During the reporting period (August 29 – September 5, 2026), 201 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.
Summary
201
Total
15
Critical
39
High
135
Medium
12
Low
0
Patched
Table of Contents 206 plugins & components
WordPress Plugin Vulnerabilities (194)
Sigma Forms Pro
critical
Vulnerability
Sigma Forms Pro — Remote Code Execution
Severity
critical Critical risk
Affected Versions
<=1.4.5
CVE Reference
Patch Status
No patch
Source
NVD
Custom User Registration Fields for WooCommerce
critical
Vulnerability
Custom User Registration Fields for WooCommerce — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=2.2.3
CVE Reference
Patch Status
No patch
Source
NVD
MyHome Core
critical
Vulnerability
MyHome Core — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=4.4.5
CVE Reference
Patch Status
No patch
Source
NVD
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
critical
Vulnerability
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode — Arbitrary file upload
Severity
critical Critical risk
Affected Versions
<=4.4.1
CVE Reference
Patch Status
No patch
Source
NVD
Booking for Appointments and Events Calendar – Amelia (Premium)
critical
Vulnerability
Booking for Appointments and Events Calendar – Amelia (Premium) — Privilege Escalation
Severity
critical Critical risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
SigmaForms Pro – AI Generated Forms
critical
Vulnerability
SigmaForms Pro – AI Generated Forms — Arbitrary file deletion
Severity
critical Critical risk
Affected Versions
<=1.4.11
CVE Reference
Patch Status
No patch
Source
NVD
Developer Tools
critical
Vulnerability
Developer Tools — CVE-2025-9314
Severity
critical Critical risk
Affected Versions
<=1.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Embed HTML5 Game
critical
Vulnerability
Embed HTML5 Game — Properly restrict who can upload files via the plugin
Severity
critical Critical risk
Affected Versions
<=1.3
CVE Reference
Patch Status
No patch
Source
NVD
WatchMan-Site7
critical
Vulnerability
WatchMan-Site7 — Restrict access to its debugging console
Severity
critical Critical risk
Affected Versions
<=4.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Divi Ajax Filter
critical
Vulnerability
Divi Ajax Filter — Local File Inclusion
Severity
critical Critical risk
Affected Versions
<=5.1.2
CVE Reference
Patch Status
No patch
Source
NVD
ACPT (Premium)
critical
Vulnerability
ACPT (Premium) — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=2.0.66
CVE Reference
Patch Status
No patch
Source
NVD
AI Website Builder
critical
Vulnerability
AI Website Builder — Perform any authorisation or nonce check on its REST API routes
Severity
critical Critical risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Mstore Api
critical
Vulnerability
Mstore Api — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=4.20.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN
critical
Vulnerability
Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN — Remote Code Execution
Severity
critical Critical risk
Affected Versions
<=3.21.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
SAML Single Sign On – SSO Login
high
Vulnerability
SAML Single Sign On – SSO Login — Authentication Bypass
Severity
high High risk
Affected Versions
<=5.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
geotargetingwp
high
Vulnerability
geotargetingwp — Sanitise or escape several parameters before reflecting them back in AJAX responses that are served
Severity
high High risk
Affected Versions
<=3.5.6.2
CVE Reference
Patch Status
No patch
Source
NVD
Customer Reviews for WooCommerce
high
Vulnerability
Customer Reviews for WooCommerce — Sanitise and escape the content of customer reviews received via one of its endpoints
Severity
high High risk
Affected Versions
<=5.118.0
CVE Reference
Patch Status
No patch
Source
NVD
Groundhogg — CRM, Newsletters, and Marketing Automation
high
Vulnerability
Groundhogg — CRM, Newsletters, and Marketing Automation — Validate or escape values submitted to some optional web form fields before storing them and outputt
Severity
high High risk
Affected Versions
<=4.5.13
CVE Reference
Patch Status
No patch
Source
NVD
ProfilePress
high
Vulnerability
ProfilePress — Unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit c
Severity
high High risk
Affected Versions
<=4.17.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
Affiliate Super Assistent
high
Vulnerability
Affiliate Super Assistent — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.10.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Listdom: AI-powered Business Directory with Classifieds Ads Listings
high
Vulnerability
Listdom: AI-powered Business Directory with Classifieds Ads Listings — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
high
Vulnerability
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System — Authentication Bypass leading to Administrator Account Takeover
Severity
high High risk
Affected Versions
<=1.4.52
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Frontend Admin by DynamiApps
high
Vulnerability
Frontend Admin by DynamiApps — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=3.29.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
high
Vulnerability
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=3.1.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Welcart e-Commerce
high
Vulnerability
Welcart e-Commerce — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.12.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
Gravity Forms
high
Vulnerability
Gravity Forms — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=3.0.2
