During the reporting period (August 6 – August 13, 2026), 221 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.
Summary
221
Total
19
Critical
63
High
131
Medium
8
Low
8
Patched
Table of Contents 226 plugins & components
WordPress Plugin Vulnerabilities (213)
Premium SEO
critical
Vulnerability
Premium SEO — CVE-2026-14812
Severity
critical Critical risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
TrueBooker – Appointment Booking and Scheduler System
critical
Vulnerability
TrueBooker – Appointment Booking and Scheduler System — Account takeover
Severity
critical Critical risk
Affected Versions
<=1.2.3
CVE Reference
Patch Status
No patch
Source
NVD
TrueBooker – Appointment Booking and Scheduler System
critical
Vulnerability
TrueBooker – Appointment Booking and Scheduler System — Authorization bypass
Severity
critical Critical risk
Affected Versions
<=1.2.3
CVE Reference
Patch Status
No patch
Source
NVD
WP Events Manager
critical
Vulnerability
WP Events Manager — Validate the requested quantity when registering for a paid event and computes the price from the at
Severity
critical Critical risk
Affected Versions
<=2.2.5
CVE Reference
Patch Status
No patch
Source
NVD
MStore API
critical
Vulnerability
MStore API — Verify the payment with the payment gateway before marking an order as paid on several of its paymen
Severity
critical Critical risk
Affected Versions
<=4.21.0
CVE Reference
Patch Status
No patch
Source
NVD
Ajax Search Lite
critical
Vulnerability
Ajax Search Lite — Prevent the deserialization of untrusted input
Severity
critical Critical risk
Affected Versions
<=4.14.5
CVE Reference
Patch Status
No patch
Source
NVD
AI Copilot – Content Generator
critical
Vulnerability
AI Copilot – Content Generator — Authorization bypass
Severity
critical Critical risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
InfiniteWP Client
critical
Vulnerability
InfiniteWP Client — Properly verify the site-connection state and the authenticity of requests to its remote-management
Severity
critical Critical risk
Affected Versions
<=1.13.6
CVE Reference
Patch Status
No patch
Source
NVD
WP Directory Kit
critical
Vulnerability
WP Directory Kit — Properly sanitise and escape a parameter before using it in a SQL statement
Severity
critical Critical risk
Affected Versions
<=1.5.5
CVE Reference
Patch Status
No patch
Source
NVD
FoodBoxBooker
critical
Vulnerability
FoodBoxBooker — Properly validate the password reset request
Severity
critical Critical risk
Affected Versions
<=1.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Single Sign On For TNG
critical
Vulnerability
Single Sign On For TNG — Properly validate a password reset request
Severity
critical Critical risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD
ProSolution WP Client
critical
Vulnerability
ProSolution WP Client — Sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visi
Severity
critical Critical risk
Affected Versions
<=2.0.6
CVE Reference
Patch Status
No patch
Source
NVD
Product Input Fields for WooCommerce
critical
Vulnerability
Product Input Fields for WooCommerce — Validate uploaded file types when its accepted-types setting is left empty
Severity
critical Critical risk
Affected Versions
<=2.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Formidable Digital Signatures
critical
Vulnerability
Formidable Digital Signatures — File deletion
Severity
critical Critical risk
Affected Versions
<=3.0.6
CVE Reference
Patch Status
No patch
Source
NVD
giftware
critical
Vulnerability
giftware — Validate the type of uploaded files in one of its upload paths
Severity
critical Critical risk
Affected Versions
<=4.2.10
CVE Reference
Patch Status
No patch
Source
NVD
wpmudev-updates
critical
Vulnerability
wpmudev-updates — Verify the integrity of the packages installed through its remote management interface
Severity
critical Critical risk
Affected Versions
<=5.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Wallet for WooCommerce
critical
Vulnerability
Wallet for WooCommerce — Verify the amount actually collected for a wallet top-up before crediting the wallet
Severity
critical Critical risk
Affected Versions
<=1.6.10
CVE Reference
Patch Status
No patch
Source
NVD
Events Manager
critical
Vulnerability
Events Manager — Properly scope its capability mapping
Severity
critical Critical risk
Affected Versions
<=7.4.1
CVE Reference
Patch Status
No patch
Source
NVD
WooCommerce Subscriptions
critical
Vulnerability
WooCommerce Subscriptions — Validate user input before unserializing it on stores with High-Performance Order Storage enabled
Severity
critical Critical risk
