BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: August 12 – August 19, 2026

174 WordPress vulnerabilities disclosed between August 12 – August 19, 2026. 18 critical, 37 high severity. 1 patched, 173 unpatched.

WPSentryAugust 19, 202639 min read

During the reporting period (August 12 – August 19, 2026), 174 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

174
Total
18
Critical
37
High
117
Medium
2
Low
1
Patched
Table of Contents 179 plugins & components

WordPress Plugin Vulnerabilities (172)

Customer Email Verification for WooCommerce

critical
Vulnerability
Customer Email Verification for WooCommerce — Correctly validate the email-verification activation code
Severity
critical Critical risk
Affected Versions
<=3.2.6
CVE Reference
Patch Status
No patch
Source
NVD

Link Factory

critical
Vulnerability
Link Factory — CVE-2026-15413
Severity
critical Critical risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Wishlist Member

critical
Vulnerability
Wishlist Member — Account Takeover
Severity
critical Critical risk
Affected Versions
<=3.34.1
CVE Reference
Patch Status
No patch
Source
NVD

RapiSafe – Secure Multi File Upload for Contact Form 7

critical
Vulnerability
RapiSafe – Secure Multi File Upload for Contact Form 7 — Arbitrary file deletion
Severity
critical Critical risk
Affected Versions
<=1.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

6Storage Rentals

critical
Vulnerability
6Storage Rentals — Authentication bypass
Severity
critical Critical risk
Affected Versions
<=2.27.0
CVE Reference
Patch Status
No patch
Source
NVD

User Session Synchronizer

critical
Vulnerability
User Session Synchronizer — Authentication Bypass leading to Account Takeover
Severity
critical Critical risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Profile Builder

critical
Vulnerability
User Profile Builder — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=3.16.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TrueBooker

critical
Vulnerability
TrueBooker — Account Takeover
Severity
critical Critical risk
Affected Versions
<=1.2.6
CVE Reference
Patch Status
No patch
Source
NVD

Pods – Custom Content Types and Fields

critical
Vulnerability
Pods – Custom Content Types and Fields — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=3.3.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Link Library

critical
Vulnerability
Link Library — Arbitrary file deletion
Severity
critical Critical risk
Affected Versions
<=7.9.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ProSolution WP Client

critical
Vulnerability
ProSolution WP Client — Arbitrary file deletion
Severity
critical Critical risk
Affected Versions
<=2.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ProSolution WP Client

critical
Vulnerability
ProSolution WP Client — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=2.0.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Frontend Admin by DynamiApps

critical
Vulnerability
Frontend Admin by DynamiApps — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=3.29.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Solace Extra

critical
Vulnerability
Solace Extra — Unauthorized modification and loss of data
Severity
critical Critical risk
Affected Versions
<=1.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Simple JWT Login

critical
Vulnerability
Simple JWT Login — Validate the audience of the Google identity tokens it accepts
Severity
critical Critical risk
Affected Versions
<=3.6.8
CVE Reference
Patch Status
No patch
Source
NVD

WPvivid — Backup, Migration & Staging

critical
Vulnerability
WPvivid — Backup, Migration & Staging — Sanitise a value taken from an unauthenticated request before using it to build a log file path
Severity
critical Critical risk
Affected Versions
<=0.9.131
CVE Reference
Patch Status
No patch
Source
NVD

Contact Form, Survey, Quiz & Popup Form Builder – ARForms

critical
Vulnerability
Contact Form, Survey, Quiz & Popup Form Builder – ARForms — PHP Object Injection
Severity
critical Critical risk
Affected Versions
<=1.8.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Forminator Forms

critical
Vulnerability
Forminator Forms — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=1.56.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

KiviCare

high
Vulnerability
KiviCare — Restrict the roles assignable through its unauthenticated registration endpoint
Severity
high High risk
Affected Versions
<=4.5.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Helper Premium

high
Vulnerability
WP Helper Premium — Verify the order key when rendering its custom order confirmation page or when handling the related
Severity
high High risk
Affected Versions
<=4.7.6
CVE Reference
Patch Status
No patch
Source
NVD