CVE Reference
Patch Status
No patch
Source
NVD
FS-Poster
high
Vulnerability
FS-Poster — Remote Code Execution
Severity
high High risk
Affected Versions
<=8.0.1
CVE Reference
Patch Status
No patch
Source
NVD
WP File Download
high
Vulnerability
WP File Download — Arbitrary file deletion
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Advanced Custom Fields: Extended
high
Vulnerability
Advanced Custom Fields: Extended — Verify that the requester is authorized to edit the targeted user account in the update-user action
Severity
high High risk
Affected Versions
<=0.9.2.7
CVE Reference
Patch Status
No patch
Source
NVD
Photo Gallery by 10Web
high
Vulnerability
Photo Gallery by 10Web — Escape two request parameters before reflecting them into input-attribute values on its admin pages
Severity
high High risk
Affected Versions
<=1.8.44
CVE Reference
Patch Status
No patch
Source
NVD
DevKit Pro
high
Vulnerability
DevKit Pro — Missing Authorization
Severity
high High risk
Affected Versions
<=2.3.0
CVE Reference
Patch Status
No patch
Source
NVD
User Frontend
high
Vulnerability
User Frontend — Prevent user-supplied field values from being deserialized when a submitted post is reopened in its
Severity
high High risk
Affected Versions
<=4.3.11
CVE Reference
Patch Status
No patch
Source
NVD
JetBackup
high
Vulnerability
JetBackup — Verify the role or capabilities of the account it preserves across a restore or migration before gra
Severity
high High risk
Affected Versions
<=3.1.23.5
CVE Reference
Patch Status
No patch
Source
NVD
Social Media Share Buttons & Social Sharing Icons
high
Vulnerability
Social Media Share Buttons & Social Sharing Icons — Properly escape a value taken from the incoming request before outputting it in an inline JavaScript
Severity
high High risk
Affected Versions
<=3.0.1
CVE Reference
Patch Status
No patch
Source
NVD
RegistrationMagic
high
Vulnerability
RegistrationMagic — Escape a registration form field value before outputting it in an HTML attribute on an administrativ
Severity
high High risk
Affected Versions
<=6.0.9.9
CVE Reference
Patch Status
No patch
Source
NVD
Advanced Custom Fields: Extended
high
Vulnerability
Advanced Custom Fields: Extended — Restrict the role submitted through its front-end user forms to the roles the form actually offers
Severity
high High risk
Affected Versions
<=0.9.2.7
CVE Reference
Patch Status
No patch
Source
NVD
FAQ Builder AYS
high
Vulnerability
FAQ Builder AYS — Sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it
Severity
high High risk
Affected Versions
<=1.8.5
CVE Reference
Patch Status
No patch
Source
NVD
Simple Ajax Chat
high
Vulnerability
Simple Ajax Chat — Escape chat message content before rendering it
Severity
high High risk
Affected Versions
<=20260827
CVE Reference
Patch Status
No patch
Source
NVD
OAuth Single Sign On
high
Vulnerability
OAuth Single Sign On — Verify the identity assertion returned by its Steam single sign-on flow
Severity
high High risk
Affected Versions
<=7.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Broken Link Checker
high
Vulnerability
Broken Link Checker — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.4.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Auto x LINE
high
Vulnerability
Auto x LINE — Have authorization checks in some of its REST endpoints
Severity
high High risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Classified Listing
high
Vulnerability
Classified Listing — Verify that the caller owns or can edit the target listing before its AI image-editing AJAX action d
Severity
high High risk
Affected Versions
<=6.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Hummingbird Performance
high
Vulnerability
Hummingbird Performance — Restrict a network-wide setting to network administrators
Severity
high High risk
Affected Versions
<=3.21.2
CVE Reference
Patch Status
No patch
Source
NVD
LearnDash LMS
high
Vulnerability
LearnDash LMS — Unrestricted File Type Upload
Severity
high High risk
Affected Versions
<=5.1.5
CVE Reference
Patch Status
No patch
Source
NVD
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
high
Vulnerability
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.13.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
high
Vulnerability
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.13.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
QuickCal
high
Vulnerability
QuickCal — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.0.20
CVE Reference
Patch Status
No patch
Source
NVD
Gravity Forms
high
Vulnerability
Gravity Forms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.5
CVE Reference
Patch Status
No patch
Source
NVD
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
high
Vulnerability
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.12.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Ninja Forms – The Contact Form Builder That Grows With You
high
Vulnerability
Ninja Forms – The Contact Form Builder That Grows With You — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.15.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Welcart e-Commerce
high
Vulnerability
Welcart e-Commerce — PHP Object Injection
Severity
high High risk
Affected Versions
<=2.12.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
Spam protection, Honeypot, Anti-Spam by CleanTalk
high
Vulnerability
Spam protection, Honeypot, Anti-Spam by CleanTalk — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.86
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
W3 Total Cache
high
Vulnerability
W3 Total Cache — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
