BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: August 21 – August 28, 2026

151 WordPress vulnerabilities disclosed between August 21 – August 28, 2026. 14 critical, 44 high severity. 0 patched, 151 unpatched.

WPSentryAugust 28, 202634 min read

During the reporting period (August 21 – August 28, 2026), 151 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

151
Total
14
Critical
44
High
87
Medium
6
Low
0
Patched
Table of Contents 156 plugins & components

WordPress Plugin Vulnerabilities (146)

Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code

critical
Vulnerability
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=4.8.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Social Media Login

critical
Vulnerability
WP Social Media Login — Verify that a social login was actually completed with the identity provider before authenticating a
Severity
critical Critical risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Social Login & Sharing buttons with Analytics By SoClever

critical
Vulnerability
Social Login & Sharing buttons with Analytics By SoClever — Perform any authentication
Severity
critical Critical risk
Affected Versions
<=1.2.0
CVE Reference
Patch Status
No patch
Source
NVD

SmilePass Selfie Login

critical
Vulnerability
SmilePass Selfie Login — Perform any server-side verification of the identity it is asked to authenticate
Severity
critical Critical risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Mailgun for WordPress

critical
Vulnerability
Mailgun for WordPress — Server-Side Request Forgery (SSRF)
Severity
critical Critical risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WS Form LITE – Drag & Drop Contact Form Builder

critical
Vulnerability
WS Form LITE – Drag & Drop Contact Form Builder — PHP Object Injection
Severity
critical Critical risk
Affected Versions
<=1.10.80
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Total Donations

critical
Vulnerability
Total Donations — SQL Injection
Severity
critical Critical risk
Affected Versions
<=2.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Total Donations

critical
Vulnerability
Total Donations — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=2.0.5
CVE Reference
Patch Status
No patch
Source
NVD

TranslatePress – Translate Multilingual sites with AI Translation

critical
Vulnerability
TranslatePress – Translate Multilingual sites with AI Translation — Sensitive Information Exposure
Severity
critical Critical risk
Affected Versions
<=3.3.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce

critical
Vulnerability
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce — Unrestricted File Type Upload
Severity
critical Critical risk
Affected Versions
<=1.17.8
CVE Reference
Patch Status
No patch
Source
NVD

Workeera

critical
Vulnerability
Workeera — Restrict which values may be written to a user's own candidate profile
Severity
critical Critical risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

critical
Vulnerability
Tutor LMS — Prevent request data from overwriting internal variables while rendering templates
Severity
critical Critical risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

WPeMatico RSS Feed Fetcher

high
Vulnerability
WPeMatico RSS Feed Fetcher — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=2.8.24
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ManageWP Worker

high
Vulnerability
ManageWP Worker — Bind the account being logged in to the signature which authorises the login
Severity
high High risk
Affected Versions
<=4.9.37
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

high
Vulnerability
Forminator Forms — Restrict a network-wide setting to network administrators
Severity
high High risk
Affected Versions
<=1.57.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Slider Hero with Video Background, Animation

high
Vulnerability
Slider Hero with Video Background, Animation — Have authorisation and nonce checks on two of its request handlers
Severity
high High risk
Affected Versions
<=9.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Firebase Authentication

high
Vulnerability
Firebase Authentication — Require the email address in an authentication token to be verified before matching it to a WordPres
Severity
high High risk
Affected Versions
<=1.7.1
CVE Reference
Patch Status
No patch
Source
NVD

Advanced Product Fields (Product Addons) for WooCommerce

high
Vulnerability
Advanced Product Fields (Product Addons) for WooCommerce — Improper Input Validation
Severity
high High risk
Affected Versions
<=1.6.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PPWP – Password Protect Pages

high
Vulnerability
PPWP – Password Protect Pages — PHP Object Injection
Severity
high High risk
Affected Versions
<=1.9.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Security Hardener

high
Vulnerability
Security Hardener — Missing Authorization
Severity
high High risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

InfusedWoo Pro

high
Vulnerability
InfusedWoo Pro — Privilege Escalation
Severity
high High risk
Affected Versions
<=5.1.17
CVE Reference
Patch Status
No patch
Source
NVD

