
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Yaswanth Reddy Sunkara
More Details >
RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104735
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds]
Researcher
Wordfence PRISM
More Details >
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103070
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]
Researcher
Intrudify
More Details >
Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103427
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Simple Membership [simple-membership]
Researcher
Maciej Komorowski
More Details >
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102393
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg [astra-sites]
Researcher
fcc
More Details >
SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102774
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
SureDash – Community, Courses & Member Dashboard [suredash]
Researcher
Jacek Sowiński (dzaku)
More Details >
Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-78068
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]
Researcher
Omar Elshopky (3l5h0pky)
More Details >
Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96743
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]
Researcher
Kuba
More Details >
Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102402
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Team – Team Members Showcase Plugin [tlp-team]
Researcher
Wordfence PRISM
More Details >
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96574
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]
Researcher
Tarcísio Luchesi De Almeida Silva (Poystick)
More Details >
WC Fields Factory <= 4.1.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-39727
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WC Fields Factory [wc-fields-factory]
Researcher
ParkHyunWoo
More Details >
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researchers
Zhengyu Liu
Jingcheng Yang
Gavin Zhong
More Details >
WP Plugin Info Card <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-62127
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WP Plugin Info Card [wp-plugin-info-card]
Researcher
V1T
More Details >
WP Store Locator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105078
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WP Store Locator [wp-store-locator]
Researcher
Intrudify
More Details >
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-62029
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]
Researcher
nh4tvd
More Details >
Zotpress <= 7.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-27420
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Zotpress [zotpress]
Researcher
Muhammad Yudha
More Details >
AI Copilot – Content Generator <= 1.5.9 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-39801
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
AI Copilot – Content Generator [ai-copilot-content-generator]
Researcher
hackthesoul
More Details >
FooSales <= 1.43.2 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-93548
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
FooSales – Point of Sale (POS) for WooCommerce [foosales]
Researcher
Naoki Kawahigashi
More Details >
JobZilla - Job Board WordPress Theme <= 2.2 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-39775
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
JobZilla - Job Board WordPress Theme [jobzilla]
Researcher
Jamaal ahmed
More Details >
Koinonia Link 1.1.2 - 1.1.4 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-87782
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Koinonia Link [koinonia-link]
Researcher
Ryan Fabella
More Details >
Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-103694
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Mobile builder [mobile-builder]
Researcher
Raphael P. Cigana
More Details >
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-93509
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Stefan Löwen
More Details >
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-93509
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Stefan Löwen
More Details >
WP User Profiles <= 2.7.3 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-105058
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WP User Profiles [wp-user-profiles]
Researcher
nguyen viet tin
More Details >
Ambed <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62064
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Ambed - Wallpapers & Painting Services WordPress Theme [ambed]
Researcher
Tran Nguyen Bao Khanh
More Details >
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62091
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) [armania]
Researcher
João Pedro S Alcântara
More Details >
Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94154
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Aurora Heatmap [aurora-heatmap]
Researcher
lhking
More Details >
Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62095
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Biolife - Organic Food WordPress Theme ( RTL Supported ) [biolife]
Researcher
João Pedro S Alcântara
More Details >
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-12054
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Download Manager [download-manager]
Researcher
Yuvraj Tomar
More Details >
Education Center <= 3.6.12 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94063
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Education Center | LMS & Online Courses WordPress Theme [education]
Researcher
João Pedro S Alcântara
More Details >
EduMall - Professional LMS Education Center WordPress Theme <= 4.5.3 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-39748
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
EduMall - Professional LMS Education Center WordPress Theme [edumall]
Researcher
dutafi
More Details >
Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-5725
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Favicon Rotator [favicon-rotator]
Researcher
Kitch
More Details >
Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-87869
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Filter Everything — WordPress & WooCommerce Filters [filter-everything]
Researcher
Omar Elshopky (3l5h0pky)
More Details >
Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-103998
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]
Researcher
Kuba
More Details >
Gloria Admin Panel <= 1.3 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94158
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Gloria Admin Panel [gloria-admin-panel]
Researcher
João Pedro S Alcântara
More Details >
If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-87971
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so]
Researcher
Utkarsh Choudhary
More Details >
Kids Planet - Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-57742
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Kids Planet - Children Kindergarten and Playgroup WordPress Theme [kidsplanet]
Researcher
João Pedro S Alcântara
More Details >
KuteShop <= 4.2.9 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62100
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
kuteshop [kuteshop]
Researcher
João Pedro S Alcântara
More Details >
Magee Shortcodes <= 2.1.1 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-105316
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Magee Shortcodes [magee-shortcodes]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Martfury - Marketplace Mobile App Figma Template <= 3.3.9 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-57806
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Martfury - Marketplace Mobile App Figma Template [martfury]
