BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: August 17 – August 24, 2026

112 WordPress vulnerabilities disclosed between August 17 – August 24, 2026. 13 critical, 34 high severity. 0 patched, 112 unpatched.

WPSentryAugust 24, 202626 min read

During the reporting period (August 17 – August 24, 2026), 112 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

112
Total
13
Critical
34
High
52
Medium
13
Low
0
Patched
Table of Contents 117 plugins & components

WordPress Plugin Vulnerabilities (112)

Forminator Forms

critical
Vulnerability
Forminator Forms — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=1.56.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TabaPay Gateway

critical
Vulnerability
TabaPay Gateway — Validate the payment callback before establishing a session for the account associated with the refe
Severity
critical Critical risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD

W3 Total Cache

critical
Vulnerability
W3 Total Cache — Properly validate the request path it uses to build cache file names
Severity
critical Critical risk
Affected Versions
<=2.10.5
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

critical
Vulnerability
TrueBooker — Have proper authorisation checks in some of its AJAX actions
Severity
critical Critical risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD

Broken Link Checker

critical
Vulnerability
Broken Link Checker — Limit which query variables it accepts from user input on sites using plain permalinks
Severity
critical Critical risk
Affected Versions
<=2.4.12
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker – Appointment Booking and Scheduler System

critical
Vulnerability
TrueBooker – Appointment Booking and Scheduler System — Authorization Bypass
Severity
critical Critical risk
Affected Versions
<=1.2.6
CVE Reference
Patch Status
No patch
Source
NVD

JSON Options

critical
Vulnerability
JSON Options — Have any capability check or nonce verification on one of its actions
Severity
critical Critical risk
Affected Versions
<=0.0.4
CVE Reference
Patch Status
No patch
Source
NVD

Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code

critical
Vulnerability
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=4.8.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Social Media Login

critical
Vulnerability
WP Social Media Login — Verify that a social login was actually completed with the identity provider before authenticating a
Severity
critical Critical risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Social Login & Sharing buttons with Analytics By SoClever

critical
Vulnerability
Social Login & Sharing buttons with Analytics By SoClever — Perform any authentication
Severity
critical Critical risk
Affected Versions
<=1.2.0
CVE Reference
Patch Status
No patch
Source
NVD

SmilePass Selfie Login

critical
Vulnerability
SmilePass Selfie Login — Perform any server-side verification of the identity it is asked to authenticate
Severity
critical Critical risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Mailgun for WordPress

critical
Vulnerability
Mailgun for WordPress — Server-Side Request Forgery (SSRF)
Severity
critical Critical risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WS Form LITE – Drag & Drop Contact Form Builder

critical
Vulnerability
WS Form LITE – Drag & Drop Contact Form Builder — PHP Object Injection
Severity
critical Critical risk
Affected Versions
<=1.10.80
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPAdverts – Classifieds Plugin

high
Vulnerability
WPAdverts – Classifieds Plugin — Authorization bypass
Severity
high High risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Quill Forms | Conversational Multi Step Forms, Surveys & quizzes

high
Vulnerability
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.7.1
CVE Reference
Patch Status
No patch
Source
NVD

HashBar – WordPress Notification Bar

high
Vulnerability
HashBar – WordPress Notification Bar — CVE-2026-66602
Severity
high High risk
Affected Versions
<=2.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback

high
Vulnerability
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=5.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced File Manager

high
Vulnerability
Advanced File Manager — Perform capability checks in several of its file management AJAX actions
Severity
high High risk
Affected Versions
<=5.4.13
CVE Reference
Patch Status
No patch
Source
NVD

Dinatur

high
Vulnerability
Dinatur — Sanitize and escape user input before using it in a SQL query
Severity
high High risk
Affected Versions
<=1.18
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

high
Vulnerability
Eventin — Properly verify ownership of events before
Severity
high High risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

high
Vulnerability
Eventin — Verify ownership or capability before deleting user accounts
Severity
high High risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Booking calendar, Appointment Booking System

high
Vulnerability
Booking calendar, Appointment Booking System — Properly sanitize uploaded SVG files
Severity
high High risk
Affected Versions
<=3.2.36
CVE Reference
Patch Status
No patch
Source
NVD

User Verification by PickPlugins

high
Vulnerability
User Verification by PickPlugins — Verify that a request to resend a verification email is authorized to act on the supplied user
Severity
high High risk
Affected Versions
<=2.0.47
CVE Reference
Patch Status
No patch
Source
NVD

