BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: August 19 – August 26, 2026

105 WordPress vulnerabilities disclosed between August 19 – August 26, 2026. 11 critical, 27 high severity. 0 patched, 105 unpatched.

WPSentryAugust 26, 202626 min read

During the reporting period (August 19 – August 26, 2026), 105 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

105
Total
11
Critical
27
High
58
Medium
9
Low
0
Patched
Table of Contents 110 plugins & components

WordPress Plugin Vulnerabilities (102)

TrueBooker – Appointment Booking and Scheduler System

critical
Vulnerability
TrueBooker – Appointment Booking and Scheduler System — Authorization Bypass
Severity
critical Critical risk
Affected Versions
<=1.2.6
CVE Reference
Patch Status
No patch
Source
NVD

JSON Options

critical
Vulnerability
JSON Options — Have any capability check or nonce verification on one of its actions
Severity
critical Critical risk
Affected Versions
<=0.0.4
CVE Reference
Patch Status
No patch
Source
NVD

Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code

critical
Vulnerability
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=4.8.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Social Media Login

critical
Vulnerability
WP Social Media Login — Verify that a social login was actually completed with the identity provider before authenticating a
Severity
critical Critical risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Social Login & Sharing buttons with Analytics By SoClever

critical
Vulnerability
Social Login & Sharing buttons with Analytics By SoClever — Perform any authentication
Severity
critical Critical risk
Affected Versions
<=1.2.0
CVE Reference
Patch Status
No patch
Source
NVD

SmilePass Selfie Login

critical
Vulnerability
SmilePass Selfie Login — Perform any server-side verification of the identity it is asked to authenticate
Severity
critical Critical risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Mailgun for WordPress

critical
Vulnerability
Mailgun for WordPress — Server-Side Request Forgery (SSRF)
Severity
critical Critical risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WS Form LITE – Drag & Drop Contact Form Builder

critical
Vulnerability
WS Form LITE – Drag & Drop Contact Form Builder — PHP Object Injection
Severity
critical Critical risk
Affected Versions
<=1.10.80
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Total Donations

critical
Vulnerability
Total Donations — SQL Injection
Severity
critical Critical risk
Affected Versions
<=2.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Total Donations

critical
Vulnerability
Total Donations — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=2.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Depicter — Popup & Slider Builder

high
Vulnerability
Depicter — Popup & Slider Builder — Validate the type of a file uploaded through its import feature and does not remove a malformed uplo
Severity
high High risk
Affected Versions
<=4.8.0
CVE Reference
Patch Status
No patch
Source
NVD

Events Made Easy

high
Vulnerability
Events Made Easy — Local File Inclusion
Severity
high High risk
Affected Versions
<=3.2.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPForms Pro

high
Vulnerability
WPForms Pro — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.0.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

high
Vulnerability
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution — Correctly check user capabilities on some of its admin REST API routes
Severity
high High risk
Affected Versions
<=5.0.14
CVE Reference
Patch Status
No patch
Source
NVD

Drag and Drop Multiple File Upload for Contact Form 7

high
Vulnerability
Drag and Drop Multiple File Upload for Contact Form 7 — Validate the final name of an uploaded file after stripping characters from it
Severity
high High risk
Affected Versions
<=1.3.9.9
CVE Reference
Patch Status
No patch
Source
NVD

AI Engine

high
Vulnerability
AI Engine — Verify that the requesting user is authorized to act on the targeted account before performing privi
Severity
high High risk
Affected Versions
<=3.6.1
CVE Reference
Patch Status
No patch
Source
NVD

WPeMatico RSS Feed Fetcher

high
Vulnerability
WPeMatico RSS Feed Fetcher — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=2.8.24
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ManageWP Worker

high
Vulnerability
ManageWP Worker — Bind the account being logged in to the signature which authorises the login
Severity
high High risk
Affected Versions
<=4.9.37
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

high
Vulnerability
Forminator Forms — Restrict a network-wide setting to network administrators
Severity
high High risk
Affected Versions
<=1.57.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Slider Hero with Video Background, Animation

high
Vulnerability
Slider Hero with Video Background, Animation — Have authorisation and nonce checks on two of its request handlers
Severity
high High risk
Affected Versions
<=9.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Firebase Authentication

high
Vulnerability
Firebase Authentication — Require the email address in an authentication token to be verified before matching it to a WordPres
Severity
high High risk
Affected Versions
<=1.7.1
CVE Reference
Patch Status
No patch
Source
NVD