Affected Versions
<=9.1.0
CVE Reference
Patch Status
No patch
Source
NVD
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
high
Vulnerability
AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
Severity
high High risk
Affected Versions
<=10.11.1
CVE Reference
Patch Status
11.0.0
Source
Wordfence
Plugin Page
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
high
Vulnerability
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.9.2
CVE Reference
Patch Status
No patch
Source
NVD
Creative Mail
high
Vulnerability
Creative Mail — Sanitize and escape a parameter before using in an SQL statement
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
CoCart
high
Vulnerability
CoCart — Validate a user-supplied price value against the actual product price when items are added to the ca
Severity
high High risk
Affected Versions
<=4.9.0
CVE Reference
Patch Status
No patch
Source
NVD
Integrate PhonePe with WooCommerce
high
Vulnerability
Integrate PhonePe with WooCommerce — Validate that a verified payment transaction belongs to the order being marked as paid
Severity
high High risk
Affected Versions
<=1.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Payment Gateway for Redsys & WooCommerce Lite
high
Vulnerability
Payment Gateway for Redsys & WooCommerce Lite — Verify the authenticity of incoming payment-provider notifications for one of its payment methods be
Severity
high High risk
Affected Versions
<=7.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Payment Plugins for PayPal WooCommerce
high
Vulnerability
Payment Plugins for PayPal WooCommerce — Have proper authorization checks on a REST endpoint
Severity
high High risk
Affected Versions
<=2.0.20
CVE Reference
Patch Status
No patch
Source
NVD
miniOrange 2FA
high
Vulnerability
miniOrange 2FA — Correctly limit the number of second-factor verification attempts
Severity
high High risk
Affected Versions
<=6.2.8
CVE Reference
Patch Status
No patch
Source
NVD
WPC Name Your Price for WooCommerce
high
Vulnerability
WPC Name Your Price for WooCommerce — Enforce its server-side price allowlist for products configured in "Select" price mode
Severity
high High risk
Affected Versions
<=2.2.5
CVE Reference
Patch Status
No patch
Source
NVD
Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content
high
Vulnerability
Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content — Restrict REST API access to authenticated users when a specific option is enabled
Severity
high High risk
Affected Versions
<=2.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Subscriptions for WooCommerce
high
Vulnerability
Subscriptions for WooCommerce — Verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPr
Severity
high High risk
Affected Versions
<=2.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Content Views
high
Vulnerability
Content Views — Perform a capability check on one of its AJAX actions and does not properly sanitise attacker-suppli
Severity
high High risk
Affected Versions
<=4.5
CVE Reference
Patch Status
No patch
Source
NVD
MStore API
high
Vulnerability
MStore API — Correctly verify the cryptographic signature of the token used to authenticate its phone-based login
Severity
high High risk
Affected Versions
<=4.21.0
CVE Reference
Patch Status
No patch
Source
NVD
MStore API
high
Vulnerability
MStore API — Perform authorization or purchase-ownership checks on its REST product-review creation route
Severity
high High risk
Affected Versions
<=4.21.0
CVE Reference
Patch Status
No patch
Source
NVD
Estatik Real Estate Plugin
high
Vulnerability
Estatik Real Estate Plugin — Bind its OAuth social login flow to the initiating user session
Severity
high High risk
Affected Versions
<=4.3.3
CVE Reference
Patch Status
No patch
Source
NVD
WP Maps
high
Vulnerability
WP Maps — Perform a capability check in one of its AJAX actions and does not properly validate a user-controll
Severity
high High risk
Affected Versions
<=4.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Newsletters
high
Vulnerability
Newsletters — Restrict the classes allowed when unserialising a value taken from a public form submission
Severity
high High risk
Affected Versions
<=4.16
CVE Reference
Patch Status
No patch
Source
NVD
Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
high
Vulnerability
Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection — Perform any capability check on one of its REST API endpoints
Severity
high High risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD
WP Directory Kit
high
Vulnerability
WP Directory Kit — Sanitize and escape a parameter before using it in a SQL statement through one of its authenticated