CM Map Locations – Visualize and share your locations in a few clicks

high
Vulnerability
CM Map Locations – Visualize and share your locations in a few clicks — Limited Arbitrary File Upload
Severity
high High risk
Affected Versions
<=2.1.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

high
Vulnerability
Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.57.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

high
Vulnerability
Forminator Forms – Contact Form, Payment Form & Custom Form Builder — DOM-Based Reflected Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.57.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Verdure Core

high
Vulnerability
Verdure Core — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.2
CVE Reference
Patch Status
No patch
Source
NVD

NotificationX Pro

high
Vulnerability
NotificationX Pro — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD

Kalles Addons

high
Vulnerability
Kalles Addons — PHP Object Injection
Severity
high High risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Readabler

high
Vulnerability
Readabler — SQL Injection
Severity
high High risk
Affected Versions
<=2.0.18
CVE Reference
Patch Status
No patch
Source
NVD

All-in-One WP Migration and Backup

high
Vulnerability
All-in-One WP Migration and Backup — SQL Injection
Severity
high High risk
Affected Versions
<=7.109
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution

high
Vulnerability
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution — Privilege Escalation
Severity
high High risk
Affected Versions
<=4.9.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Fastest Cache

high
Vulnerability
WP Fastest Cache — Validate the Host header before using it to build the URLs of the asset files it embeds in the pages
Severity
high High risk
Affected Versions
<=1.5.1
CVE Reference
Patch Status
No patch
Source
NVD

BlogVault Backup & Staging

high
Vulnerability
BlogVault Backup & Staging — CVE-2026-19718
Severity
high High risk
Affected Versions
<=6.65
CVE Reference
Patch Status
No patch
Source
NVD

WP Fastest Cache – WordPress Cache Plugin

high
Vulnerability
WP Fastest Cache – WordPress Cache Plugin — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Pods

high
Vulnerability
Pods — Correctly compare a display callback against its list of blocked functions
Severity
high High risk
Affected Versions
<=3.3.9.1
CVE Reference
Patch Status
No patch
Source
NVD

Project Manager

high
Vulnerability
Project Manager — Have any authorisation check on its import routes
Severity
high High risk
Affected Versions
<=4.0.7
CVE Reference
Patch Status
No patch
Source
NVD

AI Engine

high
Vulnerability
AI Engine — Confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and
Severity
high High risk
Affected Versions
<=3.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Order Tip for WooCommerce

high
Vulnerability
Order Tip for WooCommerce — Check the capability of the user requesting a file deletion
Severity
high High risk
Affected Versions
<=1.6.0
CVE Reference
Patch Status
No patch
Source
NVD

Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More

high
Vulnerability
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.33.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WooCommerce Lottery

high
Vulnerability
WooCommerce Lottery — Time-Based SQL Injection
Severity
high High risk
Affected Versions
<=2.2.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mang Board WP

high
Vulnerability
Mang Board WP — Missing Authorization
Severity
high High risk
Affected Versions
<=2.3.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Classified Listing - Mobile Number Verification

high
Vulnerability
Classified Listing - Mobile Number Verification — Authentication Bypass
Severity
high High risk
Affected Versions
<=1.6.0
CVE Reference
Patch Status
No patch
Source
NVD

Formidable Charts

high
Vulnerability
Formidable Charts — Directory Traversal
Severity
high High risk
Affected Versions
<=2.0.1
CVE Reference
Patch Status
No patch
Source
NVD

CMP

high
Vulnerability
CMP — Enforce an option-name allow-list when importing settings via one of its AJAX actions
Severity
high High risk
Affected Versions
<=4.1.18
CVE Reference
Patch Status
No patch
Source
NVD

Smush

high
Vulnerability
Smush — Restrict a network-wide setting to network administrators
Severity
high High risk
Affected Versions
<=4.3.2
CVE Reference
Patch Status
No patch
Source
NVD

WP OAuth Server ( Login with WordPress )

high
Vulnerability
WP OAuth Server ( Login with WordPress ) — Restrict access to the debug log it writes
Severity
high High risk
Affected Versions
<=6.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Workeera

high
Vulnerability
Workeera — Restrict which profile values a candidate may submit
Severity
high High risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Workeera

high
Vulnerability
Workeera — Restrict which profile values a candidate may submit
Severity
high High risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

StoreGrowth

high
Vulnerability
StoreGrowth — Validate a browser-supplied product price on two of its unauthenticated actions
Severity
high High risk
Affected Versions
<=2.1.2
CVE Reference
Patch Status
No patch
Source
NVD