Researcher
João Pedro S Alcântara
More Details >
Ogency <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94059
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Ogency - Web Design Agency WordPress Theme [ogency]
Researcher
Tran Nguyen Bao Khanh
More Details >
Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-89100
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Payment Plugins for Stripe WooCommerce [woo-stripe-payment]
Researcher
Adrien Brunner
More Details >
Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission <= 7.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62082
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission [pin-wp]
Researcher
João Pedro S Alcântara
More Details >
Subscribe to Comments <= 2.3.2 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-91829
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Subscribe to Comments [subscribe-to-comments]
Researcher
Het Kalariya
More Details >
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62093
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) [techone]
Researcher
João Pedro S Alcântara
More Details >
ThemeStek Extras for LabtechCO Theme <= 8.4 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94160
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
ThemeStek Extras for LabtechCO Theme [themestek-labtechco-extras]
Researcher
João Pedro S Alcântara
More Details >
Treck <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94058
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Treck - Immigration and Visa Consulting WordPress Theme [treck]
Researcher
Tran Nguyen Bao Khanh
More Details >
Voldor <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94060
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Voldor - Welding & Metal Work WordPress Theme [voldor]
Researcher
Tran Nguyen Bao Khanh
More Details >
Whistle - Sports Club <= 4.2 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94061
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Whistle - Sports Clothing & Fitness Equipment [whistle-sports-club]
Researcher
João Pedro S Alcântara
More Details >
WPAdverts – Classifieds Plugin <= 2.3.4 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-97264
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
neurotx
More Details >
WPLMS Learning Management System for WordPress, WordPress LMS <= 4.972 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-39722
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WPLMS Learning Management System for WordPress, WordPress LMS [wplms]
Researcher
João Pedro S Alcântara
More Details >
Zeinet <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-93951
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Zeinet - Internet Provider & Satellite TV [zeinet]
Researcher
Tran Nguyen Bao Khanh
More Details >
Kirki <= 6.3.1 - Authenticated (Editor+) Server-Side Request Forgery
5.5
CVSS Rating
5.5 (Medium)
CVE-ID
CVE-2026-84224
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
Mohammed Abd Alrahman
More Details >
Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-104022
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]
Researcher
Wordfence PRISM
More Details >
Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-103424
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect]
Researcher
Maciej Komorowski
More Details >
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-17538
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
owlmind
More Details >
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-15178
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]
Researcher
Nadir Şensoy
More Details >
Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-5727
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Hello Plus [hello-plus]
Researcher
normaandersonfrank
More Details >
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-102291
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
Jacek Sowiński (dzaku)
More Details >
Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-103482
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Noptin – Newsletter, New Post Notifications & Email Automation [newsletter-optin-box]
Researcher
crow
More Details >
10WebSocial <= 1.4.35 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39787
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
10WebSocial [wd-instagram-feed]
Researcher
Ananda Dhakal
More Details >
Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105989
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]
Researcher
Daniel Dhaniswara
More Details >
Accept PayPal Payments Using Contact Form 7 <= 4.0.6 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105990
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Advanced Google reCAPTCHA <= 5.40 - Unauthenticated Login Protection Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-100518
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Advanced Google reCAPTCHA [advanced-google-recaptcha]
Researcher
Asim Alshaya
More Details >
Advanced Posts Listing – Show Post List Easily <= 1.0.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39796
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Advanced Posts Listing – Show Post List Easily [advanced-posts-listing]
Researcher
Mohamed Bassia
More Details >
Airwallex Online Payments Gateway <= 1.35.0 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103517
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Airwallex Online Payments Gateway [airwallex-online-payments-gateway]
Researcher
Pedro Pinho
More Details >
Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-6723
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
awhacken
More Details >
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.7.3 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105198
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Vũ Quang Huy
More Details >
Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.7 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39756
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Appointment Bookings for Zoom GoogleMeet and more – Wappointment [wappointment]
Researcher
Md. Minaruzzaman Shovon
More Details >
Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39762
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Autoship Cloud for WooCommerce Subscription Products [autoship-cloud]
Researcher
Averon Averenkov
More Details >
BackWPup – WordPress Backup & Restore Plugin < 5.7.7 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86826
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
BackWPup – WordPress Backup & Restore Plugin [backwpup]
Researcher
Philipp Doblhofer
More Details >
BackWPup – WordPress Backup & Restore Plugin 3.3 - 5.7.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86827
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
BackWPup – WordPress Backup & Restore Plugin [backwpup]
Researcher
Duy Tran
More Details >
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62118
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
she11f
More Details >
Bayarcash WooCommerce <= 4.4.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106609
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Bayarcash WooCommerce [bayarcash-wc]
Researcher
Nguyen Ba Khanh
More Details >
Booking Calendar < 11.8 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105193
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Booking Calendar [booking]
Researcher
Olaf Schigt
More Details >
Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-18496
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Booking Calendar [booking]
Researcher
Jonah Burgess (CryptoCat)
More Details >