Severity
high High risk
Affected Versions
<=1.5.5
CVE Reference
Patch Status
No patch
Source
NVD
WP Directory Kit
high
Vulnerability
WP Directory Kit — Perform authorization or nonce checks on one of its authenticated AJAX actions
Severity
high High risk
Affected Versions
<=1.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Solace Extra
high
Vulnerability
Solace Extra — Perform capability checks in several of its AJAX actions and exposes the nonce that protects them on
Severity
high High risk
Affected Versions
<=1.6.1
CVE Reference
Patch Status
No patch
Source
NVD
GeoDirectory
high
Vulnerability
GeoDirectory — Perform any authorization check when returning map marker data for a single requested listing
Severity
high High risk
Affected Versions
<=2.8.169
CVE Reference
Patch Status
No patch
Source
NVD
CubeWP Framework
high
Vulnerability
CubeWP Framework — Properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action
Severity
high High risk
Affected Versions
<=1.1.31
CVE Reference
Patch Status
No patch
Source
NVD
Iptanus File Upload
high
Vulnerability
Iptanus File Upload — Properly sanitise and escape a parameter before using it in a SQL statement
Severity
high High risk
Affected Versions
<=5.1.8
CVE Reference
Patch Status
No patch
Source
NVD
WP Data Access
high
Vulnerability
WP Data Access — Validate the column names it accepts on one of its unauthenticated AJAX actions
Severity
high High risk
Affected Versions
<=5.5.79
CVE Reference
Patch Status
No patch
Source
NVD
WPC Order Tip for WooCommerce
high
Vulnerability
WPC Order Tip for WooCommerce — Perform authorisation or nonce checks in one of its reporting features
Severity
high High risk
Affected Versions
<=3.3.1
CVE Reference
Patch Status
No patch
Source
NVD
WP MAPS PRO
high
Vulnerability
WP MAPS PRO — Perform a capability check in one of its AJAX actions
Severity
high High risk
Affected Versions
<=6.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Eventin
high
Vulnerability
Eventin — Properly validate a template path setting before using it to include a local file
Severity
high High risk
Affected Versions
<=4.1.20
CVE Reference
Patch Status
No patch
Source
NVD
AutoNetTV Relay
high
Vulnerability
AutoNetTV Relay — Perform any capability or authentication check before setting a WordPress administrator authenticati
Severity
high High risk
Affected Versions
<=3.0.14
CVE Reference
Patch Status
No patch
Source
NVD
HT Contact Form
high
Vulnerability
HT Contact Form — Perform any authorization check on the endpoint that returns a saved form draft
Severity
high High risk
Affected Versions
<=2.9.3
CVE Reference
Patch Status
No patch
Source
NVD
vitepos
high
Vulnerability
vitepos — CVE-2026-14237
Severity
high High risk
Affected Versions
<=3.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Autopay
high
Vulnerability
Autopay — Perform any capability or nonce check before saving a styling option from a public request
Severity
high High risk
Affected Versions
<=5.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Arvow AI SEO Writer
high
Vulnerability
Arvow AI SEO Writer — Properly restrict access to one of its REST endpoints
Severity
high High risk
Affected Versions
<=1.5.4
CVE Reference
Patch Status
No patch
Source
NVD
Squeeze
high
Vulnerability
Squeeze — Validate the file type or extension of the per-size image data written by one of its attachment-upda
Severity
high High risk
Affected Versions
<=1.7.12
CVE Reference
Patch Status
No patch
Source
NVD
Salon Booking System
high
Vulnerability
Salon Booking System — Properly validate a booking's ownership token before loading it in its booking-wizard confirmation s
Severity
high High risk
Affected Versions
<=10.30.33
CVE Reference
Patch Status
No patch
Source
NVD
File Manager
high
Vulnerability
File Manager — Properly authorise its file management commands
Severity
high High risk
Affected Versions
<=6.9.1
CVE Reference
Patch Status
No patch
Source
NVD
File Manager
high
Vulnerability
File Manager — Have authorisation checks on one of its REST API routes
Severity
high High risk
Affected Versions
<=6.9.1
CVE Reference
Patch Status
No patch
Source
NVD
File Manager
high
Vulnerability
File Manager — Perform any capability check on one of its file manager connector endpoints
Severity
high High risk
Affected Versions
<=6.9.1
CVE Reference
Patch Status
No patch
Source
NVD
BricksForge
high
Vulnerability
BricksForge — Verify the identity of the requester when processing a password change submitted through one of its
Severity
high High risk
Affected Versions
<=3.1.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Login & Register Forms