NextScripts: Social Networks Auto-Poster

high
Vulnerability
NextScripts: Social Networks Auto-Poster — Escape some of the query-string parameters it reflects back on one of its admin pages
Severity
high High risk
Affected Versions
<=4.4.8
CVE Reference
Patch Status
No patch
Source
NVD

Simple File List

high
Vulnerability
Simple File List — Validate the source path of a file-move operation reachable by unauthenticated users
Severity
high High risk
Affected Versions
<=6.3.11
CVE Reference
Patch Status
No patch
Source
NVD

Simple File List

high
Vulnerability
Simple File List — Properly sanitise and escape a file's description before outputting it on the public file list
Severity
high High risk
Affected Versions
<=6.3.11
CVE Reference
Patch Status
No patch
Source
NVD

Product Shortlist

high
Vulnerability
Product Shortlist — Properly sanitise and escape a parameter before using it in a SQL statement
Severity
high High risk
Affected Versions
<=1.0.4
CVE Reference
Patch Status
No patch
Source
NVD

Animation Addons for Elementor

high
Vulnerability
Animation Addons for Elementor — Validate a user-supplied value before using it to build the host of a server-side HTTP request
Severity
high High risk
Affected Versions
<=2.7.2
CVE Reference
Patch Status
No patch
Source
NVD

ProSolution WP Client

high
Vulnerability
ProSolution WP Client — Sanitise and escape several parameters before reflecting them into HTML attributes on its public pag
Severity
high High risk
Affected Versions
<=2.0.11
CVE Reference
Patch Status
No patch
Source
NVD

ProSolution WP Client

high
Vulnerability
ProSolution WP Client — Sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administra
Severity
high High risk
Affected Versions
<=2.0.11
CVE Reference
Patch Status
No patch
Source
NVD

SAML Single Sign On

high
Vulnerability
SAML Single Sign On — Verify the signature of a SAML response before storing the certificate it carries
Severity
high High risk
Affected Versions
<=5.4.7
CVE Reference
Patch Status
No patch
Source
NVD

WP Statistics – Simple, privacy-friendly Google Analytics alternative

high
Vulnerability
WP Statistics – Simple, privacy-friendly Google Analytics alternative — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=14.16.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TranslatePress – Translate Multilingual sites with AI Translation

high
Vulnerability
TranslatePress – Translate Multilingual sites with AI Translation — Unauthenticated Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.2.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Depicter — Popup & Slider Builder

high
Vulnerability
Depicter — Popup & Slider Builder — Validate the type of a file uploaded through its import feature and does not remove a malformed uplo
Severity
high High risk
Affected Versions
<=4.8.0
CVE Reference
Patch Status
No patch
Source
NVD

Events Made Easy

high
Vulnerability
Events Made Easy — Local File Inclusion
Severity
high High risk
Affected Versions
<=3.2.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPForms Pro

high
Vulnerability
WPForms Pro — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.0.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

high
Vulnerability
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution — Correctly check user capabilities on some of its admin REST API routes
Severity
high High risk
Affected Versions
<=5.0.14
CVE Reference
Patch Status
No patch
Source
NVD

Drag and Drop Multiple File Upload for Contact Form 7

high
Vulnerability
Drag and Drop Multiple File Upload for Contact Form 7 — Validate the final name of an uploaded file after stripping characters from it
Severity
high High risk
Affected Versions
<=1.3.9.9
CVE Reference
Patch Status
No patch
Source
NVD

AI Engine

high
Vulnerability
AI Engine — Verify that the requesting user is authorized to act on the targeted account before performing privi
Severity
high High risk
Affected Versions
<=3.6.1
CVE Reference
Patch Status
No patch
Source
NVD

WPeMatico RSS Feed Fetcher

high
Vulnerability
WPeMatico RSS Feed Fetcher — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=2.8.24
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ManageWP Worker

high
Vulnerability
ManageWP Worker — Bind the account being logged in to the signature which authorises the login
Severity
high High risk
Affected Versions
<=4.9.37
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

high
Vulnerability
Forminator Forms — Restrict a network-wide setting to network administrators
Severity
high High risk
Affected Versions
<=1.57.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Slider Hero with Video Background, Animation

high
Vulnerability
Slider Hero with Video Background, Animation — Have authorisation and nonce checks on two of its request handlers
Severity
high High risk
Affected Versions
<=9.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Firebase Authentication

high
Vulnerability
Firebase Authentication — Require the email address in an authentication token to be verified before matching it to a WordPres
Severity
high High risk
Affected Versions
<=1.7.1
CVE Reference
Patch Status
No patch
Source
NVD