Booking Package <= 1.7.29 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105995
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Booking Package [booking-package]
Researcher
Md. Moniruzzaman Prodhan
More Details >
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms <= 5.2.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39772
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms [captcha-bws]
Researcher
Ananda Dhakal
More Details >
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-84254
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]
Researcher
Enrico Marcolini
More Details >
click5 CRM add-on to Gravity Forms <= 1.0.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-84253
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]
Researcher
Enrico Marcolini
More Details >
click5 CRM add-on to Ninja Forms <= 1.0.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-84251
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]
Researcher
Enrico Marcolini
More Details >
click5 CRM add-on to WPForms <= 1.0.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-84252
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to WPForms [wpf-add-on-by-click5]
Researcher
Enrico Marcolini
More Details >
Contest Gallery <= 33.0.0 - Unauthenticated Unauthorized Account Activation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107120
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Akshat Parikh
More Details >
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62128
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms]
Researcher
Peter Tang
More Details >
CURCY – Multi Currency for WooCommerce <= 2.2.17 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97071
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
CURCY – Multi Currency for WooCommerce [woo-multi-currency]
Researcher
dcs
More Details >
CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-3717
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP CV Builder [cv-builder]
Researcher
Teerachai Somprasong
More Details >
DK <= 3.2.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42706
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
DK [dk]
Researcher
Tran Nguyen Bao Khanh
More Details >
DTX – Dynamic Text Extension for Contact Form 7 <= 5.0.7 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62043
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
DTX – Dynamic Text Extension for Contact Form 7 [contact-form-7-dynamic-text-extension]
Researcher
Asim Alshaya
More Details >
E-cab Taxi Booking Manager for Woocommerce <= 2.1.1 - Missing Authroization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103351
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]
Researcher
Peter Tang
More Details >
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42638
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Ananda Dhakal
More Details >
Easy Digital Downloads <= 3.7.0 - Unauthenticated Unauthorized Account Creation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105190
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Rik de Kok
More Details >
Edwiser Bridge – WordPress Moodle Integration <= 4.3.4 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39729
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Edwiser Bridge – WordPress Moodle Integration [edwiser-bridge]
Researcher
Jakub Herman
More Details >
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62038
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Jakub Herman
More Details >
Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105893
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Matthew Lapinski
More Details >
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97300
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Ratchanon Chamnankit
More Details >
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103684
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Peter Tang
More Details >
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105073
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Peter Tang
More Details >
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105068
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
Ananda Dhakal
More Details >
FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104724
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment [firebox]
Researcher
Wordfence PRISM
More Details >
Fluent Affiliate Pro <= 1.6.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39789
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Fluent Affiliate Pro [fluent-affiliate-pro]
Researcher
Ananda Dhakal
More Details >
Fluent Booking Pro < 2.5.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105072
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Fluent Booking Pro [fluent-booking-pro]
Researcher
Ananda Dhakal
More Details >
Fluent Forms Pro Add On Pack <= 6.2.13 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94669
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Tarcísio Luchesi
More Details >
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-65459
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
Ananda Dhakal
More Details >
Fundiin <= 3.4.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-81649
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Fundiin cho WooCommerce [fundiin]
Researcher(s): Unknown
More Details >
Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103378
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Geliver Akıllı Kargo Pazaryeri [geliver-akilli-kargo-pazaryeri]
Researcher
Naoki Kawahigashi
More Details >
GIFT4U – Gift Cards All in One for Woo <= 1.1.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103357
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
GIFT4U – Gift Cards All in One for Woo [gift4u-gift-cards-all-in-one-for-woo]
Researcher
dcs
More Details >
GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106600
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Enis Getmez
More Details >
Grand News <= 3.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42705
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
grandnews [grandnews]
Researcher
Tran Nguyen Bao Khanh
More Details >
Graphina – Charts and Graphs For Elementor <= 3.1.12 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39769
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]
Researcher
Ananda Dhakal
More Details >
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104385
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]
Researcher
Ayukiab
More Details >
HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.14 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106603
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
HollerBox — Fast & Effective Popups & Lead-Generation [holler-box]
Researcher
benzdeus
More Details >
Insurify <= 1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86717
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Insurify – Order & Shipping Protection [insurify]
Researcher
Naoki Kawahigashi
More Details >
Insurify <= 1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-85121
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Insurify – Order & Shipping Protection [insurify]
Researcher
Enrico Marcolini
More Details >
Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103323
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Integration for Epos Now and WooCommerce [woo-epos-now-integration]
Researcher
Raphael P. Cigana
More Details >
Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106601
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Jetpack – AI Agents & MCP, Security, Backup & Analytics [jetpack]
Researcher
Ananda Dhakal
More Details >
Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106602