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

high
Vulnerability
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

W3 Total Cache

high
Vulnerability
W3 Total Cache — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Paymob for WooCommerce

high
Vulnerability
Paymob for WooCommerce — Properly sanitise a client-supplied identifier before using it in a SQL query within its public
Severity
high High risk
Affected Versions
<=4.1.9
CVE Reference
Patch Status
No patch
Source
NVD

Essential Addons for Elementor

high
Vulnerability
Essential Addons for Elementor — Prevent user-supplied registration fields from overwriting reserved account attributes
Severity
high High risk
Affected Versions
<=6.7.2
CVE Reference
Patch Status
No patch
Source
NVD

WP-Stats

high
Vulnerability
WP-Stats — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.56
CVE Reference
Patch Status
No patch
Source
NVD

Online Booking & Scheduling Calendar for WordPress by vcita

high
Vulnerability
Online Booking & Scheduling Calendar for WordPress by vcita — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

bLoyal: Loyalty & Promotions by bLoyal

high
Vulnerability
bLoyal: Loyalty & Promotions by bLoyal — Privilege Escalation
Severity
high High risk
Affected Versions
<=3.1.611.78
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Propovoice: All-in-One Client Management System

high
Vulnerability
Propovoice: All-in-One Client Management System — Privilege Escalation
Severity
high High risk
Affected Versions
<=1.7.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MaxUpload – Big File Uploads – Increase Maximum File Upload Size

high
Vulnerability
MaxUpload – Big File Uploads – Increase Maximum File Upload Size — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent

high
Vulnerability
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.3.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms

high
Vulnerability
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Product Feed PRO for WooCommerce by AdTribes

high
Vulnerability
Product Feed PRO for WooCommerce by AdTribes — Perform an authorization check on one of its REST read routes
Severity
high High risk
Affected Versions
<=13.5.7
CVE Reference
Patch Status
No patch
Source
NVD

Wholesale Market

high
Vulnerability
Wholesale Market — Privilege escalation
Severity
high High risk
Affected Versions
<=2.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Real Estate Manager Pro

high
Vulnerability
Real Estate Manager Pro — Privilege Escalation
Severity
high High risk
Affected Versions
<=12.8.6
CVE Reference
Patch Status
No patch
Source
NVD

Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!

high
Vulnerability
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! — Remote Code Execution
Severity
high High risk
Affected Versions
<=3.7.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Query Wrangler

high
Vulnerability
Query Wrangler — Remote Code Execution
Severity
high High risk
Affected Versions
<=1.5.57
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Platnosci Online Blue Media (Autopay)

high
Vulnerability
Platnosci Online Blue Media (Autopay) — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Podlove Podcast Publisher

high
Vulnerability
Podlove Podcast Publisher — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=4.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Royal Elementor Addons

high
Vulnerability
Royal Elementor Addons — Server-Side Request Forgery
Severity
high High risk
Affected Versions
<=1.7.1064
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

All-in-One WP Migration and Backup

high
Vulnerability
All-in-One WP Migration and Backup — Restrict its migration import functionality to network administrators on multisite installations
Severity
high High risk
Affected Versions
<=7.108
CVE Reference
Patch Status
No patch
Source
NVD

WCPOS – Point of Sale (POS) plugin for WooCommerce

high
Vulnerability
WCPOS – Point of Sale (POS) plugin for WooCommerce — Code Injection
Severity
high High risk
Affected Versions
<=1.9.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Directory Kit

high
Vulnerability
WP Directory Kit — Sanitise and escape a parameter before using it in a SQL statement
Severity
high High risk
Affected Versions
<=1.5.7
CVE Reference
Patch Status
No patch
Source
NVD

CatFolders Document Gallery & PDF Library

high
Vulnerability
CatFolders Document Gallery & PDF Library — Have authorisation checks in some of its REST API endpoints
Severity
high High risk
Affected Versions
<=2.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Extra Product Options Builder for WooCommerce

high
Vulnerability
Extra Product Options Builder for WooCommerce — Verify that the requester is entitled to a customer-uploaded file before serving it
Severity
high High risk
Affected Versions
<=1.2.176
CVE Reference
Patch Status
No patch
Source
NVD