Advanced Product Fields (Product Addons) for WooCommerce

high
Vulnerability
Advanced Product Fields (Product Addons) for WooCommerce — Improper Input Validation
Severity
high High risk
Affected Versions
<=1.6.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PPWP – Password Protect Pages

high
Vulnerability
PPWP – Password Protect Pages — PHP Object Injection
Severity
high High risk
Affected Versions
<=1.9.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Security Hardener

high
Vulnerability
Security Hardener — Missing Authorization
Severity
high High risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PPWP: Password Protect Pages, Posts & Full or Partial Content

medium
Vulnerability
PPWP: Password Protect Pages, Posts & Full or Partial Content — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=1.9.15
CVE Reference
Patch Status
No patch
Source
NVD

Speed Optimizer – The All-In-One Performance-Boosting Plugin

medium
Vulnerability
Speed Optimizer – The All-In-One Performance-Boosting Plugin — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin

medium
Vulnerability
Eventin — Verify ownership before
Severity
medium Medium risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

WCFM Marketplace

medium
Vulnerability
WCFM Marketplace — Verify that a marketplace vendor owns a review before
Severity
medium Medium risk
Affected Versions
<=3.8.1
CVE Reference
Patch Status
No patch
Source
NVD

10Web Booster

medium
Vulnerability
10Web Booster — Correctly validate an access token on an unauthenticated request handler and does not escape attacke
Severity
medium Medium risk
Affected Versions
<=2.33.5
CVE Reference
Patch Status
No patch
Source
NVD

Easy Media Replace

medium
Vulnerability
Easy Media Replace — Sanitise and escape an attachment title before outputting it in an HTML attribute in the media libra
Severity
medium Medium risk
Affected Versions
<=0.2.0
CVE Reference
Patch Status
No patch
Source
NVD

YayCurrency

medium
Vulnerability
YayCurrency — Perform any capability or ownership check on several of its multi-vendor integration handlers that a
Severity
medium Medium risk
Affected Versions
<=3.3.5
CVE Reference
Patch Status
No patch
Source
NVD

SmartCrawl SEO checker, analyzer & optimizer

medium
Vulnerability
SmartCrawl SEO checker, analyzer & optimizer — Perform capability checks on two of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=3.16.3
CVE Reference
Patch Status
No patch
Source
NVD

JetEngine

medium
Vulnerability
JetEngine — CVE-2026-18202
Severity
medium Medium risk
Affected Versions
<=3.8.14
CVE Reference
Patch Status
No patch
Source
NVD

WP Directory Kit

medium
Vulnerability
WP Directory Kit — Perform any authorization check on one of its public AJAX actions and returns unfiltered database ro
Severity
medium Medium risk
Affected Versions
<=1.5.7
CVE Reference
Patch Status
No patch
Source
NVD

WP Maps

medium
Vulnerability
WP Maps — Perform a capability check
Severity
medium Medium risk
Affected Versions
<=4.9.8
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

medium
Vulnerability
TrueBooker — Have proper authorisation checks in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

medium
Vulnerability
TrueBooker — Have proper authorisation checks in some of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

medium
Vulnerability
TrueBooker — Have proper authorisation checks in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD

KiviCare

medium
Vulnerability
KiviCare — Verify that the requesting user owns the appointment being modified
Severity
medium Medium risk
Affected Versions
<=4.5.4
CVE Reference
Patch Status
No patch
Source
NVD

KiviCare

medium
Vulnerability
KiviCare — Verify that the requesting user is entitled to the media file being served
Severity
medium Medium risk
Affected Versions
<=4.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Membership For WooCommerce

medium
Vulnerability
Membership For WooCommerce — Check that an API consumer secret has actually been generated before comparing it against the one su
Severity
medium Medium risk
Affected Versions
<=3.1.2
CVE Reference
Patch Status
No patch
Source
NVD

WPS Bidouille

medium
Vulnerability
WPS Bidouille — Have proper authorisation checks in an AJAX action
Severity
medium Medium risk
Affected Versions
<=1.33.5
CVE Reference
Patch Status
No patch
Source
NVD

EWWW Image Optimizer

medium
Vulnerability
EWWW Image Optimizer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=8.7.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Royal Addons for Elementor

medium
Vulnerability
Royal Addons for Elementor — Correctly sanitise custom widget markup before writing it to a file that is later executed
Severity
medium Medium risk
Affected Versions
<=1.7.1066
CVE Reference
Patch Status
No patch
Source
NVD