Advanced Product Fields (Product Addons) for WooCommerce

high
Vulnerability
Advanced Product Fields (Product Addons) for WooCommerce — Improper Input Validation
Severity
high High risk
Affected Versions
<=1.6.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PPWP – Password Protect Pages

high
Vulnerability
PPWP – Password Protect Pages — PHP Object Injection
Severity
high High risk
Affected Versions
<=1.9.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Security Hardener

high
Vulnerability
Security Hardener — Missing Authorization
Severity
high High risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

InfusedWoo Pro

high
Vulnerability
InfusedWoo Pro — Privilege Escalation
Severity
high High risk
Affected Versions
<=5.1.17
CVE Reference
Patch Status
No patch
Source
NVD

CM Map Locations – Visualize and share your locations in a few clicks

high
Vulnerability
CM Map Locations – Visualize and share your locations in a few clicks — Limited Arbitrary File Upload
Severity
high High risk
Affected Versions
<=2.1.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

high
Vulnerability
Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.57.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

high
Vulnerability
Forminator Forms – Contact Form, Payment Form & Custom Form Builder — DOM-Based Reflected Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.57.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Verdure Core

high
Vulnerability
Verdure Core — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.2
CVE Reference
Patch Status
No patch
Source
NVD

NotificationX Pro

high
Vulnerability
NotificationX Pro — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD

Kalles Addons

high
Vulnerability
Kalles Addons — PHP Object Injection
Severity
high High risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Readabler

high
Vulnerability
Readabler — SQL Injection
Severity
high High risk
Affected Versions
<=2.0.18
CVE Reference
Patch Status
No patch
Source
NVD

All-in-One WP Migration and Backup

high
Vulnerability
All-in-One WP Migration and Backup — SQL Injection
Severity
high High risk
Affected Versions
<=7.109
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution

high
Vulnerability
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution — Privilege Escalation
Severity
high High risk
Affected Versions
<=4.9.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Fastest Cache

high
Vulnerability
WP Fastest Cache — Validate the Host header before using it to build the URLs of the asset files it embeds in the pages
Severity
high High risk
Affected Versions
<=1.5.1
CVE Reference
Patch Status
No patch
Source
NVD

Royal Addons for Elementor

medium
Vulnerability
Royal Addons for Elementor — Correctly sanitise custom widget markup before writing it to a file that is later executed
Severity
medium Medium risk
Affected Versions
<=1.7.1066
CVE Reference
Patch Status
No patch
Source
NVD

AI Agent by SiteGround

medium
Vulnerability
AI Agent by SiteGround — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Admin and Site Enhancements (ASE)

medium
Vulnerability
Admin and Site Enhancements (ASE) — Sanitise uploaded SVG files on every route it accepts them through
Severity
medium Medium risk
Affected Versions
<=9.0.1
CVE Reference
Patch Status
No patch
Source
NVD

GutenKit

medium
Vulnerability
GutenKit — Sanitise uploaded SVG files on all of the upload paths it enables
Severity
medium Medium risk
Affected Versions
<=2.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Properly validate the files contained in archives uploaded by users with the Editor role
Severity
medium Medium risk
Affected Versions
<=6.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Welcart e-Commerce

medium
Vulnerability
Welcart e-Commerce — Regenerate the session identifier on authentication and sets the session identifier from a user-supp
Severity
medium Medium risk
Affected Versions
<=2.12.1
CVE Reference
Patch Status
No patch
Source
NVD

NewPath WildApricotPress Add-on

medium
Vulnerability
NewPath WildApricotPress Add-on — Enforce its members-only field privacy on an unauthenticated REST route
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Link Whisper Free

medium
Vulnerability
Link Whisper Free — Properly sanitize and escape a parameter before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=0.9.7
CVE Reference
Patch Status
No patch
Source
NVD

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

medium
Vulnerability
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution — Restrict access to per-vendor commission configuration returned by one of its unauthenticated store
Severity
medium Medium risk
Affected Versions
<=5.0.14
CVE Reference
Patch Status
No patch
Source
NVD

Media Library Assistant

medium
Vulnerability
Media Library Assistant — Validate a search parameter before concatenating it into a SQL query in one of its media-library que
Severity
medium Medium risk
Affected Versions
<=3.40
CVE Reference
Patch Status
No patch
Source
NVD

Tamara Checkout

medium
Vulnerability
Tamara Checkout — Verify the order key
Severity
medium Medium risk
Affected Versions
<=1.9.9.20
CVE Reference
Patch Status
No patch
Source
NVD

LitExtension

medium
Vulnerability
LitExtension — Verify a nonce before an administrative action that overwrites the store-migration connector's authe
Severity
medium Medium risk
Affected Versions
<=1.2.5
CVE Reference
Patch Status
No patch
Source
NVD

myCred

medium
Vulnerability
myCred — Verify that the receiver of an incoming payment gateway notification matches the site's configured m
Severity
medium Medium risk
Affected Versions
<=3.2.5
CVE Reference
Patch Status
No patch
Source
NVD