Infility Global

high
Vulnerability
Infility Global — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.15.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Online Scheduling and Appointment Booking System – Bookly

high
Vulnerability
Online Scheduling and Appointment Booking System – Bookly — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=27.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Travel Engine – Tour Booking Plugin – Tour Operator Software

high
Vulnerability
WP Travel Engine – Tour Booking Plugin – Tour Operator Software — Authorization bypass
Severity
high High risk
Affected Versions
<=6.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gallery by BestWebSoft

high
Vulnerability
Gallery by BestWebSoft — SQL Injection
Severity
high High risk
Affected Versions
<=4.7.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPAdverts – Classifieds Plugin

high
Vulnerability
WPAdverts – Classifieds Plugin — Authorization bypass
Severity
high High risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Quill Forms | Conversational Multi Step Forms, Surveys & quizzes

high
Vulnerability
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.7.1
CVE Reference
Patch Status
No patch
Source
NVD

HashBar – WordPress Notification Bar

high
Vulnerability
HashBar – WordPress Notification Bar — CVE-2026-66602
Severity
high High risk
Affected Versions
<=2.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback

high
Vulnerability
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=5.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Statistics – Simple, privacy-friendly Google Analytics alternative

high
Vulnerability
WP Statistics – Simple, privacy-friendly Google Analytics alternative — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=14.16.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TranslatePress – Translate Multilingual sites with AI Translation

high
Vulnerability
TranslatePress – Translate Multilingual sites with AI Translation — Unauthenticated Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.2.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

medium
Vulnerability
Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure
Severity
medium Medium risk
Affected Versions
<=4.1.18
CVE Reference
Patch Status
4.1.19
Source
Wordfence
Plugin Page

Wallet System for WooCommerce

medium
Vulnerability
Wallet System for WooCommerce — Validate a user-supplied wallet amount against the customer's actual stored balance during checkout
Severity
medium Medium risk
Affected Versions
<=2.7.10
CVE Reference
Patch Status
No patch
Source
NVD

Welcart e-Commerce

medium
Vulnerability
Welcart e-Commerce — Verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthentic
Severity
medium Medium risk
Affected Versions
<=2.11.33
CVE Reference
Patch Status
No patch
Source
NVD

Payment Gateway for PayPal on WooCommerce

medium
Vulnerability
Payment Gateway for PayPal on WooCommerce — Verify that payment actually succeeded before completing an order in its PayPal return handler: it r
Severity
medium Medium risk
Affected Versions
<=9.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Properly authorise its front-end form submission REST routes and passes attacker-controlled input th
Severity
medium Medium risk
Affected Versions
<=6.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Payment Button for PayPal

medium
Vulnerability
Payment Button for PayPal — Enforce the merchant-configured price server-side and trusts a client-supplied payment amount
Severity
medium Medium risk
Affected Versions
<=1.2.3.44
CVE Reference
Patch Status
No patch
Source
NVD

Quick Paypal Payments

medium
Vulnerability
Quick Paypal Payments — Verify the paid amount
Severity
medium Medium risk
Affected Versions
<=5.7.50
CVE Reference
Patch Status
No patch
Source
NVD

Draft List is a

medium
Vulnerability
Draft List is a — Stored Cross-Site Scripting (XSS)
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Food Menu

medium
Vulnerability
Food Menu — Perform any capability or ownership check on its reservation-status update action
Severity
medium Medium risk
Affected Versions
<=6.0.2
CVE Reference
Patch Status
No patch
Source
NVD

ShopEngine Elementor WooCommerce Builder Addon

medium
Vulnerability
ShopEngine Elementor WooCommerce Builder Addon — Protect one of its authentication endpoints against CSRF
Severity
medium Medium risk
Affected Versions
<=4.9.3
CVE Reference
Patch Status
No patch
Source
NVD

Prevent Direct Access – Protect WordPress Files

medium
Vulnerability
Prevent Direct Access – Protect WordPress Files — Unauthorized access of protected files
Severity
medium Medium risk
Affected Versions
<=2.8.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PPWP – Password Protect Pages

medium
Vulnerability
PPWP – Password Protect Pages — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.9.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ecwid by Lightspeed Ecommerce Shopping Cart

medium
Vulnerability
Ecwid by Lightspeed Ecommerce Shopping Cart — Perform a capability check or nonce verification on one of its store-management actions
Severity
medium Medium risk
Affected Versions
<=7.0.9
CVE Reference
Patch Status
No patch
Source
NVD