12 Step Meeting List

high
Vulnerability
12 Step Meeting List — Sanitise and escape a value submitted by unauthenticated users before storing it in its activity log
Severity
high High risk
Affected Versions
<=3.19.17
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

high
Vulnerability
Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.57.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LiteSpeed Cache

high
Vulnerability
LiteSpeed Cache — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=7.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

One User Avatar | User Profile Picture

high
Vulnerability
One User Avatar | User Profile Picture — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.5.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TranslatePress – Translate Multilingual sites with AI Translation

high
Vulnerability
TranslatePress – Translate Multilingual sites with AI Translation — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.3.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

high
Vulnerability
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.2.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LitExtension

medium
Vulnerability
LitExtension — Verify a nonce before an administrative action that overwrites the store-migration connector's authe
Severity
medium Medium risk
Affected Versions
<=1.2.5
CVE Reference
Patch Status
No patch
Source
NVD

myCred

medium
Vulnerability
myCred — Verify that the receiver of an incoming payment gateway notification matches the site's configured m
Severity
medium Medium risk
Affected Versions
<=3.2.5
CVE Reference
Patch Status
No patch
Source
NVD

Charitable

medium
Vulnerability
Charitable — Verify the authenticity of incoming Square payment webhook events in a default configuration
Severity
medium Medium risk
Affected Versions
<=1.8.12
CVE Reference
Patch Status
No patch
Source
NVD

Passster

medium
Vulnerability
Passster — Correctly match its own public endpoint paths when deciding which REST API requests may bypass globa
Severity
medium Medium risk
Affected Versions
<=4.3.9
CVE Reference
Patch Status
No patch
Source
NVD

ProfilePress

medium
Vulnerability
ProfilePress — Strip shortcodes from two of its profile fields before rendering them on public pages
Severity
medium Medium risk
Affected Versions
<=4.17.1
CVE Reference
Patch Status
No patch
Source
NVD

Themify Builder

medium
Vulnerability
Themify Builder — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=7.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress

medium
Vulnerability
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=5.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress

medium
Vulnerability
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=5.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Grid, Slider & Carousel Ultimate

medium
Vulnerability
Post Grid, Slider & Carousel Ultimate — Sanitise and escape one of its custom post type settings before outputting it in an HTML attribute o
Severity
medium Medium risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD

FiboSearch

medium
Vulnerability
FiboSearch — Consistently exclude password-protected products from its unauthenticated AJAX endpoints
Severity
medium Medium risk
Affected Versions
<=1.34.1
CVE Reference
Patch Status
No patch
Source
NVD

Conekta Payment Gateway

medium
Vulnerability
Conekta Payment Gateway — Verify the authenticity of incoming payment gateway webhook notifications
Severity
medium Medium risk
Affected Versions
<=6.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

medium
Vulnerability
Tutor LMS — Validate a stored file path before using it to stream media
Severity
medium Medium risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

medium
Vulnerability
Forminator Forms — Consistently enforce the role restriction it applies to registration forms
Severity
medium Medium risk
Affected Versions
<=1.57.0.7
CVE Reference
Patch Status
No patch
Source
NVD

The kk Star Ratings – Rate Post & Collect User Feedbacks

medium
Vulnerability
The kk Star Ratings – Rate Post & Collect User Feedbacks — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.4.10.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Duplicator

medium
Vulnerability
Post Duplicator — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Duplicator

medium
Vulnerability
Post Duplicator — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=3.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Image Photo Gallery Final Tiles Grid

medium
Vulnerability
Image Photo Gallery Final Tiles Grid — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.6.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MC4WP: Mailchimp for WordPress

medium
Vulnerability
MC4WP: Mailchimp for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.12.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GreenShift – Animation and Page Builder Blocks

medium
Vulnerability
GreenShift – Animation and Page Builder Blocks — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=12.8.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels

medium
Vulnerability
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=4.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

RestrictMate

medium
Vulnerability
RestrictMate — Restrict the user role supplied during account registration
Severity
medium Medium risk
Affected Versions
<=1.3.0
CVE Reference
Patch Status
No patch
Source
NVD

WooCommerce Bookings

medium
Vulnerability
WooCommerce Bookings — Perform a capability check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=3.9.0
CVE Reference
Patch Status
No patch
Source
NVD

Rejected reason: This CVE ID is a duplicate of CVE-2026-15303 and was never published. Both IDs were assigned to the same vulnerability in the 6Storage Rentals

medium
Vulnerability
Rejected reason: This CVE ID is a duplicate of CVE-2026-15303 and was never published. Both IDs were assigned to the same vulnerability in the 6Storage Rentals — CVE-2026-16249
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses

medium
Vulnerability
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.2.29
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Events Manager – Calendar, Bookings, Tickets, and more!