SOGO Add Script to Individual Pages Header Footer
medium
Vulnerability
SOGO Add Script to Individual Pages Header Footer — Sanitise or escape the custom header/footer script values saved from its post metabox
Severity
medium Medium risk
Affected Versions
<=3.9
CVE Reference
Patch Status
No patch
Source
NVD
WPvivid — Backup, Migration & Staging
medium
Vulnerability
WPvivid — Backup, Migration & Staging — Validate the destination of files extracted from a backup package during restoration
Severity
medium Medium risk
Affected Versions
<=0.9.133
CVE Reference
Patch Status
No patch
Source
NVD
Really Simple Security
medium
Vulnerability
Really Simple Security — Check that the user is allowed to install Really Simple Security WordPress plugin before 9
Severity
medium Medium risk
Affected Versions
<=9.8.0
CVE Reference
Patch Status
No patch
Source
NVD
爱采集数据采集和发布插件
medium
Vulnerability
爱采集数据采集和发布插件 — Restrict which of its handler methods a request may invoke
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Frontend Admin by DynamiApps
medium
Vulnerability
Frontend Admin by DynamiApps — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.29.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Live Composer – Free WordPress Website Builder
medium
Vulnerability
Live Composer – Free WordPress Website Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Live Composer – Free WordPress Website Builder
medium
Vulnerability
Live Composer – Free WordPress Website Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Shopping Cart & eCommerce Store
medium
Vulnerability
Shopping Cart & eCommerce Store — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.9.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
Persistent Login
medium
Vulnerability
Persistent Login — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.2.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
medium
Vulnerability
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Photo Gallery by Ays – Responsive Image Gallery
medium
Vulnerability
Photo Gallery by Ays – Responsive Image Gallery — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=6.8.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
LearnPress
medium
Vulnerability
LearnPress — SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
Blocksy Companion
medium
Vulnerability
Blocksy Companion — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1.51
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
medium
Vulnerability
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot
medium
Vulnerability
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
medium
Vulnerability
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.8.12.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
KiviCare
medium
Vulnerability
KiviCare — Perform authorization checks on some of its REST endpoints
Severity
medium Medium risk
Affected Versions
<=4.5.5
CVE Reference
Patch Status
No patch
Source
NVD
WP Fastest Cache
medium
Vulnerability
WP Fastest Cache — Include a set of tracking-related query parameters in its page-cache key while still caching pages r
Severity
medium Medium risk
Affected Versions
<=1.5.1
CVE Reference
Patch Status
No patch
Source
NVD
MW WP Form
medium
Vulnerability
MW WP Form — Prevent shortcodes in user-submitted values from being executed when it merges those values into a m
Severity
medium Medium risk
Affected Versions
<=5.1.5
CVE Reference
Patch Status
No patch
Source
NVD
WPBakery Page Builder
medium
Vulnerability
WPBakery Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=8.7.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
Live Composer – Free WordPress Website Builder
medium
Vulnerability
Live Composer – Free WordPress Website Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Live Composer – Free WordPress Website Builder
medium
Vulnerability
Live Composer – Free WordPress Website Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Simple Membership
medium
Vulnerability
Simple Membership — Authentication Bypass leading to Administrator Account Takeover
Severity
medium Medium risk
Affected Versions
<=4.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
WP Recipe Maker Premium
medium
Vulnerability
WP Recipe Maker Premium — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=10.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Ultimate Before After Image Slider & Gallery
medium
Vulnerability
Ultimate Before After Image Slider & Gallery — Properly escape the slider's after-label value before its bundled client-side script re-injects it i
Severity
medium Medium risk
Affected Versions
<=4.7.19
CVE Reference
Patch Status
No patch
Source
NVD
Ultimate Before After Image Slider & Gallery
medium
Vulnerability
Ultimate Before After Image Slider & Gallery — Properly escape the slider's before-label value before its bundled client-side script re-injects it
Severity
medium Medium risk
Affected Versions
<=4.7.19
CVE Reference
Patch Status
No patch
Source
NVD
Booking for Appointments and Events Calendar
medium
Vulnerability
Booking for Appointments and Events Calendar — Require authentication or a valid request token before running the post-booking action chain
Severity
medium Medium risk
Affected Versions
<=2.4.9
CVE Reference
Patch Status
No patch
Source
NVD
MotoPress Appointment Booking
medium
Vulnerability
MotoPress Appointment Booking — Perform an authorization or ownership check when handling a user-supplied booking identifier on an u
Severity
medium Medium risk
Affected Versions
<=2.4.8
CVE Reference
Patch Status
No patch
Source
NVD
Solace Extra
medium
Vulnerability