Astro Booking Engine

medium
Vulnerability
Astro Booking Engine — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display

medium
Vulnerability
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Embed Google Photos album

medium
Vulnerability
Embed Google Photos album — Escape a shortcode attribute value before outputting it inside an HTML attribute
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Epeken All Kurir for Woocommerce

medium
Vulnerability
Epeken All Kurir for Woocommerce — Verify that a payment-confirmation request originates from the owner of the targeted order
Severity
medium Medium risk
Affected Versions
<=2.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder

medium
Vulnerability
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Pinpoint Booking System – Version 2

medium
Vulnerability
Pinpoint Booking System – Version 2 — Price Manipulation
Severity
medium Medium risk
Affected Versions
<=2.9.9.6.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Image Uploader for Welcart

medium
Vulnerability
Image Uploader for Welcart — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booking calendar, Appointment Booking System

medium
Vulnerability
Booking calendar, Appointment Booking System — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.2.36
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

KiviCare – Clinic & Patient Management System (EHR)

medium
Vulnerability
KiviCare – Clinic & Patient Management System (EHR) — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Hydra Booking — Appointment Scheduling & Booking Calendar

medium
Vulnerability
Hydra Booking — Appointment Scheduling & Booking Calendar — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

medium
Vulnerability
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder — Blind SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.15.44
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms

medium
Vulnerability
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms

medium
Vulnerability
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

medium
Vulnerability
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe — Second-Order SQL Injection
Severity
medium Medium risk
Affected Versions
<=30.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Beaver Builder Page Builder – Drag and Drop Website Builder

medium
Vulnerability
Beaver Builder Page Builder – Drag and Drop Website Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.10.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Groundhogg — CRM, Newsletters, and Marketing Automation

medium
Vulnerability
Groundhogg — CRM, Newsletters, and Marketing Automation — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.5.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ECS

medium
Vulnerability
ECS — Check the post status or any capability when rendering an Elementor document requested through one o
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

ECS

medium
Vulnerability
ECS — Perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

Simply Schedule Appointments

medium
Vulnerability
Simply Schedule Appointments — Restrict the user records returned by some of its REST endpoints to those the requester is entitled
Severity
medium Medium risk
Affected Versions
<=1.6.12.17
CVE Reference
Patch Status
No patch
Source
NVD

Backup Migration

medium
Vulnerability
Backup Migration — Properly restrict a post-restore automatic login mechanism
Severity
medium Medium risk
Affected Versions
<=2.1.7
CVE Reference
Patch Status
No patch
Source
NVD

ECS

medium
Vulnerability
ECS — Have capability or ownership checks on its dynamic repeater actions
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

WPML Multilingual CMS

medium
Vulnerability
WPML Multilingual CMS — SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.9.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Admin Custom Login

medium
Vulnerability
Admin Custom Login — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.6.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin

medium
Vulnerability
PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=1.9.20
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

medium
Vulnerability
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=11.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gravity Booster – Styles & Layouts for Gravity Forms

medium
Vulnerability
Gravity Booster – Styles & Layouts for Gravity Forms — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.26
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bookly

medium
Vulnerability
Bookly — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=27.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

medium
Vulnerability
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.5.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

medium
Vulnerability
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=1.6.12.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution

medium
Vulnerability
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.4.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Loco Translate

medium
Vulnerability
Loco Translate — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.8.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WC Product Table Lite

medium
Vulnerability
WC Product Table Lite — CSS Injection
Severity
medium Medium risk
Affected Versions
<=5.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

NEX-Forms – Ultimate Forms

medium
Vulnerability
NEX-Forms – Ultimate Forms — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=9.2.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Serious Slider

medium
Vulnerability
Serious Slider — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

medium
Vulnerability
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=11.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fullscreen Galleria

medium
Vulnerability
Fullscreen Galleria — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.6.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kubio AI Page Builder

medium
Vulnerability
Kubio AI Page Builder — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.8.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

medium
Vulnerability
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=4.16.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Turnkey bbPress by WeaverTheme

medium
Vulnerability
Turnkey bbPress by WeaverTheme — PHP Object Injection
Severity
medium Medium risk
Affected Versions
<=1.7.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More

medium
Vulnerability
StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=2.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization

medium
Vulnerability
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.11.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors

medium
Vulnerability
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.7.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Manual Image Crop

medium
Vulnerability
Manual Image Crop — Perform any capability check or nonce verification on the authenticated AJAX action that crops attac
Severity
medium Medium risk
Affected Versions
<=1.15
CVE Reference
Patch Status
No patch
Source
NVD