medium
Vulnerability
Events Manager – Calendar, Bookings, Tickets, and more! — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=7.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP

medium
Vulnerability
BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin

medium
Vulnerability
PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.9.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Events Manager – Calendar, Bookings, Tickets, and more!

medium
Vulnerability
Events Manager – Calendar, Bookings, Tickets, and more! — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=7.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates

medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnPress

medium
Vulnerability
LearnPress — Unauthorized modification of arbitrary WordPress options
Severity
medium Medium risk
Affected Versions
<=4.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Events Manager – Calendar, Bookings, Tickets, and more!

medium
Vulnerability
Events Manager – Calendar, Bookings, Tickets, and more! — Local File Inclusion
Severity
medium Medium risk
Affected Versions
<=7.3.7.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Events Manager – Calendar, Bookings, Tickets, and more!

medium
Vulnerability
Events Manager – Calendar, Bookings, Tickets, and more! — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.4.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gutenverse – WordPress Blocks, Page Builder & Site Editor

medium
Vulnerability
Gutenverse – WordPress Blocks, Page Builder & Site Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FundEngine – Donation and Crowdfunding Platform

medium
Vulnerability
FundEngine – Donation and Crowdfunding Platform — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FundEngine – Donation and Crowdfunding Platform

medium
Vulnerability
FundEngine – Donation and Crowdfunding Platform — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

tagDiv Composer

medium
Vulnerability
tagDiv Composer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.4.5
CVE Reference
Patch Status
No patch
Source
NVD

Fluent Boards Pro

medium
Vulnerability
Fluent Boards Pro — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=2.0.11
CVE Reference
Patch Status
No patch
Source
NVD

Fluent Support Pro

medium
Vulnerability
Fluent Support Pro — Unauthorized access
Severity
medium Medium risk
Affected Versions
<=2.3.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Project Manager Pro

medium
Vulnerability
WP Project Manager Pro — SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.0.1
CVE Reference
Patch Status
No patch
Source
NVD

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

medium
Vulnerability
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.1.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TranslatePress – Translate Multilingual sites with AI Translation

medium
Vulnerability
TranslatePress – Translate Multilingual sites with AI Translation — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.2.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

eCommerce Product Catalog

medium
Vulnerability
eCommerce Product Catalog — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

My Agile Privacy® – CMP, Cookie Consent & Privacy Tools

medium
Vulnerability
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

medium
Vulnerability
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.12.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletters

medium
Vulnerability
Newsletters — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Media Sweep – WordPress Media Cleaner

medium
Vulnerability
Media Sweep – WordPress Media Cleaner — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution

medium
Vulnerability
FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution — SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.1.12
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Restrict access to non-published content by status or ownership in one of its REST API namespaces
Severity
medium Medium risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD

Royal Addons for Elementor

medium
Vulnerability
Royal Addons for Elementor — Perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writi
Severity
medium Medium risk
Affected Versions
<=1.7.1066
CVE Reference
Patch Status
No patch
Source
NVD

Royal Addons for Elementor

medium
Vulnerability
Royal Addons for Elementor — Perform any capability or nonce check before returning taxonomy term data for an arbitrary
Severity
medium Medium risk
Affected Versions
<=1.7.1066
CVE Reference
Patch Status
No patch
Source
NVD

Booking for Appointments and Events Calendar

medium
Vulnerability
Booking for Appointments and Events Calendar — Verify that an authenticated employee (provider) owns the provider account being updated
Severity
medium Medium risk
Affected Versions
<=9.8
CVE Reference
Patch Status
No patch
Source
NVD

Booking for Appointments and Events Calendar

medium
Vulnerability
Booking for Appointments and Events Calendar — Require authentication before processing its pending notification queue
Severity
medium Medium risk
Affected Versions
<=2.4.7
CVE Reference
Patch Status
No patch
Source
NVD

WPCafe

medium
Vulnerability
WPCafe — Perform an authorization check when creating a reservation through its REST API
Severity
medium Medium risk
Affected Versions
<=3.0.18
CVE Reference
Patch Status
No patch
Source
NVD

Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates

medium
Vulnerability
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates — Include an authorization check on a REST route that returns stored account data
Severity
medium Medium risk
Affected Versions
<=3.7.1
CVE Reference
Patch Status
No patch
Source
NVD

Booking Package

medium
Vulnerability
Booking Package — Validate the payment amount server-side against the stored service price
Severity
medium Medium risk
Affected Versions
<=1.7.25
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

medium
Vulnerability
Tutor LMS — Validate values used to build a database query
Severity
medium Medium risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Royal Addons for Elementor

medium
Vulnerability
Royal Addons for Elementor — Validate some widget settings before outputting them inside an HTML attribute
Severity
medium Medium risk
Affected Versions
<=1.7.1066
CVE Reference
Patch Status
No patch
Source
NVD

Project Manager

medium
Vulnerability
Project Manager — Restrict several of its REST API routes to the projects a user belongs to
Severity
medium Medium risk
Affected Versions
<=4.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Project Manager

medium
Vulnerability
Project Manager — Check that the user whose activity is being requested is the one making the request in one of its RE
Severity
medium Medium risk
Affected Versions
<=4.0.7
CVE Reference
Patch Status
No patch
Source
NVD

AI Engine

medium
Vulnerability
AI Engine — Perform an authorisation check on one of its administration-only features
Severity
medium Medium risk
Affected Versions
<=3.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Properly restrict which changes a guest checkout token is allowed to authorise on an order
Severity
medium Medium risk
Affected Versions
<=4.1.19
CVE Reference
Patch Status
No patch
Source
NVD

Return Refund and Exchange For WooCommerce

medium
Vulnerability
Return Refund and Exchange For WooCommerce — Correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthentic
Severity
medium Medium risk
Affected Versions
<=4.6.4
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Perform a capability check on some endpoints of one of its public AJAX actions
Severity
medium Medium risk
Affected Versions
<=6.0.14
CVE Reference
Patch Status
No patch
Source
NVD

Directorist: AI-Powered Business Directory, Listings & Classified Ads

medium
Vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads — Sanitize a user-supplied image reference before using it as the source of a file move
Severity
medium Medium risk
Affected Versions
<=8.9.3
CVE Reference
Patch Status
No patch
Source
NVD

Stripe Payment Forms by WP Full Pay

medium
Vulnerability
Stripe Payment Forms by WP Full Pay — Properly verify that a customer portal session has completed its confirmation step before returning
Severity
medium Medium risk
Affected Versions
<=8.5.1
CVE Reference
Patch Status
No patch
Source
NVD

Stripe Payment Forms by WP Full Pay

medium
Vulnerability
Stripe Payment Forms by WP Full Pay — Verify that a subscription belongs to the customer bound to the requesting customer-portal session b
Severity
medium Medium risk
Affected Versions
<=8.5.1
CVE Reference
Patch Status
No patch
Source
NVD

RegistrationMagic

medium
Vulnerability
RegistrationMagic — Sanitise and escape a parameter before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=6.0.9.4
CVE Reference
Patch Status
No patch
Source
NVD

Simple Newsletter Plugin

medium
Vulnerability
Simple Newsletter Plugin — Verify that the requester is the subscriber named in a public request before rendering that subscrib
Severity
medium Medium risk
Affected Versions
<=4.3.3
CVE Reference
Patch Status
No patch
Source
NVD

Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem

medium
Vulnerability
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Reviews and Rating – Google Reviews

medium
Vulnerability
Reviews and Rating – Google Reviews — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Data Access

medium
Vulnerability
WP Data Access — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=5.5.68
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Greenshift – animation and page builder blocks

medium
Vulnerability
Greenshift – animation and page builder blocks — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=12.8.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CMP

medium
Vulnerability
CMP — Perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for ce
Severity
medium Medium risk
Affected Versions
<=4.1.18
CVE Reference
Patch Status
No patch
Source
NVD

Document Embedder

medium
Vulnerability
Document Embedder — Check a document's status before issuing a download token and streaming the file
Severity
medium Medium risk
Affected Versions
<=2.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce

medium
Vulnerability
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce — Verify that the requesting user owns the customer profile being queried through one of its REST endp
Severity
medium Medium risk
Affected Versions
<=0.4.62
CVE Reference
Patch Status
No patch
Source
NVD

Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce

medium
Vulnerability
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce — Check the user's capabilities before
Severity
medium Medium risk
Affected Versions
<=0.4.62
CVE Reference
Patch Status
No patch
Source
NVD