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Jetpack – AI Agents & MCP, Security, Backup & Analytics [jetpack]
Researcher
Ananda Dhakal
More Details >
Kit (formerly ConvertKit) for WooCommerce <= 2.2.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105421
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Kit (formerly ConvertKit) for WooCommerce [convertkit-for-woocommerce]
Researcher
Peter Tang
More Details >
Livees Checkout 6.8 - 7.0.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86851
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Livees Checkout [livees-checkout]
Researcher
Naoki Kawahigashi
More Details >
Login Lockdown & Protection <= 2.17 - Unauthenticated Login Lockout Protection Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97308
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Login Lockdown & Protection [login-lockdown]
Researcher
Ananda Dhakal
More Details >
Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105322
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Magee Shortcodes [magee-shortcodes]
Researcher
Erwan LR
More Details >
Mailjet Email Marketing <= 6.2.3 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39791
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Mailjet Email Marketing [mailjet-for-wordpress]
Researcher
Ananda Dhakal
More Details >
Modula Image Gallery – Photo Grid & Video Gallery <= 3.0.11 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105876
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Peter Tang
More Details >
Morning for WooCommerce <= 2.4.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39723
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Morning for WooCommerce [wc-gateway-greeninvoice]
Researcher
ParkHyunWoo
More Details >
Motors - Car Dealer, Rental & Listing WordPress theme <= 1.4.108 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-93950
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Motors - Car Dealer, Rental & Listing WordPress theme [motors]
Researcher
Jonathan Dersch
More Details >
Motors – Car Dealership & Classified Listings Plugin <= 1.4.124 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104399
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Ananda Dhakal
More Details >
Museder RestoreOne <= 2.7.276 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-41561
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Museder RestoreOne [museder-restoreone]
Researcher
Ananda Dhakal
More Details >
Nexi XPay Build 7.0.0 - 7.6.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-82211
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Nexi XPay Build [nexi-xpay-build]
Researcher
Naoki Kawahigashi
More Details >
Nexi XPay Build 7.2.2 - 7.6.2 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-82212
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Nexi XPay Build [nexi-xpay-build]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Norvis Backup <= 1.1.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-41562
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Norvis Backup [norvis-backup]
Researcher
Ananda Dhakal
More Details >
Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103365
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
R3D
More Details >
Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94375
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Order Export & Order Import for WooCommerce [order-import-export-for-woocommerce]
Researcher
Boluwatife Opeyemi (tcyph3r)
More Details >
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 - Unauthenticated Arbitrary Order Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107420
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway [cryptocurrency-payments-using-metamask-for-woocommerce]
Researcher
luffy
More Details >
PayPlug for WooCommerce (Official) <= 3.1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39751
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
PayPlug for WooCommerce (Official) [payplug]
Researcher
Jakub Herman
More Details >
PayPlug for WooCommerce (Official) <= 3.1.0 - Missing Authorization to Unauthenticated Settings Change
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42637
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
PayPlug for WooCommerce (Official) [payplug]
Researcher
Filip Kecman
More Details >
picu – Online Photo Proofing Gallery <= 3.10.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104406
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
picu – Online Photo Proofing Gallery [picu]
Researcher
Intrudify
More Details >
Posts Password Batch Manager <= 1.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-89283
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WP Posts Password Batch Manager [wp-posts-password-batch-manager]
Researcher
Naoki Kawahigashi
More Details >
PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104387
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
b1ue0cean
More Details >
PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104388
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Peter Tang
More Details >
Quick quotes <= 1.0.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86706
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Quick quotes – WPSHARE247 [quick-quotes-wpshare247]
Researcher
Naoki Kawahigashi
More Details >
Restrict User Access – Ultimate Membership & Content Protection <= 2.8.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62040
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Restrict User Access – Ultimate Membership & Content Protection [restrict-user-access]
Researcher
Salúa Es-sair
More Details >
SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-41559
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
SafeSnap – Verified WordPress Backup & Restore [safesnap]
Researcher
Ananda Dhakal
More Details >
Scripts n Styles <= 3.5.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62042
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Scripts n Styles [scripts-n-styles]
Researcher
Que Thanh Tuan
More Details >
Sell Downloads <= 1.2.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94590
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Sell Downloads [sell-downloads]
Researcher
c4st1e
More Details >
SendPress <= 1.26.1.20 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-92990
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
SendPress Newsletters [sendpress]
Researcher
Usama Arshad
More Details >
Shipping for Nova Poshta 1.18.7 - 1.19.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87846
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Shipping for Nova Poshta [nova-poshta-ttn]
Researcher
emiliano carrizo
More Details >
Sitemovr <= 1.0.1 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-41563
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Sitemovr [sitemovr]
Researcher
Ananda Dhakal
More Details >
SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105071
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
SiteVault – Backup, Restore, Migration & Cloning [sitevault-backup-restore-migration]
Researcher
Ananda Dhakal
More Details >
SKU Error Fixer for WooCommerce <= 1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86850
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
SKU Error Fixer for WooCommerce [sku-error-fixer-for-woocommerce]
Researcher
Naoki Kawahigashi
More Details >
Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42413
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Snapshotify – All-in-One Backup & Restore & Migrate [snapshotify]
Researcher
Ananda Dhakal
More Details >
Social Web Suite <= 4.1.12 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-88931
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]