Toocheke Companion

medium
Vulnerability
Toocheke Companion — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Youtube Showcase

medium
Vulnerability
Youtube Showcase — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Snippet Shortcodes

medium
Vulnerability
Snippet Shortcodes — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Smash Balloon Social Post Feed – Simple Social Feeds for WordPress

medium
Vulnerability
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.9.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Slider Hero

medium
Vulnerability
Slider Hero — Second-order SQL Injection
Severity
medium Medium risk
Affected Versions
<=9.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SureDash – Community, Courses & Member Dashboard

medium
Vulnerability
SureDash – Community, Courses & Member Dashboard — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.10.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ECS

medium
Vulnerability
ECS — Perform ownership or post-status checks when one of its dynamic repeater data sources reads custom f
Severity
medium Medium risk
Affected Versions
<=4.3.10
CVE Reference
Patch Status
No patch
Source
NVD

Premium Packages

medium
Vulnerability
Premium Packages — Validate a withdrawal request against the requesting user's actual earned balance
Severity
medium Medium risk
Affected Versions
<=7.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Masteriyo LMS

medium
Vulnerability
Masteriyo LMS — Sanitise and escape a quiz field before outputting it back in a page
Severity
medium Medium risk
Affected Versions
<=2.3.3
CVE Reference
Patch Status
No patch
Source
NVD

Visualizer

medium
Vulnerability
Visualizer — Properly authorise access to the configuration of its charts
Severity
medium Medium risk
Affected Versions
<=4.0.7
CVE Reference
Patch Status
No patch
Source
NVD

User Login History

medium
Vulnerability
User Login History — SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The School Management – Education & Learning ERP

medium
Vulnerability
The School Management – Education & Learning ERP — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

medium
Vulnerability
Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=1.55.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kirki – Freeform Page Builder, Website Builder & Customizer

medium
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=6.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Compress – Instant Performance & Speed Optimization

medium
Vulnerability
WP Compress – Instant Performance & Speed Optimization — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=7.10.09
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kirki – Freeform Page Builder, Website Builder & Customizer

medium
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=6.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.6.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WooMS

medium
Vulnerability
WooMS — Validate a user-supplied URL before using it in a server-side request and attaches stored third-part
Severity
medium Medium risk
Affected Versions
<=9.14
CVE Reference
Patch Status
No patch
Source
NVD

ShopSmart Loyalty for WooCommerce

medium
Vulnerability
ShopSmart Loyalty for WooCommerce — Perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated use
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

PPWP: Password Protect Pages, Posts & Full or Partial Content

medium
Vulnerability
PPWP: Password Protect Pages, Posts & Full or Partial Content — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=1.9.15
CVE Reference
Patch Status
No patch
Source
NVD

Speed Optimizer – The All-In-One Performance-Boosting Plugin

medium
Vulnerability
Speed Optimizer – The All-In-One Performance-Boosting Plugin — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced File Manager

medium
Vulnerability
Advanced File Manager — Perform capability checks in several of its file management AJAX actions
Severity
medium Medium risk
Affected Versions
<=5.4.13
CVE Reference
Patch Status
No patch
Source
NVD

Dinatur

medium
Vulnerability
Dinatur — Sanitize and escape user input before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=1.18
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Properly verify ownership of events before
Severity
medium Medium risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Verify the current user's permission to edit other users before assigning roles and updating user me
Severity
medium Medium risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Verify ownership or capability before deleting user accounts
Severity
medium Medium risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Verify ownership before
Severity
medium Medium risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

WCFM Marketplace

medium
Vulnerability
WCFM Marketplace — Verify that a marketplace vendor owns a review before
Severity
medium Medium risk
Affected Versions
<=3.8.1
CVE Reference
Patch Status
No patch
Source
NVD

10Web Booster

medium
Vulnerability
10Web Booster — Correctly validate an access token on an unauthenticated request handler and does not escape attacke
Severity
medium Medium risk
Affected Versions
<=2.33.5
CVE Reference
Patch Status
No patch
Source
NVD