Defender Security

medium
Vulnerability
Defender Security — Restrict a network-wide setting to network administrators
Severity
medium Medium risk
Affected Versions
<=6.2.0
CVE Reference
Patch Status
No patch
Source
NVD

JetBackup

medium
Vulnerability
JetBackup — Perform its multisite authorisation check before serving backup archives and job logs
Severity
medium Medium risk
Affected Versions
<=3.1.23.5
CVE Reference
Patch Status
No patch
Source
NVD

UpdraftPlus: WP Backup & Migration Plugin

medium
Vulnerability
UpdraftPlus: WP Backup & Migration Plugin — Have CSRF checks in one of its backup management actions
Severity
medium Medium risk
Affected Versions
<=1.26.7
CVE Reference
Patch Status
No patch
Source
NVD

LearnPress

medium
Vulnerability
LearnPress — Perform any authorization check on one of its REST endpoints in all versions up to
Severity
medium Medium risk
Affected Versions
<=4.0.3
CVE Reference
Patch Status
No patch
Source
NVD

Finale Lite

medium
Vulnerability
Finale Lite — Perform a capability check on an AJAX action that returns a sales-campaign's configuration for an ar
Severity
medium Medium risk
Affected Versions
<=2.21.0
CVE Reference
Patch Status
No patch
Source
NVD

Notifima

medium
Vulnerability
Notifima — Verify that the caller owns the subscription being modified on one of its REST endpoints in all vers
Severity
medium Medium risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD

Smart Slider 3

medium
Vulnerability
Smart Slider 3 — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.1.38
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Avada (Fusion) Builder

medium
Vulnerability
Avada (Fusion) Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.15.6
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS – eLearning and online course solution

medium
Vulnerability
Tutor LMS – eLearning and online course solution — Remote Code Execution limited to zero-argument function invocation
Severity
medium Medium risk
Affected Versions
<=4.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LiteSpeed Cache

medium
Vulnerability
LiteSpeed Cache — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin

low
Vulnerability
Eventin — Validate a user-supplied webhook URL stored on events nor verify event ownership
Severity
low Low risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Limit Login Attempts Reloaded

low
Vulnerability
Limit Login Attempts Reloaded — Compare logins against its username denylist case-insensitively and does not account for the account
Severity
low Low risk
Affected Versions
<=3.3.5
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

low
Vulnerability
Tutor LMS — Enforce per-object ownership checks on its course content type
Severity
low Low risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Content Mask

low
Vulnerability
Content Mask — Check the capability required to publish the post type being created
Severity
low Low risk
Affected Versions
<=1.8.5.5
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

low
Vulnerability
Forminator Forms — Verify that site registration is enabled on the network before creating a site signup
Severity
low Low risk
Affected Versions
<=1.57.1
CVE Reference
Patch Status
No patch
Source
NVD

CMP

low
Vulnerability
CMP — Sanitise and escape a settings value before outputting it on the coming-soon page
Severity
low Low risk
Affected Versions
<=4.1.18
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (5)

Jawn

critical
Vulnerability
Jawn — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=1.4.2
CVE Reference
Patch Status
No patch
Source
NVD

Avada

critical
Vulnerability
Avada — Arbitrary File Write
Severity
critical Critical risk
Affected Versions
<=7.16
CVE Reference
Patch Status
No patch
Source
NVD

Mane

high
Vulnerability
Mane — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.7
CVE Reference
Patch Status
No patch
Source
NVD

Shuffle

high
Vulnerability
Shuffle — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.8
CVE Reference
Patch Status
No patch
Source
NVD

Betheme

medium
Vulnerability
Betheme — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=28.4
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: August 25 – September 1, 2026

171 WordPress vulnerabilities disclosed between August 25 – September 1, 2026. 15 critical, 57 high severity. 0 patched, 171 unpatched.

WPSentry·Sep 1, 2026
Vulnerability Report

WordPress Vulnerability Report: August 24 – August 31, 2026

171 WordPress vulnerabilities disclosed between August 24 – August 31, 2026. 15 critical, 50 high severity. 0 patched, 171 unpatched.

WPSentry·Aug 31, 2026
Vulnerability Report

WordPress Vulnerability Report: August 23 – August 30, 2026

170 WordPress vulnerabilities disclosed between August 23 – August 30, 2026. 15 critical, 50 high severity. 0 patched, 170 unpatched.

WPSentry·Aug 30, 2026
Back to Blog