Solace Extra — Perform any authorization or post-status checks in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.7.0
CVE Reference
Patch Status
No patch
Source
NVD
Gutentor
medium
Vulnerability
Gutentor — Apply the correct context restriction to one of its REST endpoints
Severity
medium Medium risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD
Ultimate Member
medium
Vulnerability
Ultimate Member — Check whether a comment has been approved
Severity
medium Medium risk
Affected Versions
<=2.13.0
CVE Reference
Patch Status
No patch
Source
NVD
Comments
medium
Vulnerability
Comments — Validate a value used to build a database query
Severity
medium Medium risk
Affected Versions
<=7.6.66
CVE Reference
Patch Status
No patch
Source
NVD
Social Media Share Buttons & Social Sharing Icons
medium
Vulnerability
Social Media Share Buttons & Social Sharing Icons — Escape the post title before outputting it in an inline JavaScript event handler
Severity
medium Medium risk
Affected Versions
<=3.0.1
CVE Reference
Patch Status
No patch
Source
NVD
MultiVendorX
medium
Vulnerability
MultiVendorX — Have proper authorisation controls on one of its REST API listing routes
Severity
medium Medium risk
Affected Versions
<=5.0.15
CVE Reference
Patch Status
No patch
Source
NVD
GamiPress
medium
Vulnerability
GamiPress — Properly restrict its video watch-tracking functionality
Severity
medium Medium risk
Affected Versions
<=7.9.9.6
CVE Reference
Patch Status
No patch
Source
NVD
Rank Math SEO
medium
Vulnerability
Rank Math SEO — Check whether a post is password protected before using its content to build publicly generated SEO
Severity
medium Medium risk
Affected Versions
<=1.0.277.1
CVE Reference
Patch Status
No patch
Source
NVD
Rank Math SEO
medium
Vulnerability
Rank Math SEO — Verify that the metadata row being updated belongs to the object the user was authorised against
Severity
medium Medium risk
Affected Versions
<=1.0.277
CVE Reference
Patch Status
No patch
Source
NVD
FormLayer
medium
Vulnerability
FormLayer — Perform any authorization check before returning a form's full stored configuration in the response
Severity
medium Medium risk
Affected Versions
<=1.0.9
CVE Reference
Patch Status
No patch
Source
NVD
CatalogX
medium
Vulnerability
CatalogX — Sanitise or escape content that an unauthenticated user can store before including it in the product
Severity
medium Medium risk
Affected Versions
<=6.1.3
CVE Reference
Patch Status
No patch
Source
NVD
MasterStudy LMS
medium
Vulnerability
MasterStudy LMS — Properly verify authorization when retrieving order line-item data
Severity
medium Medium risk
Affected Versions
<=3.7.46
CVE Reference
Patch Status
No patch
Source
NVD
MasterStudy LMS
medium
Vulnerability
MasterStudy LMS — Perform an authorization check before returning per-student course enrollment and progress data
Severity
medium Medium risk
Affected Versions
<=3.7.46
CVE Reference
Patch Status
No patch
Source
NVD
MasterStudy LMS
medium
Vulnerability
MasterStudy LMS — Restrict access to a REST route that lists an author's courses
Severity
medium Medium risk
Affected Versions
<=3.7.46
CVE Reference
Patch Status
No patch
Source
NVD
MasterStudy LMS
medium
Vulnerability
MasterStudy LMS — Perform an authorization check before returning a student's learning statistics
Severity
medium Medium risk
Affected Versions
<=3.7.46
CVE Reference
Patch Status
No patch
Source
NVD
WC Vendors
medium
Vulnerability
WC Vendors — Have CSRF protection on some of its front-end order shipment status actions
Severity
medium Medium risk
Affected Versions
<=2.7.2.1
CVE Reference
Patch Status
No patch
Source
NVD
WC Vendors
medium
Vulnerability
WC Vendors — Verify that the vendor submitting a front-end order shipment status change owns the referenced order
Severity
medium Medium risk
Affected Versions
<=2.7.2.1
CVE Reference
Patch Status
No patch
Source
NVD
WC Vendors
medium
Vulnerability
WC Vendors — Verify ownership or the object type of user-supplied IDs when saving product variations
Severity
medium Medium risk
Affected Versions
<=2.7.2.1
CVE Reference
Patch Status
No patch
Source
NVD
JetStyleManager for Gutenberg
medium
Vulnerability
JetStyleManager for Gutenberg — Have CSRF protection on some of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.3.9
CVE Reference
Patch Status
No patch
Source
NVD
My Login
medium
Vulnerability
My Login — Enforce the network's registration setting when processing site signups on multisite installations
Severity
medium Medium risk
Affected Versions
<=7.2.0
CVE Reference
Patch Status
No patch
Source
NVD
WPvivid — Backup, Migration & Staging
medium
Vulnerability
WPvivid — Backup, Migration & Staging — Sanitise a user supplied list of identifiers before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=0.9.133
CVE Reference
Patch Status
No patch
Source
NVD
Easy Waveform Player
medium
Vulnerability
Easy Waveform Player — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
LiveJournal Shortcode
medium
Vulnerability
LiveJournal Shortcode — Validate and escape some of its shortcode attributes before outputting them back in a page/post wher
Severity
medium Medium risk
Affected Versions
<=1.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Rejected reason: This CVE ID is a duplicate of CVE-2025-13542 and was never published. Both IDs were assigned to the same unauthenticated privilege escalation vulnerability in the DesignThemes LMS
medium
Vulnerability
Rejected reason: This CVE ID is a duplicate of CVE-2025-13542 and was never published. Both IDs were assigned to the same unauthenticated privilege escalation vulnerability in the DesignThemes LMS — CVE-2025-13398