Booking calendar, Appointment Booking System

medium
Vulnerability
Booking calendar, Appointment Booking System — Properly sanitize uploaded SVG files
Severity
medium Medium risk
Affected Versions
<=3.2.36
CVE Reference
Patch Status
No patch
Source
NVD

Quiz and Survey Master (QSM)

medium
Vulnerability
Quiz and Survey Master (QSM) — Perform a per-object ownership check before saving a quiz's front-end text settings
Severity
medium Medium risk
Affected Versions
<=11.2.4
CVE Reference
Patch Status
No patch
Source
NVD

Quiz and Survey Master (QSM)

medium
Vulnerability
Quiz and Survey Master (QSM) — Perform a per-object ownership check on the REST routes that return a quiz's email-notification and
Severity
medium Medium risk
Affected Versions
<=11.2.4
CVE Reference
Patch Status
No patch
Source
NVD

User Verification by PickPlugins

medium
Vulnerability
User Verification by PickPlugins — Verify that a request to resend a verification email is authorized to act on the supplied user
Severity
medium Medium risk
Affected Versions
<=2.0.47
CVE Reference
Patch Status
No patch
Source
NVD

Easy Media Replace

medium
Vulnerability
Easy Media Replace — Sanitise and escape an attachment title before outputting it in an HTML attribute in the media libra
Severity
medium Medium risk
Affected Versions
<=0.2.0
CVE Reference
Patch Status
No patch
Source
NVD

YayCurrency

medium
Vulnerability
YayCurrency — Perform any capability or ownership check on several of its multi-vendor integration handlers that a
Severity
medium Medium risk
Affected Versions
<=3.3.5
CVE Reference
Patch Status
No patch
Source
NVD

NextScripts: Social Networks Auto-Poster

medium
Vulnerability
NextScripts: Social Networks Auto-Poster — Escape some of the query-string parameters it reflects back on one of its admin pages
Severity
medium Medium risk
Affected Versions
<=4.4.8
CVE Reference
Patch Status
No patch
Source
NVD

Simple File List

medium
Vulnerability
Simple File List — Validate the source path of a file-move operation reachable by unauthenticated users
Severity
medium Medium risk
Affected Versions
<=6.3.11
CVE Reference
Patch Status
No patch
Source
NVD

Simple File List

medium
Vulnerability
Simple File List — Properly sanitise and escape a file's description before outputting it on the public file list
Severity
medium Medium risk
Affected Versions
<=6.3.11
CVE Reference
Patch Status
No patch
Source
NVD

Product Shortlist

medium
Vulnerability
Product Shortlist — Properly sanitise and escape a parameter before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=1.0.4
CVE Reference
Patch Status
No patch
Source
NVD

SmartCrawl SEO checker, analyzer & optimizer

medium
Vulnerability
SmartCrawl SEO checker, analyzer & optimizer — Perform capability checks on two of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=3.16.3
CVE Reference
Patch Status
No patch
Source
NVD

Animation Addons for Elementor

medium
Vulnerability
Animation Addons for Elementor — Validate a user-supplied value before using it to build the host of a server-side HTTP request
Severity
medium Medium risk
Affected Versions
<=2.7.2
CVE Reference
Patch Status
No patch
Source
NVD

TabaPay Gateway

medium
Vulnerability
TabaPay Gateway — Validate the payment callback before establishing a session for the account associated with the refe
Severity
medium Medium risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD

W3 Total Cache

medium
Vulnerability
W3 Total Cache — Properly validate the request path it uses to build cache file names
Severity
medium Medium risk
Affected Versions
<=2.10.5
CVE Reference
Patch Status
No patch
Source
NVD

JetEngine

medium
Vulnerability
JetEngine — CVE-2026-18202
Severity
medium Medium risk
Affected Versions
<=3.8.14
CVE Reference
Patch Status
No patch
Source
NVD

WP Directory Kit

medium
Vulnerability
WP Directory Kit — Perform any authorization check on one of its public AJAX actions and returns unfiltered database ro
Severity
medium Medium risk
Affected Versions
<=1.5.7
CVE Reference
Patch Status
No patch
Source
NVD