Charitable

medium
Vulnerability
Charitable — Verify the authenticity of incoming Square payment webhook events in a default configuration
Severity
medium Medium risk
Affected Versions
<=1.8.12
CVE Reference
Patch Status
No patch
Source
NVD

Passster

medium
Vulnerability
Passster — Correctly match its own public endpoint paths when deciding which REST API requests may bypass globa
Severity
medium Medium risk
Affected Versions
<=4.3.9
CVE Reference
Patch Status
No patch
Source
NVD

ProfilePress

medium
Vulnerability
ProfilePress — Strip shortcodes from two of its profile fields before rendering them on public pages
Severity
medium Medium risk
Affected Versions
<=4.17.1
CVE Reference
Patch Status
No patch
Source
NVD

Themify Builder

medium
Vulnerability
Themify Builder — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=7.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress

medium
Vulnerability
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=5.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress

medium
Vulnerability
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=5.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Grid, Slider & Carousel Ultimate

medium
Vulnerability
Post Grid, Slider & Carousel Ultimate — Sanitise and escape one of its custom post type settings before outputting it in an HTML attribute o
Severity
medium Medium risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD

FiboSearch

medium
Vulnerability
FiboSearch — Consistently exclude password-protected products from its unauthenticated AJAX endpoints
Severity
medium Medium risk
Affected Versions
<=1.34.1
CVE Reference
Patch Status
No patch
Source
NVD

Conekta Payment Gateway

medium
Vulnerability
Conekta Payment Gateway — Verify the authenticity of incoming payment gateway webhook notifications
Severity
medium Medium risk
Affected Versions
<=6.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

medium
Vulnerability
Tutor LMS — Validate a stored file path before using it to stream media
Severity
medium Medium risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

medium
Vulnerability
Forminator Forms — Consistently enforce the role restriction it applies to registration forms
Severity
medium Medium risk
Affected Versions
<=1.57.0.7
CVE Reference
Patch Status
No patch
Source
NVD

The kk Star Ratings – Rate Post & Collect User Feedbacks

medium
Vulnerability
The kk Star Ratings – Rate Post & Collect User Feedbacks — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.4.10.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Duplicator

medium
Vulnerability
Post Duplicator — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Duplicator

medium
Vulnerability
Post Duplicator — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=3.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Image Photo Gallery Final Tiles Grid

medium
Vulnerability
Image Photo Gallery Final Tiles Grid — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.6.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MC4WP: Mailchimp for WordPress

medium
Vulnerability
MC4WP: Mailchimp for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.12.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GreenShift – Animation and Page Builder Blocks

medium
Vulnerability
GreenShift – Animation and Page Builder Blocks — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=12.8.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels

medium
Vulnerability
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=4.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

RestrictMate

medium
Vulnerability
RestrictMate — Restrict the user role supplied during account registration
Severity
medium Medium risk
Affected Versions
<=1.3.0
CVE Reference
Patch Status
No patch
Source
NVD

WooCommerce Bookings

medium
Vulnerability
WooCommerce Bookings — Perform a capability check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=3.9.0
CVE Reference
Patch Status
No patch
Source
NVD

Rejected reason: This CVE ID is a duplicate of CVE-2026-15303 and was never published. Both IDs were assigned to the same vulnerability in the 6Storage Rentals

medium
Vulnerability
Rejected reason: This CVE ID is a duplicate of CVE-2026-15303 and was never published. Both IDs were assigned to the same vulnerability in the 6Storage Rentals — CVE-2026-16249
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses

medium
Vulnerability
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.2.29
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Events Manager – Calendar, Bookings, Tickets, and more!

medium
Vulnerability
Events Manager – Calendar, Bookings, Tickets, and more! — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=7.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP

medium
Vulnerability
BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin

medium
Vulnerability
PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.9.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Events Manager – Calendar, Bookings, Tickets, and more!

medium
Vulnerability
Events Manager – Calendar, Bookings, Tickets, and more! — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=7.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates

medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnPress

medium
Vulnerability
LearnPress — Unauthorized modification of arbitrary WordPress options
Severity
medium Medium risk
Affected Versions
<=4.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Events Manager – Calendar, Bookings, Tickets, and more!

medium
Vulnerability
Events Manager – Calendar, Bookings, Tickets, and more! — Local File Inclusion
Severity
medium Medium risk
Affected Versions
<=7.3.7.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Events Manager – Calendar, Bookings, Tickets, and more!