AI Agent by SiteGround

medium
Vulnerability
AI Agent by SiteGround — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Admin and Site Enhancements (ASE)

medium
Vulnerability
Admin and Site Enhancements (ASE) — Sanitise uploaded SVG files on every route it accepts them through
Severity
medium Medium risk
Affected Versions
<=9.0.1
CVE Reference
Patch Status
No patch
Source
NVD

GutenKit

medium
Vulnerability
GutenKit — Sanitise uploaded SVG files on all of the upload paths it enables
Severity
medium Medium risk
Affected Versions
<=2.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Properly validate the files contained in archives uploaded by users with the Editor role
Severity
medium Medium risk
Affected Versions
<=6.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Welcart e-Commerce

medium
Vulnerability
Welcart e-Commerce — Regenerate the session identifier on authentication and sets the session identifier from a user-supp
Severity
medium Medium risk
Affected Versions
<=2.12.1
CVE Reference
Patch Status
No patch
Source
NVD

NewPath WildApricotPress Add-on

medium
Vulnerability
NewPath WildApricotPress Add-on — Enforce its members-only field privacy on an unauthenticated REST route
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Link Whisper Free

medium
Vulnerability
Link Whisper Free — Properly sanitize and escape a parameter before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=0.9.7
CVE Reference
Patch Status
No patch
Source
NVD

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

medium
Vulnerability
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution — Restrict access to per-vendor commission configuration returned by one of its unauthenticated store
Severity
medium Medium risk
Affected Versions
<=5.0.14
CVE Reference
Patch Status
No patch
Source
NVD

Media Library Assistant

medium
Vulnerability
Media Library Assistant — Validate a search parameter before concatenating it into a SQL query in one of its media-library que
Severity
medium Medium risk
Affected Versions
<=3.40
CVE Reference
Patch Status
No patch
Source
NVD

Tamara Checkout

medium
Vulnerability
Tamara Checkout — Verify the order key
Severity
medium Medium risk
Affected Versions
<=1.9.9.20
CVE Reference
Patch Status
No patch
Source
NVD

LitExtension

medium
Vulnerability
LitExtension — Verify a nonce before an administrative action that overwrites the store-migration connector's authe
Severity
medium Medium risk
Affected Versions
<=1.2.5
CVE Reference
Patch Status
No patch
Source
NVD

myCred

medium
Vulnerability
myCred — Verify that the receiver of an incoming payment gateway notification matches the site's configured m
Severity
medium Medium risk
Affected Versions
<=3.2.5
CVE Reference
Patch Status
No patch
Source
NVD

Charitable

medium
Vulnerability
Charitable — Verify the authenticity of incoming Square payment webhook events in a default configuration
Severity
medium Medium risk
Affected Versions
<=1.8.12
CVE Reference
Patch Status
No patch
Source
NVD

Passster

medium
Vulnerability
Passster — Correctly match its own public endpoint paths when deciding which REST API requests may bypass globa
Severity
medium Medium risk
Affected Versions
<=4.3.9
CVE Reference
Patch Status
No patch
Source
NVD

ProfilePress

medium
Vulnerability
ProfilePress — Strip shortcodes from two of its profile fields before rendering them on public pages
Severity
medium Medium risk
Affected Versions
<=4.17.1
CVE Reference
Patch Status
No patch
Source
NVD

Themify Builder

medium
Vulnerability
Themify Builder — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=7.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress

medium
Vulnerability
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=5.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress

medium
Vulnerability
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=5.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Grid, Slider & Carousel Ultimate

medium
Vulnerability
Post Grid, Slider & Carousel Ultimate — Sanitise and escape one of its custom post type settings before outputting it in an HTML attribute o
Severity
medium Medium risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD

FiboSearch

medium
Vulnerability
FiboSearch — Consistently exclude password-protected products from its unauthenticated AJAX endpoints
Severity
medium Medium risk
Affected Versions
<=1.34.1
CVE Reference
Patch Status
No patch
Source
NVD

Conekta Payment Gateway

medium
Vulnerability
Conekta Payment Gateway — Verify the authenticity of incoming payment gateway webhook notifications
Severity
medium Medium risk
Affected Versions
<=6.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

medium
Vulnerability
Tutor LMS — Validate a stored file path before using it to stream media
Severity
medium Medium risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

medium
Vulnerability
Forminator Forms — Consistently enforce the role restriction it applies to registration forms
Severity
medium Medium risk
Affected Versions
<=1.57.0.7
CVE Reference
Patch Status
No patch
Source
NVD