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Notification Bar for
medium
Vulnerability
Notification Bar for — CVE-2025-15481
Severity
medium Medium risk
Affected Versions
<=1.1.8
CVE Reference
Patch Status
No patch
Source
NVD
Passster
medium
Vulnerability
Passster — Handle input properly in an AJAX action
Severity
medium Medium risk
Affected Versions
<=4.2.24
CVE Reference
Patch Status
No patch
Source
NVD
Passster
medium
Vulnerability
Passster — CVE-2025-15490
Severity
medium Medium risk
Affected Versions
<=4.2.26
CVE Reference
Patch Status
No patch
Source
NVD
Wp Edit Password Protected
medium
Vulnerability
Wp Edit Password Protected — Protecting page content, but this protection can be bypassed by using the REST API
Severity
medium Medium risk
Affected Versions
<=1.3.5
CVE Reference
Patch Status
No patch
Source
NVD
Yoast SEO Premium
medium
Vulnerability
Yoast SEO Premium — Sanitize control characters from redirect origins before writing them to the site's Apache configura
Severity
medium Medium risk
Affected Versions
<=27.6.1
CVE Reference
Patch Status
No patch
Source
NVD
User Frontend
medium
Vulnerability
User Frontend — Enforce its subscription-purchase requirement when processing frontend post submissions
Severity
medium Medium risk
Affected Versions
<=4.3.11
CVE Reference
Patch Status
No patch
Source
NVD
HIPAA FORMS
medium
Vulnerability
HIPAA FORMS — Unauthenticated attackers to access protected AJAX endpoints
Severity
medium Medium risk
Affected Versions
<=3.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Ajaxify Comments
medium
Vulnerability
Ajaxify Comments — HTTP Header Injection
Severity
medium Medium risk
Affected Versions
<=3.2
CVE Reference
Patch Status
No patch
Source
NVD
RegistrationMagic
medium
Vulnerability
RegistrationMagic — Validate the total price of a paid registration server-side
Severity
medium Medium risk
Affected Versions
<=6.0.9.9
CVE Reference
Patch Status
No patch
Source
NVD
RegistrationMagic
medium
Vulnerability
RegistrationMagic — Validate a client-supplied quantity multiplier when calculating the total price of a paid registrati
Severity
medium Medium risk
Affected Versions
<=6.0.9.9
CVE Reference
Patch Status
No patch
Source
NVD
Restrict User Access
medium
Vulnerability
Restrict User Access — Normalise the REST API route before checking it against the routes its content protection covers
Severity
medium Medium risk
Affected Versions
<=2.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Brave
medium
Vulnerability
Brave — Prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode eng
Severity
medium Medium risk
Affected Versions
<=0.8.8
CVE Reference
Patch Status
No patch
Source
NVD
All in One SEO
medium
Vulnerability
All in One SEO — Sanitise and escape some content stored in posts before rendering it back in the post editor
Severity
medium Medium risk
Affected Versions
<=5.0.0.1
CVE Reference
Patch Status
No patch
Source
NVD
WP Express Checkout
medium
Vulnerability
WP Express Checkout — Verify server-side that a payment was actually completed before marking an order as paid
Severity
medium Medium risk
Affected Versions
<=2.4.9
CVE Reference
Patch Status
No patch
Source
NVD
Xpro Addons
medium
Vulnerability
Xpro Addons — Properly escape some of its widgets' settings before outputting them within HTML attributes
Severity
medium Medium risk
Affected Versions
<=1.7.4
CVE Reference
Patch Status
No patch
Source
NVD
Simple Membership MailChimp Integration
medium
Vulnerability
Simple Membership MailChimp Integration — Have CSRF checks in its settings page
Severity
medium Medium risk
Affected Versions
<=1.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
medium
Vulnerability
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD
MountDev AI MCP Connector
medium
Vulnerability
MountDev AI MCP Connector — CVE-2026-85306
Severity
medium Medium risk
Affected Versions
<=1.6.5
CVE Reference
Patch Status
No patch
Source
NVD
LearnPress
medium
Vulnerability
LearnPress — Authenticated attackers with the Instructor role to add answers to quiz questions owned by other ins
Severity
medium Medium risk
Affected Versions
<=4.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
LearnPress
medium
Vulnerability
LearnPress — Authenticated attackers with the Instructor role to inject persistent malicious payloads by submitti
Severity
medium Medium risk
Affected Versions
<=4.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
WPFunnels
medium
Vulnerability
WPFunnels — Check whether user registration is enabled on the site before creating accounts from opt-in form sub
Severity
medium Medium risk
Affected Versions
<=3.13.0
CVE Reference
Patch Status
No patch
Source
NVD
Content Views
medium
Vulnerability
Content Views — Check whether the user requesting a view is allowed to read the posts it returns
Severity
medium Medium risk
Affected Versions
<=4.5.1.2
CVE Reference
Patch Status
No patch
Source
NVD
Pods
medium
Vulnerability
Pods — Restrict which functions a display callback may resolve to
Severity
medium Medium risk
Affected Versions
<=3.3.9.2
CVE Reference
Patch Status
No patch
Source
NVD
WPFunnels
medium
Vulnerability
WPFunnels — Verify that the product requested through a checkout order bump is the product that bump's discount
Severity
medium Medium risk
Affected Versions
<=3.13.0
CVE Reference
Patch Status
No patch
Source
NVD
WPFunnels
medium
Vulnerability
WPFunnels — Restrict access to the log files it writes to a predictable location under the public uploads direct
Severity
medium Medium risk
Affected Versions
<=3.13.0
CVE Reference
Patch Status
No patch
Source
NVD
WPFunnels
medium
Vulnerability