medium
Vulnerability
Events Manager – Calendar, Bookings, Tickets, and more! — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.4.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gutenverse – WordPress Blocks, Page Builder & Site Editor

medium
Vulnerability
Gutenverse – WordPress Blocks, Page Builder & Site Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FundEngine – Donation and Crowdfunding Platform

medium
Vulnerability
FundEngine – Donation and Crowdfunding Platform — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FundEngine – Donation and Crowdfunding Platform

medium
Vulnerability
FundEngine – Donation and Crowdfunding Platform — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

tagDiv Composer

medium
Vulnerability
tagDiv Composer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.4.5
CVE Reference
Patch Status
No patch
Source
NVD

Fluent Boards Pro

medium
Vulnerability
Fluent Boards Pro — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=2.0.11
CVE Reference
Patch Status
No patch
Source
NVD

Fluent Support Pro

medium
Vulnerability
Fluent Support Pro — Unauthorized access
Severity
medium Medium risk
Affected Versions
<=2.3.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Project Manager Pro

medium
Vulnerability
WP Project Manager Pro — SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.0.1
CVE Reference
Patch Status
No patch
Source
NVD

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

medium
Vulnerability
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.1.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TranslatePress – Translate Multilingual sites with AI Translation

medium
Vulnerability
TranslatePress – Translate Multilingual sites with AI Translation — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.2.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

eCommerce Product Catalog

medium
Vulnerability
eCommerce Product Catalog — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

My Agile Privacy® – CMP, Cookie Consent & Privacy Tools

medium
Vulnerability
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

medium
Vulnerability
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.12.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletters

medium
Vulnerability
Newsletters — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Media Sweep – WordPress Media Cleaner

medium
Vulnerability
Media Sweep – WordPress Media Cleaner — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution

medium
Vulnerability
FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution — SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.1.12
CVE Reference
Patch Status
No patch
Source
NVD

GutenKit

low
Vulnerability
GutenKit — Have a sufficient capability check on some of its REST API endpoints
Severity
low Low risk
Affected Versions
<=2.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Drag and Drop Multiple File Upload for Contact Form 7

low
Vulnerability
Drag and Drop Multiple File Upload for Contact Form 7 — Escape one of its settings before using it as an HTML tag name in front-end output
Severity
low Low risk
Affected Versions
<=1.3.9.9
CVE Reference
Patch Status
No patch
Source
NVD

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

low
Vulnerability
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution — Validate a client-supplied payment amount against the vendor's actual outstanding balance when recor
Severity
low Low risk
Affected Versions
<=5.0.14
CVE Reference
Patch Status
No patch
Source
NVD

Duplicate Post

low
Vulnerability
Duplicate Post — Check that a user may read the content of a post before duplicating it
Severity
low Low risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD

Duplicate Post

low
Vulnerability
Duplicate Post — Check the user's capabilities before returning post data
Severity
low Low risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

low
Vulnerability
Eventin — Validate a user-supplied webhook URL stored on events nor verify event ownership
Severity
low Low risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Limit Login Attempts Reloaded

low
Vulnerability
Limit Login Attempts Reloaded — Compare logins against its username denylist case-insensitively and does not account for the account
Severity
low Low risk
Affected Versions
<=3.3.5
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

low
Vulnerability
Tutor LMS — Enforce per-object ownership checks on its course content type
Severity
low Low risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Content Mask

low
Vulnerability
Content Mask — Check the capability required to publish the post type being created
Severity
low Low risk
Affected Versions
<=1.8.5.5
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (3)

Jawn

critical
Vulnerability
Jawn — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=1.4.2
CVE Reference
Patch Status
No patch
Source
NVD

Mane

high
Vulnerability
Mane — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.7
CVE Reference
Patch Status
No patch
Source
NVD

Shuffle

high
Vulnerability
Shuffle — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.8
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: August 25 – September 1, 2026

171 WordPress vulnerabilities disclosed between August 25 – September 1, 2026. 15 critical, 57 high severity. 0 patched, 171 unpatched.

WPSentry·Sep 1, 2026
Vulnerability Report

WordPress Vulnerability Report: August 24 – August 31, 2026

171 WordPress vulnerabilities disclosed between August 24 – August 31, 2026. 15 critical, 50 high severity. 0 patched, 171 unpatched.

WPSentry·Aug 31, 2026
Vulnerability Report

WordPress Vulnerability Report: August 23 – August 30, 2026

170 WordPress vulnerabilities disclosed between August 23 – August 30, 2026. 15 critical, 50 high severity. 0 patched, 170 unpatched.

WPSentry·Aug 30, 2026
Back to Blog