Researcher
Naoki Kawahigashi
More Details >
Super Payments <= 1.43.0 - Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Forgery
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103329
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Super Payments – WooCommerce Payment Gateway [super-payments]
Researcher
Naoki Kawahigashi
More Details >
Swish Migrate and Backup <= 1.4.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42419
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Swish Migrate and Backup [swish-migrate-and-backup]
Researcher
Ananda Dhakal
More Details >
The7 — Website and eCommerce Builder for WordPress <= 14.2.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-66588
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
The7 — Website and eCommerce Builder for WordPress [dt-the7]
Researcher
Bonds
More Details >
Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping < 1.2.7 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94275
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping [track-orders-for-woocommerce]
Researcher
Pedro Pinho
More Details >
TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Settings Update
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39798
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Abdullah Kareem "cyberkareem"
More Details >
TutorStarter <= 4.0.3 - Unauthenticated Unauthorized User Account Creation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104671
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
TutorStarter [tutorstarter]
Researcher
Alexander Jurkschat
More Details >
UnitechPay <= 1.0.6.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87841
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
UnitechPay – Wave & Orange Money Payments [unitechpay-paiements-mobile-money]
Researcher
Timur Jurayev
More Details >
WCFM – Multivendor Marketplace REST API for WooCommerce <= 1.6.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39794
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WCFM – Multivendor Marketplace REST API for WooCommerce [wcfm-marketplace-rest-api]
Researcher
Lee chul woong
More Details >
Web Plura Backup & Restore – Local Backups, Restore & Recovery <= 0.2.25 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42630
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Web Plura Backup & Restore – Local Backups, Restore & Recovery [web-plura-backup-restore-manager]
Researcher
Ananda Dhakal
More Details >
WeddingCity Lite <= 1.0.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106029
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WeddingCity Lite – Wedding Directory and Listing [weddingcity-lite]
Researcher
Naoki Kawahigashi
More Details >
WooCommerce Bookings <= 3.10.0 - Unauthenticated Denial of Service
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-14854
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WooCommerce Bookings [woocommerce-bookings]
Researcher
Mike Gozdiskowski
More Details >
WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-66666
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Ananda Dhakal
More Details >
WP Rentals - Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-27434
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
WP Rentals - Booking Accommodation WordPress Theme [wprentals]
Researcher
João Pedro S Alcântara
More Details >
WP Rocket < 3.23.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97075
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WP Rocket [wp-rocket]
Researcher
T.Kalimullin
More Details >
WP Rollback – Rollback Plugins and Themes <= 3.1.2 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-66435
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WP Rollback – Rollback Plugins and Themes [wp-rollback]
Researcher
Ananda Dhakal
More Details >
WPCafe <= 3.0.20 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86816
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]
Researcher
Usama Arshad
More Details >
WXD Backup Lite <= 1.0.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-41560
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WXD Backup Lite [wxd-backup-lite]
Researcher
Ananda Dhakal
More Details >
XServer Migrator <= 1.6.6 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-102387
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
XServer Migrator [xserver-migrator]
Researcher
Ismayil Tahmazov
More Details >
YITH WooCommerce Product Add-Ons <= 4.34.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-66480
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
YITH WooCommerce Product Add-Ons [yith-woocommerce-product-add-ons]
Researcher
Phat RiO | João Pedro S Alcântara
More Details >
YITH WooCommerce Product Bundles <= 2.29.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105878
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
YITH WooCommerce Product Bundles [yith-woocommerce-product-bundles]
Researcher
sungbyeongchan
More Details >
Zero Spam for WordPress <= 5.7.11 - Unauthenticated Spam Protection Bypass on Login
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105057
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Zero Spam for WordPress [zero-spam]
Researcher
Peter Tang
More Details >
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42721
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Ananda Dhakal
More Details >
Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104667
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Animated Number Counters [animated-number-counters]
Researcher
Seongwon Lee
More Details >
BackWPup – WordPress Backup & Restore Plugin < 5.7.7 - Authenticated (Administrator+) Path Traversal
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-86828
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
BackWPup – WordPress Backup & Restore Plugin [backwpup]
Researcher
Bhaveshkumar Parmar
More Details >
Code Snippets <= 3.9.0 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-106097
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Code Snippets [code-snippets]
Researcher
Sarthak Saxena
More Details >
Dynamic User Directory <= 2.4 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42720
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Dynamic User Directory [dynamic-user-directory]
Researcher
Ananda Dhakal
More Details >
Frontend Admin by DynamiApps <= 3.29.13 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42722
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
ACF Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Ananda Dhakal
More Details >
Leyka <= 3.32.3 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42717
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Leyka [leyka]
Researcher
Ananda Dhakal
More Details >
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104722
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Listdom: AI-powered Business Directory with Classifieds Ads Listings [listdom]
Researcher
Wordfence PRISM
More Details >
MPG <= 4.2.2 - Authenticated (Editor+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104953
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researcher
ieuns
More Details >
Pix por Piggly (para Woocommerce) <= 2.1.2 - Authenticated (Shop Manager+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42714
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Pix por Piggly (para Woocommerce) [pix-por-piggly]
Researcher
Ananda Dhakal
More Details >
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104763
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Post Export Import with Media [post-export-import-with-media]
Researcher
Wordfence PRISM
More Details >
Post title marquee scroll <= 9.9 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42713