WPFunnels — Perform any authorisation or nonce check in one of its opt-in submission handlers
Severity
medium Medium risk
Affected Versions
<=3.13.0
CVE Reference
Patch Status
No patch
Source
NVD
Ninja Forms
medium
Vulnerability
Ninja Forms — Restrict its REST abilities to administrators
Severity
medium Medium risk
Affected Versions
<=3.15.2
CVE Reference
Patch Status
No patch
Source
NVD
Frontend Admin by DynamiApps
medium
Vulnerability
Frontend Admin by DynamiApps — Properly validate a user-controllable directory path before deleting files within it
Severity
medium Medium risk
Affected Versions
<=3.29.13
CVE Reference
Patch Status
No patch
Source
NVD
WPLP Cookie Consent
medium
Vulnerability
WPLP Cookie Consent — Properly validate a pagination parameter before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD
WPvivid — Backup, Migration & Staging
medium
Vulnerability
WPvivid — Backup, Migration & Staging — Validate a user supplied file name before using it to build a write path
Severity
medium Medium risk
Affected Versions
<=0.9.134
CVE Reference
Patch Status
No patch
Source
NVD
WPvivid — Backup, Migration & Staging
medium
Vulnerability
WPvivid — Backup, Migration & Staging — Validate a user supplied path before using it in a file deletion routine
Severity
medium Medium risk
Affected Versions
<=0.9.134
CVE Reference
Patch Status
No patch
Source
NVD
Xpro Addons — 140+ Widgets for Elementor
medium
Vulnerability
Xpro Addons — 140+ Widgets for Elementor — Perform any capability or post-status check before rendering a WooCommerce product summary from a su
Severity
medium Medium risk
Affected Versions
<=1.7.8
CVE Reference
Patch Status
No patch
Source
NVD
ePayco Payment Gateway for WooCommerce
medium
Vulnerability
ePayco Payment Gateway for WooCommerce — Properly verify the authenticity of payment confirmation requests
Severity
medium Medium risk
Affected Versions
<=8.4.7
CVE Reference
Patch Status
No patch
Source
NVD
Restaurant Menu and Food Ordering
medium
Vulnerability
Restaurant Menu and Food Ordering — Verify that a PayPal payment notification genuinely originates from PayPal
Severity
medium Medium risk
Affected Versions
<=2.4.12
CVE Reference
Patch Status
No patch
Source
NVD
E-cab Taxi Booking Manager for Woocommerce
medium
Vulnerability
E-cab Taxi Booking Manager for Woocommerce — Validate a client-supplied trip distance and base-price value on the server before pricing a booking
Severity
medium Medium risk
Affected Versions
<=2.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Events Manager - Calendar, Bookings, Tickets, and more!
medium
Vulnerability
Events Manager - Calendar, Bookings, Tickets, and more! — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.3.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Social Chat – Click To Chat App Button
medium
Vulnerability
Social Chat – Click To Chat App Button — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=8.6.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Theme My Login
medium
Vulnerability
Theme My Login — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=7.1.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
medium
Vulnerability
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.4.30
CVE Reference
Patch Status
No patch
Source
NVD
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
medium
Vulnerability
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.4.30
CVE Reference
Patch Status
No patch
Source
NVD
JCH Optimize
medium
Vulnerability
JCH Optimize — Properly restrict a directory path provided to one of its administrative image-browsing features to
Severity
medium Medium risk
Affected Versions
<=5.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Joli Table Of Contents
medium
Vulnerability
Joli Table Of Contents — Sanitise and escape some of its settings before outputting them in an admin page
Severity
medium Medium risk
Affected Versions
<=2.8.1
CVE Reference
Patch Status
No patch
Source
NVD
WP File Download
medium
Vulnerability
WP File Download — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=6.3.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Search Atlas SEO
medium
Vulnerability
Search Atlas SEO — Perform a nonce or capability check before processing a settings update in one of its early-priority
Severity
medium Medium risk
Affected Versions
<=2.6.24
CVE Reference
Patch Status
No patch
Source
NVD
Beaver Builder Plugin (Starter Version)
medium
Vulnerability
Beaver Builder Plugin (Starter Version) — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.11.0.1
CVE Reference
Patch Status
No patch
Source
NVD
JetFormBuilder — Dynamic Blocks Form Builder
medium
Vulnerability
JetFormBuilder — Dynamic Blocks Form Builder — Perform authorisation checks when resolving request-derived data during page rendering
Severity
medium Medium risk
Affected Versions
<=3.6.5.2
CVE Reference
Patch Status
No patch
Source
NVD
JetFormBuilder — Dynamic Blocks Form Builder
medium
Vulnerability
JetFormBuilder — Dynamic Blocks Form Builder — Properly sanitise and escape a form field's value before including it in the HTML notification email
Severity
medium Medium risk
Affected Versions
<=3.6.5.2
CVE Reference
Patch Status
No patch
Source
NVD
RegistrationMagic
medium
Vulnerability
RegistrationMagic — Verify which application a Facebook access token was issued to before accepting it as proof of ident
Severity
medium Medium risk
Affected Versions
<=6.0.9.9
CVE Reference
Patch Status
No patch
Source
NVD
Smart Post
medium
Vulnerability
Smart Post — Check whether a post is password protected before returning its content and its stored password thro
Severity