The kk Star Ratings – Rate Post & Collect User Feedbacks

medium
Vulnerability
The kk Star Ratings – Rate Post & Collect User Feedbacks — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.4.10.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Duplicator

medium
Vulnerability
Post Duplicator — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Duplicator

medium
Vulnerability
Post Duplicator — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=3.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Image Photo Gallery Final Tiles Grid

medium
Vulnerability
Image Photo Gallery Final Tiles Grid — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.6.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MC4WP: Mailchimp for WordPress

medium
Vulnerability
MC4WP: Mailchimp for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.12.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GreenShift – Animation and Page Builder Blocks

medium
Vulnerability
GreenShift – Animation and Page Builder Blocks — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=12.8.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels

medium
Vulnerability
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=4.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

RestrictMate

medium
Vulnerability
RestrictMate — Restrict the user role supplied during account registration
Severity
medium Medium risk
Affected Versions
<=1.3.0
CVE Reference
Patch Status
No patch
Source
NVD

WooCommerce Bookings

medium
Vulnerability
WooCommerce Bookings — Perform a capability check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=3.9.0
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

low
Vulnerability
Eventin — Verify the current user's permission to edit other users before assigning roles and updating user me
Severity
low Low risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Quiz and Survey Master (QSM)

low
Vulnerability
Quiz and Survey Master (QSM) — Perform a per-object ownership check before saving a quiz's front-end text settings
Severity
low Low risk
Affected Versions
<=11.2.4
CVE Reference
Patch Status
No patch
Source
NVD

Quiz and Survey Master (QSM)

low
Vulnerability
Quiz and Survey Master (QSM) — Perform a per-object ownership check on the REST routes that return a quiz's email-notification and
Severity
low Low risk
Affected Versions
<=11.2.4
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

low
Vulnerability
Easy Appointments — Restrict one of its appointment-listing REST endpoints to the records belonging to the requesting us
Severity
low Low risk
Affected Versions
<=4.0.1
CVE Reference
Patch Status
No patch
Source
NVD

GutenKit

low
Vulnerability
GutenKit — Have a sufficient capability check on some of its REST API endpoints
Severity
low Low risk
Affected Versions
<=2.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Drag and Drop Multiple File Upload for Contact Form 7

low
Vulnerability
Drag and Drop Multiple File Upload for Contact Form 7 — Escape one of its settings before using it as an HTML tag name in front-end output
Severity
low Low risk
Affected Versions
<=1.3.9.9
CVE Reference
Patch Status
No patch
Source
NVD

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

low
Vulnerability
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution — Validate a client-supplied payment amount against the vendor's actual outstanding balance when recor
Severity
low Low risk
Affected Versions
<=5.0.14
CVE Reference
Patch Status
No patch
Source
NVD

Duplicate Post

low
Vulnerability
Duplicate Post — Check that a user may read the content of a post before duplicating it
Severity
low Low risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD

Duplicate Post

low
Vulnerability
Duplicate Post — Check the user's capabilities before returning post data
Severity
low Low risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

low
Vulnerability
Eventin — Validate a user-supplied webhook URL stored on events nor verify event ownership
Severity
low Low risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Limit Login Attempts Reloaded

low
Vulnerability
Limit Login Attempts Reloaded — Compare logins against its username denylist case-insensitively and does not account for the account
Severity
low Low risk
Affected Versions
<=3.3.5
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

low
Vulnerability
Tutor LMS — Enforce per-object ownership checks on its course content type
Severity
low Low risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Content Mask

low
Vulnerability
Content Mask — Check the capability required to publish the post type being created
Severity
low Low risk
Affected Versions
<=1.8.5.5
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (0)

No vulnerabilities reported in this category this week.

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: August 25 – September 1, 2026

171 WordPress vulnerabilities disclosed between August 25 – September 1, 2026. 15 critical, 57 high severity. 0 patched, 171 unpatched.

WPSentry·Sep 1, 2026
Vulnerability Report

WordPress Vulnerability Report: August 24 – August 31, 2026

171 WordPress vulnerabilities disclosed between August 24 – August 31, 2026. 15 critical, 50 high severity. 0 patched, 171 unpatched.

WPSentry·Aug 31, 2026
Vulnerability Report

WordPress Vulnerability Report: August 23 – August 30, 2026

170 WordPress vulnerabilities disclosed between August 23 – August 30, 2026. 15 critical, 50 high severity. 0 patched, 170 unpatched.

WPSentry·Aug 30, 2026
Back to Blog