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Post title marquee scroll [post-title-marquee-scroll]
Researcher
Ananda Dhakal
More Details >
Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104753
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Karthik Ramakrishnan
More Details >
Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104023
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation [popup-by-supsystic]
Researcher
Wordfence PRISM
More Details >
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 4.0.0 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42708
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]
Researcher
Ananda Dhakal
More Details >
WP Post Author <= 4.0.0 - Authenticated (Admin+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-108124
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]
Researcher
Joshua Martinelle
More Details >
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.2 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-45440
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]
Researcher
Ananda Dhakal
More Details >
WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export
4.8
CVSS Rating
4.8 (Medium)
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Anthropic
More Details >
Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-101324
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]
Researcher
Santh
More Details >
Import and export users and customers <= 2.5.5 - Authenticated (Editor+) Privilege Escalation
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-104757
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Ananda Dhakal
More Details >
JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-103912
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Zenith-sec
More Details >
PDF Invoices & Packing Slips for WooCommerce – Challan <= 3.7.88 - Authenticated (Shop Manager+) Privilege Escalation
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-39765
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
PDF Invoices & Packing Slips for WooCommerce – Challan [webappick-pdf-invoice-for-woocommerce]
Researcher
Ananda Dhakal
More Details >
WooCommerce 9.8.0 - 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-106608
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WooCommerce [woocommerce]
Researcher
Ananda Dhakal
More Details >
WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-101921
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite]
Researcher
UKO
More Details >
Job Openings <= 3.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVSS Rating
4.4 (Medium)
CVE-ID
CVE-2025-15703
Patch Status
Patched
Published
Oct 10, 2026
Affected Software
HireZoot – Job Listings, Career Page & Recruitment Tool [wp-job-openings]
Researcher
Krugov Artyom
More Details >
Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVSS Rating
4.4 (Medium)
CVE-ID
CVE-2026-104754
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Karthik Ramakrishnan
More Details >
Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
4.4
CVSS Rating
4.4 (Medium)
CVE-ID
CVE-2026-103897
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Responsive Lightbox & Gallery [responsive-lightbox]
Researcher
Jakub Herman
More Details >
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104050
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]
Researcher
Morato Antoine
More Details >
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104049
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]
Researcher
Morato Antoine
More Details >
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.4 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103685
Patch Status
Patched
Published
Oct 10, 2026
Affected Software
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce [woo-alidropship]
Researcher
Je22y
More Details >
All Bootstrap Blocks <= 1.3.31 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62036
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
All Bootstrap Blocks [all-bootstrap-blocks]
Researcher
Bao
More Details >
App for Cloudflare® <= 1.10.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39749
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
App for Cloudflare® [app-for-cf]
Researcher
takito
More Details >
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105197
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.9 - Authenticated (Custom Role+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105196
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Artus KG
More Details >
Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-91050
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Supakiad S. (m3ez)
More Details >
Asgaros Forum <= 3.4.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39779
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Asgaros Forum [asgaros-forum]
Researcher
buitu
More Details >
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104728
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI [automatorwp]
Researcher
Wordfence PRISM
More Details >
AutoPoly – AI Translation For Polylang <= 1.6.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107419
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
AutoPoly – AI Translation For Polylang [automatic-translations-for-polylang]
Researcher
myhappyhoon
More Details >
Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62028
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]
Researcher
Asim Alshaya
More Details >
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104390
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Booktics – Appointment Booking Calendar for Service Businesses [booktics]
Researcher
Oly Hossen
More Details >
Comment Cleaner 6.1 - 7.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107791
Patch Status
Patched
Published
Oct 10, 2026
Affected Software
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments [delete-all-comments-of-website]
Researcher
Thanh Hang
More Details >
CP Media Player <= 1.3.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104678
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
CP Media Player – Audio Player and Video Player [audio-and-video-player]
Researcher
Ryan Fabella
More Details >
Dashboard Notes <= 1.0.3 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62026
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Dashboard Notes [dashboard-notes]
Researcher
JunHee CHO
More Details >
Database Addon For WPForms ( wpforms entries ) – WPFormsDB < 1.1.1 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105260
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Database Addon For WPForms ( wpforms entries ) – WPFormsDB [database-for-wpforms]
Researcher
Rik de Kok
More Details >
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Settings Update
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62033
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Directory Listings WordPress plugin – uListing [ulisting]
Researcher
Jakub Herman
More Details >
Disable Users <= 1.0.5 - Disabled Account Authorization Bypass
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-88827
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Disable Users [disable-users]
Researcher
Naoki Kawahigashi
More Details >
Dokan <= 5.1.0 - Authenticated (Vendor+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107694
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]
Researcher
Karthik Ramakrishnan
More Details >
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103964
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Download Manager [download-manager]
Researcher
Sawyer
More Details >
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.7.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105194