WP Maps

medium
Vulnerability
WP Maps — Perform a capability check
Severity
medium Medium risk
Affected Versions
<=4.9.8
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

medium
Vulnerability
TrueBooker — Have proper authorisation checks in some of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

medium
Vulnerability
TrueBooker — Have proper authorisation checks in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

medium
Vulnerability
TrueBooker — Have proper authorisation checks in some of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

medium
Vulnerability
TrueBooker — Have proper authorisation checks in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD

Broken Link Checker

medium
Vulnerability
Broken Link Checker — Limit which query variables it accepts from user input on sites using plain permalinks
Severity
medium Medium risk
Affected Versions
<=2.4.12
CVE Reference
Patch Status
No patch
Source
NVD

ProSolution WP Client

medium
Vulnerability
ProSolution WP Client — Sanitise and escape several parameters before reflecting them into HTML attributes on its public pag
Severity
medium Medium risk
Affected Versions
<=2.0.11
CVE Reference
Patch Status
No patch
Source
NVD

ProSolution WP Client

medium
Vulnerability
ProSolution WP Client — Sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administra
Severity
medium Medium risk
Affected Versions
<=2.0.11
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

medium
Vulnerability
Easy Appointments — Restrict one of its appointment-listing REST endpoints to the records belonging to the requesting us
Severity
medium Medium risk
Affected Versions
<=4.0.1
CVE Reference
Patch Status
No patch
Source
NVD

KiviCare

medium
Vulnerability
KiviCare — Verify that the requesting user owns the appointment being modified
Severity
medium Medium risk
Affected Versions
<=4.5.4
CVE Reference
Patch Status
No patch
Source
NVD

KiviCare

medium
Vulnerability
KiviCare — Verify that the requesting user is entitled to the media file being served
Severity
medium Medium risk
Affected Versions
<=4.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Membership For WooCommerce

medium
Vulnerability
Membership For WooCommerce — Check that an API consumer secret has actually been generated before comparing it against the one su
Severity
medium Medium risk
Affected Versions
<=3.1.2
CVE Reference
Patch Status
No patch
Source
NVD

WPS Bidouille

medium
Vulnerability
WPS Bidouille — Have proper authorisation checks in an AJAX action
Severity
medium Medium risk
Affected Versions
<=1.33.5
CVE Reference
Patch Status
No patch
Source
NVD

SAML Single Sign On

medium
Vulnerability
SAML Single Sign On — Verify the signature of a SAML response before storing the certificate it carries
Severity
medium Medium risk
Affected Versions
<=5.4.7
CVE Reference
Patch Status
No patch
Source
NVD

EWWW Image Optimizer

medium
Vulnerability
EWWW Image Optimizer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=8.7.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Estatik Real Estate Plugin

low
Vulnerability
Estatik Real Estate Plugin — Validate the same recipient list that it later uses to address the message sent by its property requ
Severity
low Low risk
Affected Versions
<=4.3.4
CVE Reference
Patch Status
No patch
Source
NVD

Booking for Appointments and Events Calendar

low
Vulnerability
Booking for Appointments and Events Calendar — Verify that an authenticated employee (provider) is assigned to the appointment being accessed
Severity
low Low risk
Affected Versions
<=2.4.6
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (2)

Samex - Clean, Minimal Shop WooCommerce

high
Vulnerability
Samex - Clean, Minimal Shop WooCommerce — CVE-2026-28154
Severity
high High risk
Affected Versions
<=2.5
CVE Reference
Patch Status
No patch
Source
NVD

Divi

medium
Vulnerability
Divi — Properly escape some of its Social Media Follow module settings before outputting them in link attri
Severity
medium Medium risk
Affected Versions
<=5.9.0
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: August 25 – September 1, 2026

171 WordPress vulnerabilities disclosed between August 25 – September 1, 2026. 15 critical, 57 high severity. 0 patched, 171 unpatched.

WPSentry·Sep 1, 2026
Vulnerability Report

WordPress Vulnerability Report: August 24 – August 31, 2026

171 WordPress vulnerabilities disclosed between August 24 – August 31, 2026. 15 critical, 50 high severity. 0 patched, 171 unpatched.

WPSentry·Aug 31, 2026
Vulnerability Report

WordPress Vulnerability Report: August 23 – August 30, 2026

170 WordPress vulnerabilities disclosed between August 23 – August 30, 2026. 15 critical, 50 high severity. 0 patched, 170 unpatched.

WPSentry·Aug 30, 2026
Back to Blog