medium Medium risk
Affected Versions
<=4.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Smart Post
medium
Vulnerability
Smart Post — Check the type
Severity
medium Medium risk
Affected Versions
<=4.0.8
CVE Reference
Patch Status
No patch
Source
NVD
SEO Flow by LupsOnline
medium
Vulnerability
SEO Flow by LupsOnline — Correctly validate the credential supplied with its API requests
Severity
medium Medium risk
Affected Versions
<=3.0.3
CVE Reference
Patch Status
No patch
Source
NVD
My Private Site
medium
Vulnerability
My Private Site — Apply its site-privacy access control to certain unauthenticated front-end read surfaces
Severity
medium Medium risk
Affected Versions
<=4.2.3
CVE Reference
Patch Status
No patch
Source
NVD
IPGP Visitors Origin
medium
Vulnerability
IPGP Visitors Origin — Sanitise or escape user input before reflecting it back in the HTTP response
Severity
medium Medium risk
Affected Versions
<=1.6
CVE Reference
Patch Status
No patch
Source
NVD
Accept Stripe Payments
medium
Vulnerability
Accept Stripe Payments — Validate a user-supplied URL before using it in a redirect
Severity
medium Medium risk
Affected Versions
<=2.1.4
CVE Reference
Patch Status
No patch
Source
NVD
Accept Stripe Payments
medium
Vulnerability
Accept Stripe Payments — Verify that the product fulfilled when a checkout is completed matches the product the authoritative
Severity
medium Medium risk
Affected Versions
<=2.1.4
CVE Reference
Patch Status
No patch
Source
NVD
Music Store
medium
Vulnerability
Music Store — Sanitise and escape user input before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=1.4.5
CVE Reference
Patch Status
No patch
Source
NVD
Masteriyo LMS
medium
Vulnerability
Masteriyo LMS — Sanitise and escape some course settings before outputting them in a page available to all visitors
Severity
medium Medium risk
Affected Versions
<=3.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Greenshift
medium
Vulnerability
Greenshift — Validate a user-supplied URL before fetching it server-side
Severity
medium Medium risk
Affected Versions
<=13.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Greenshift
medium
Vulnerability
Greenshift — Properly escape a block animation attribute before outputting it within an HTML attribute
Severity
medium Medium risk
Affected Versions
<=13.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Bold Page Builder
medium
Vulnerability
Bold Page Builder — Properly validate a link URL before outputting it in an HTML attribute
Severity
medium Medium risk
Affected Versions
<=5.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Bold Page Builder
medium
Vulnerability
Bold Page Builder — Sanitise and escape several shortcode attributes before outputting them in HTML attributes
Severity
medium Medium risk
Affected Versions
<=5.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Kirki
medium
Vulnerability
Kirki — Escape a user-supplied identifier before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=6.3.0
CVE Reference
Patch Status
No patch
Source
NVD
Kirki
medium
Vulnerability
Kirki — Check that a user is allowed to act on a collaboration comment before changing its state
Severity
medium Medium risk
Affected Versions
<=6.3.0
CVE Reference
Patch Status
No patch
Source
NVD
Events Calendar
medium
Vulnerability
Events Calendar — Restrict non-public content to the users entitled to read it on its public REST archives
Severity
medium Medium risk
Affected Versions
<=6.17.3.1
CVE Reference
Patch Status
No patch
Source
NVD
King Addons for Elementor
medium
Vulnerability
King Addons for Elementor — Escape a widget display-style setting before outputting it in an HTML attribute
Severity
medium Medium risk
Affected Versions
<=51.1.77
CVE Reference
Patch Status
No patch
Source
NVD
Eventin
medium
Vulnerability
Eventin — Properly validate a template path value before using it to include a local file
Severity
medium Medium risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD
VikWidgetsLoader
medium
Vulnerability
VikWidgetsLoader — Sanitise or escape a block attribute before outputting it inside an inline script
Severity
medium Medium risk
Affected Versions
<=1.12.0
CVE Reference
Patch Status
No patch
Source
NVD
Eventin
medium
Vulnerability
Eventin — Properly check authorization on several of its event-management REST routes
Severity
medium Medium risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD
EmbedPress
medium
Vulnerability
EmbedPress — Correctly restrict access to one of its Google Reviews REST routes to administrators
Severity
medium Medium risk
Affected Versions
<=4.6.4
CVE Reference
Patch Status
No patch
Source
NVD
EmbedPress
medium
Vulnerability
EmbedPress — Perform a sufficient authorization check on one of its Google Reviews REST API routes
Severity
medium Medium risk
Affected Versions
<=4.6.4
CVE Reference
Patch Status
No patch
Source
NVD
CatFolders Document Gallery & PDF Library
medium
Vulnerability
CatFolders Document Gallery & PDF Library — Properly validate a block attribute before using it as an HTML tag name in its gallery output
Severity
medium Medium risk
Affected Versions
<=2.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Joli Table Of Contents
medium
Vulnerability
Joli Table Of Contents — Sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribu
Severity
medium Medium risk
Affected Versions
<=3.0.3
CVE Reference
Patch Status
No patch
Source
NVD
JCH Optimize
medium
Vulnerability
JCH Optimize — Perform a capability check on one of its authenticated AJAX actions and lets the request choose whic
Severity
medium Medium risk
Affected Versions
<=6.0.1
CVE Reference