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.16.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104079
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Paul Serban
More Details >
Envira Gallery <= 1.16.1 - Authenticated (Author+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104681
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Karthik Ramakrishnan
More Details >
Envira Gallery <= 1.16.1 - Authenticated (Author+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104684
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Envira Gallery <= 1.16.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104682
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Karthik Ramakrishnan
More Details >
Event Tickets and Registration <= 5.30.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104675
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Intrudify
More Details >
Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105891
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
dzeusking
More Details >
Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105888
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Erik Debye
More Details >
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-106611
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
HOMEVO Adonis Orfel
More Details >
Frontend Dashboard <= 2.0.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103681
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Frontend Dashboard [frontend-dashboard]
Researcher
Daniel Dhaniswara
More Details >
GDPR Data Request Form 1.5 - 1.7.1 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-85348
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
GDPR Data Request Form [gdpr-data-request-form]
Researcher
Shikhali Jamalzade
More Details >
Grocery Shopping Store <= 1.3.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-93949
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Grocery Shopping Store [grocery-shopping-store]
Researcher
Nguyen Dinh Hai (HaiND)
More Details >
Hotel Booking <= 3.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-84167
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Hotel Booking [nd-booking]
Researcher
Yaswanth Reddy Sunkara
More Details >
Hotel Booking <= 3.8 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-84166
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Hotel Booking [nd-booking]
Researcher
Yaswanth Reddy Sunkara
More Details >
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103075
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Dustin Lange
More Details >
Image Photo Gallery Final Tiles Grid < 3.6.14 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104645
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Ala Bouali
More Details >
Jetpack VideoPress <= 3.6 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-40808
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Jetpack VideoPress [jetpack-videopress]
Researcher
Ananda Dhakal
More Details >
JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103079
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
Rasyid Abdi Gantoro
More Details >
JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103078
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
KePulsary
More Details >
Memberful – Membership Plugin <= 1.81.2 - Authenticated (Contributor+) Protected Post Content Disclosure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104401
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Memberful – Membership Plugin [memberful-wp]
Researcher
sungbyeongchan
More Details >
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.9 - Authenticated (Subscriber+) Payment Bypass
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107434
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet [paid-membership]
Researcher
JunHee CHO
More Details >
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.19 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-108695
Patch Status
Unpatched
Published
Oct 10, 2026
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
George Chen
More Details >
Optimole 4.0.0 - 4.2.14 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-96530
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]
Researcher
Karthik Ramakrishnan
More Details >
Polylang <= 3.8.7 - Authenticated (Contributor+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39783
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Polylang [polylang]
Researcher
Ananda Dhakal
More Details >
Portfolio Filter Gallery <= 2.2.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105976
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Portfolio Filter Gallery – Photo Gallery [portfolio-filter-gallery]
Researcher
Artus KG
More Details >
Portfolio Filter Gallery 2.0.2 - 2.2.0 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105977
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Portfolio Filter Gallery – Photo Gallery [portfolio-filter-gallery]
Researcher
blast
More Details >
PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104407
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Intrudify
More Details >
Pubjet <= 5.4.8 - Missing Authorization to Authenticated (Subscriber+) Settings Update
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-40802
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Pubjet | پابجت [pubjet]
Researcher
Aydan Arabadzha
More Details >
QA Assistants – Driven by data <= 5.3.0.0 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105877
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
QA Assistants – Driven by data [qa-heatmap-analytics]
Researcher
Ananda Dhakal
More Details >
SendPress Newsletters <= 1.26.1.20 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-92989
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
SendPress Newsletters [sendpress]
Researcher
Enrico Marcolini
More Details >
Simple JWT Login – Allows you to use JWT on REST endpoints. 4.0.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39793
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Simple JWT Login – Allows you to use JWT on REST endpoints. [simple-jwt-login]
Researcher
Taylsec
More Details >
Simple User Registration <= 6.9 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-94235
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
MemberHero – Simple User Registration & Login [wp-registration]
Researcher
Yaswanth Reddy Sunkara
More Details >
Squadeno <= 1.11.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107507
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Squadeno – Club Sports Manager [squadeno-club-sports-manager]
Researcher
Doston Abdullayev
More Details >
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39721
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg [astra-sites]
Researcher
elaprendiz1927
More Details >
Th Shop Mania <= 1.9.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105883
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Th Shop Mania [th-shop-mania]
Researcher
Nguyen Dinh Hai (HaiND)
More Details >
Tutor LMS – eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Race Condition
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-42698
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
Ananda Dhakal
More Details >
Tutor LMS 4.0.5 - 4.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-85571
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
vuxvinh
More Details >
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets <= 4.5.5 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105886
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets [ultimate-post-kit]
Researcher
Intrudify
More Details >