high
Vulnerability
Login & Register Forms — Bind the password reset verification state to the account being reset or to the party that completed
Severity
high High risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Login & Register Forms
high
Vulnerability
Login & Register Forms — Enforce its password reset attempt limit against a server-derived value
Severity
high High risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Login & Register Forms
high
Vulnerability
Login & Register Forms — Verify that a password reset request comes from the account's owner
Severity
high High risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD
CheckView
high
Vulnerability
CheckView — Restrict its REST API authentication filter to its own routes and unconditionally discards the authe
Severity
high High risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Contact Form to Any API
high
Vulnerability
Contact Form to Any API — Use a random filename when copying files uploaded through contact forms into a publicly accessible d
Severity
high High risk
Affected Versions
<=3.0.7
CVE Reference
Patch Status
No patch
Source
NVD
ProSolution WP Client
high
Vulnerability
ProSolution WP Client — Sanitise a cookie value before using it in SQL queries
Severity
high High risk
Affected Versions
<=2.0.9
CVE Reference
Patch Status
No patch
Source
NVD
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
high
Vulnerability
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress — Authorization bypass
Severity
high High risk
Affected Versions
<=10.11.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
InstaWP Connect – 1-click WP Staging & Migration
high
Vulnerability
InstaWP Connect – 1-click WP Staging & Migration — Remote Code Execution
Severity
high High risk
Affected Versions
<=0.1.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
high
Vulnerability
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=2.8.169
CVE Reference
Patch Status
No patch
Source
NVD
Frontend Admin by DynamiApps
high
Vulnerability
Frontend Admin by DynamiApps — Authorization bypass
Severity
high High risk
Affected Versions
<=3.29.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect
high
Vulnerability
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect — Authentication Bypass
Severity
high High risk
Affected Versions
<=1.4.3
CVE Reference
Patch Status
No patch
Source
NVD
Eventin
high
Vulnerability
Eventin — Perform an authorization check on its waiting-list registration handler
Severity
high High risk
Affected Versions
<=4.1.20
CVE Reference
Patch Status
No patch
Source
NVD
KiviCare
high
Vulnerability
KiviCare — Properly sanitise and escape user-supplied parameters before using them in a SQL query
Severity
high High risk
Affected Versions
<=4.5.2
CVE Reference
Patch Status
No patch
Source
NVD
Import WP
high
Vulnerability
Import WP — Perform any authorization check on one of its export-file download handlers
Severity
high High risk
Affected Versions
<=2.14.23
CVE Reference
Patch Status
No patch
Source
NVD
Total Upkeep
high
Vulnerability
Total Upkeep — Adequately protect the secret that authorizes its backup-restore functionality and exposes it to una
Severity
high High risk
Affected Versions
<=1.17.3
CVE Reference
Patch Status
No patch
Source
NVD
PowerPress Podcasting plugin by Blubrry
high
Vulnerability
PowerPress Podcasting plugin by Blubrry — Validate one of its Podcast Episode URL settings before performing a server-side request with it
Severity
high High risk
Affected Versions
<=11.17.1
CVE Reference
Patch Status
No patch
Source
NVD
Form Maker by 10Web
high
Vulnerability
Form Maker by 10Web — Properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for
Severity
high High risk
Affected Versions
<=1.15.45
CVE Reference
Patch Status
No patch
Source
NVD
WP Photo Album Plus
high
Vulnerability
WP Photo Album Plus — Validate a client-controlled value used to build a file path in one of its public endpoint actions
Severity
high High risk
Affected Versions
<=9.2.07.002
CVE Reference
Patch Status
No patch
Source
NVD
WP Photo Album Plus
high
Vulnerability
WP Photo Album Plus — Perform any capability or nonce check on one of its public endpoint actions and builds an option nam
Severity
high High risk
Affected Versions
<=9.2.07.002
CVE Reference
Patch Status
No patch
Source
NVD
Events Manager
high
Vulnerability
Events Manager — Sanitise and escape a user-controlled value before using it in a SQL statement
Severity
high High risk
Affected Versions
<=7.4.1
CVE Reference
Patch Status
No patch
Source
NVD
WP Directory Kit
high
Vulnerability