Patch Status
No patch
Source
NVD
HT Menu
medium
Vulnerability
HT Menu — Perform any capability or object-ownership check when saving navigation menu-item settings
Severity
medium Medium risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD
EmbedPress
medium
Vulnerability
EmbedPress — Have proper authorization on a public review-loading action
Severity
medium Medium risk
Affected Versions
<=4.6.4
CVE Reference
Patch Status
No patch
Source
NVD
Video Player for YouTube
medium
Vulnerability
Video Player for YouTube — Properly sanitise and escape user-supplied input before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD
MW WP Form
low
Vulnerability
MW WP Form — Sanitise and escape some of its form settings before outputting them back in an admin dashboard page
Severity
low Low risk
Affected Versions
<=5.1.6
CVE Reference
Patch Status
No patch
Source
NVD
Rank Math SEO
low
Vulnerability
Rank Math SEO — Verify that the post whose schema it renders on the front end is publicly viewable
Severity
low Low risk
Affected Versions
<=1.0.277
CVE Reference
Patch Status
No patch
Source
NVD
Rank Math SEO
low
Vulnerability
Rank Math SEO — Verify that a user is allowed to edit the object being modified before updating its SEO indexing met
Severity
low Low risk
Affected Versions
<=1.0.277
CVE Reference
Patch Status
No patch
Source
NVD
Rank Math SEO
low
Vulnerability
Rank Math SEO — Verify that the requesting user is permitted to read the specific post referenced in a request befor
Severity
low Low risk
Affected Versions
<=1.0.277
CVE Reference
Patch Status
No patch
Source
NVD
Rank Math SEO
low
Vulnerability
Rank Math SEO — Perform a capability check when bulk metadata updates target taxonomy terms
Severity
low Low risk
Affected Versions
<=1.0.277
CVE Reference
Patch Status
No patch
Source
NVD
MasterStudy LMS
low
Vulnerability
MasterStudy LMS — Properly verify ownership of quiz question identifiers
Severity
low Low risk
Affected Versions
<=3.7.46
CVE Reference
Patch Status
No patch
Source
NVD
MasterStudy LMS
low
Vulnerability
MasterStudy LMS — Properly verify ownership of a curriculum object before acting on it
Severity
low Low risk
Affected Versions
<=3.7.46
CVE Reference
Patch Status
No patch
Source
NVD
Weaver Show Posts
low
Vulnerability
Weaver Show Posts — CVE-2023-3360
Severity
low Low risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Icegram Express
low
Vulnerability
Icegram Express — Properly escape a list description setting before outputting it within an HTML attribute
Severity
low Low risk
Affected Versions
<=5.8.6
CVE Reference
Patch Status
No patch
Source
NVD
Timetics
low
Vulnerability
Timetics — Enforce per-object ownership when updating appointments through its REST API
Severity
low Low risk
Affected Versions
<=1.0.61
CVE Reference
Patch Status
No patch
Source
NVD
GutenKit
low
Vulnerability
GutenKit — Validate or escape style settings saved against a post before using them to build the CSS it outputs
Severity
low Low risk
Affected Versions
<=2.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Directorist: AI-Powered Business Directory, Listings & Classified Ads
low
Vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads — Verify that the requesting user owns the post being modified before writing uploaded file references
Severity
low Low risk
Affected Versions
<=8.9
CVE Reference
Patch Status
No patch
Source
NVD
WordPress Theme Vulnerabilities (7)
Nokri - Job Board WordPress
critical
Vulnerability
Nokri - Job Board WordPress — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=1.6.6
CVE Reference
Patch Status
No patch
Source
NVD
Divi
medium
Vulnerability
Divi — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.27.6
CVE Reference
Patch Status
No patch
Source
NVD
Divi
medium
Vulnerability
Divi — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.27.6
CVE Reference
Patch Status
No patch
Source
NVD
Divi
medium
Vulnerability
Divi — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.27.6
CVE Reference
Patch Status
No patch
Source
NVD
WPKoi Templates for Elementor
medium
Vulnerability
WPKoi Templates for Elementor — CVE-2026-85302
Severity
medium Medium risk
Affected Versions
<=3.7.2
CVE Reference
Patch Status
No patch
Source
NVD
Divi
medium
Vulnerability
Divi — DOM-Based Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.27.6
CVE Reference
Patch Status
No patch
Source
NVD
Divi
medium
Vulnerability
Divi — Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=4.27.6
CVE Reference
Patch Status
No patch
Source
NVD
WordPress Core Vulnerabilities (0)
No vulnerabilities reported in this category this week.
Recommendations
1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.
Set up uptime monitoring and periodic security scans to catch issues early.
Methodology
This report is compiled automatically from multiple trusted sources:
NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans
Tags
Related Posts
Vulnerability Report
WordPress Vulnerability Report: August 28 – September 4, 2026
190 WordPress vulnerabilities disclosed between August 28 – September 4, 2026. 17 critical, 40 high severity. 0 patched, 190 unpatched.
WPSentry·Sep 4, 2026
Vulnerability Report
WordPress Vulnerability Report: August 27 – September 3, 2026
177 WordPress vulnerabilities disclosed between August 27 – September 3, 2026. 15 critical, 45 high severity. 0 patched, 177 unpatched.
WPSentry·Sep 3, 2026
Vulnerability Report
WordPress Vulnerability Report: August 26 – September 2, 2026
177 WordPress vulnerabilities disclosed between August 26 – September 2, 2026. 14 critical, 44 high severity. 0 patched, 177 unpatched.
WPSentry·Sep 2, 2026