Unlimited Elements for Elementor <= 2.0.22 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105064
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Ayukiab
More Details >
Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration <= 3.1.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62035
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration [upcasted-s3-offload]
Researcher
Dahmani Toumi
More Details >
User Private Files <= 2.1.8 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-97331
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
User Private Files – Secure File Sharing and Client Portal Plugin [user-private-files]
Researcher
Usama Arshad
More Details >
Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103335
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Video Conferencing with Zoom [video-conferencing-with-zoom-api]
Researcher
Ananda Dhakal
More Details >
VillaTheme Core <= 1.0.5 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103072
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
VillaTheme Core [villatheme-core]
Researcher
Erik Debye
More Details >
Visual Composer Website Builder <= 45.16.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-106596
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Visual Composer Website Builder [visualcomposer]
Researcher
Aarush Gaur
More Details >
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-94245
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Stefan Spasic
More Details >
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-94246
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Mytears
More Details >
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-94244
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Sanyam Jain
More Details >
Wise Chat <= 3.4.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39730
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Wise Chat [wise-chat]
Researcher
takito
More Details >
Wordable – Export Google Docs to WordPress <= 8.2.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-40801
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Wordable – Export Google Docs to WordPress [wordable]
Researcher
Aydan Arabadzha
More Details >
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API
4.3
CVSS Rating
4.3 (Medium)
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Anthropic
More Details >
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details
4.3
CVSS Rating
4.3 (Medium)
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Anthropic
More Details >
WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62142
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WP 2FA – Two-factor authentication for WordPress [wp-2fa]
Researcher
Filip Kowalski
More Details >
WP Admin Audit <= 1.2.17 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105062
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WP Admin Audit [wp-admin-audit]
Researcher
Nixxies
More Details >
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments <= 7.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105059
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments [delete-all-comments-of-website]
Researcher
mamgad
More Details >
WP Dummy Content Generator <= 4.0.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39763
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WP Dummy Content Generator [wp-dummy-content-generator]
Researcher
longnv719
More Details >
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62041
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce [wp-event-manager]
Researcher
Tai Ha (superx)
More Details >
WP Mailster <= 1.9.0.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105055
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WP Mailster [wp-mailster]
Researcher
Ratchanon Chamnankit
More Details >
WP Synchro – The Ultimate WordPress Migration Tool <= 1.16.1 - 2-Factor Authentication Bypass
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-41558
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WP Synchro – The Ultimate WordPress Migration Tool [wpsynchro]
Researcher
Ananda Dhakal
More Details >
WP-Invoice <= 4.3.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-97183
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WP-Invoice – Web Invoice and Billing [wp-invoice]
Researcher
Usama Arshad
More Details >
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-25433
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden [wp2leads]
Researcher
johska
More Details >
WPComplete <= 2.9.5.6 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-66479
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WPComplete [wpcomplete]
Researcher
Asim Alshaya
More Details >
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-102915
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]
Researcher
Michał Wiencek
More Details >
wpsection <= 1.5.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-40777
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
wpsection [wpsection]
Researcher
Suhayb Ahmed
More Details >
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress <= 9.1.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104386
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]
Researcher
Zac Lou
More Details >
Yaad Sarig Payment Gateway For WC <= 2.2.12 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104651
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Yaad Sarig Payment Gateway For WC [yaad-sarig-payment-gateway-for-wc]
Researcher
Ryan Fabella
More Details >
SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
3.7
CVSS Rating
3.7 (Low)
CVE-ID
CVE-2026-104006
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
SpeedyCache – Cache, Optimization, Performance [speedycache]
Researcher
Kuba
More Details >
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
3.3
CVSS Rating
3.3 (Low)
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Alex Concha
More Details >
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
3.1
CVSS Rating
3.1 (Low)
CVE-ID
CVE-2026-104741
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
AI Puffer – AI Chatbot & MCP Server for Claude and ChatGPT [gpt3-ai-content-generator]
Researcher
Wordfence PRISM
More Details >
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
3.1
CVSS Rating
3.1 (Low)
CVE-ID
CVE-2026-104742
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
AI Puffer – AI Chatbot & MCP Server for Claude and ChatGPT [gpt3-ai-content-generator]
Researcher
Wordfence PRISM
More Details >
Simple Membership <= 4.8.2 - Information Exposure
3.1
CVSS Rating
3.1 (Low)
CVE-ID
CVE-2026-88785
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Simple Membership [simple-membership]
Researcher
Rafael Honorato
More Details >
Booking Calendar 10.15 - 11.8.2 - Authenticated (Editor+) Information Exposure
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-105195
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Booking Calendar [booking]
Researcher
vuxvinh
More Details >
Code Snippets <= 3.9.0 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-106095
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Code Snippets [code-snippets]
Researcher
Mohammed Abd Alrahman
More Details >
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery 3.6.4 - 4.0.0 - Authenticated (Administrator+) Information Exposure
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-94258
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]
Researcher
Muni Nitish Kumar Yaddala
More Details >
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026) appeared first on Wordfence.
来源：Wordfence 官方博客 · https://www.wordfence.com/blog/2026/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-october-5-2026-to-october-11-2026/
部分链接为推广/关联链接。