WP Directory Kit — Sanitise and escape a parameter before using it in a SQL statement through one of its authenticated
Severity
high High risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD
WP Directory Kit
high
Vulnerability
WP Directory Kit — Sanitise and escape a parameter before using it in a SQL statement
Severity
high High risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD
Ezoic
high
Vulnerability
Ezoic — Properly restrict access to some of its content export functionality
Severity
high High risk
Affected Versions
<=2.23.1
CVE Reference
Patch Status
No patch
Source
NVD
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
high
Vulnerability
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Prime Slider Addons for Elementor – Widgets, Templates & Elementor Addons
medium
Vulnerability
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
Severity
medium Medium risk
Affected Versions
<=4.4.5
CVE Reference
N/A
Patch Status
No patch
Source
Wordfence
Plugin Page
Smart Admin Assistant – Dashboard and Site Enhancements
medium
Vulnerability
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
Severity
medium Medium risk
Affected Versions
<=2.2.0
CVE Reference
N/A
Patch Status
No patch
Source
Wordfence
Plugin Page
Ultimate Post Kit Addons for Elementor
medium
Vulnerability
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
Severity
medium Medium risk
Affected Versions
<=4.2.0
CVE Reference
N/A
Patch Status
No patch
Source
Wordfence
Plugin Page
Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery
medium
Vulnerability
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
Severity
medium Medium risk
Affected Versions
<=2.1.14
CVE Reference
N/A
Patch Status
No patch
Source
Wordfence
Plugin Page
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator
medium
Vulnerability
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
Severity
medium Medium risk
Affected Versions
<=1.5.4
CVE Reference
N/A
Patch Status
No patch
Source
Wordfence
Plugin Page
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons
medium
Vulnerability
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
Severity
medium Medium risk
Affected Versions
<=8.7.14
CVE Reference
N/A
Patch Status
No patch
Source
Wordfence
Plugin Page
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor
medium
Vulnerability
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
Severity
medium Medium risk
Affected Versions
<=3.0.7
CVE Reference
N/A
Patch Status
No patch
Source
Wordfence
Plugin Page
Ad Inserter – Ad Manager & AdSense Ads
medium
Vulnerability
Ad Inserter – Ad Manager & AdSense Ads — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.8.16
CVE Reference
Patch Status
No patch
Source
NVD
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
medium
Vulnerability
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.0.13
CVE Reference
Patch Status
No patch
Source
NVD
LatePoint
medium
Vulnerability
LatePoint — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Element Pack Addons for Elementor
medium
Vulnerability
Element Pack Addons for Elementor — Email Header Injection
Severity
medium Medium risk
Affected Versions
<=8.3.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
medium
Vulnerability
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.2.69
CVE Reference
Patch Status
No patch
Source
NVD
RealHomes Memberships
medium
Vulnerability
RealHomes Memberships — Verify that a membership payment actually completed
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Formidable Forms
medium
Vulnerability
Formidable Forms — Properly validate the status of a PayPal subscription payment before marking it complete
Severity
medium Medium risk
Affected Versions
<=6.32.1
CVE Reference
Patch Status
No patch
Source
NVD
WP Travel Engine
medium
Vulnerability
WP Travel Engine — Verify that an incoming PayPal payment notification was sent to the site's configured merchant accou
Severity
medium Medium risk
Affected Versions
<=6.8.2
CVE Reference
Patch Status
No patch
Source
NVD
GetPaid
medium
Vulnerability
GetPaid — Verify the authenticity of incoming Worldpay payment notifications
Severity
medium Medium risk
Affected Versions
<=2.8.55
CVE Reference
Patch Status
No patch
Source
NVD
Security Optimizer
medium
Vulnerability
Security Optimizer — Correctly validate requests to its optional IP-based login restriction feature
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Tutor LMS
medium
Vulnerability
Tutor LMS — Properly verify enrollment when restricting access to protected course content
Severity
medium Medium risk
Affected Versions
<=3.9.14
CVE Reference
Patch Status
No patch
Source
NVD
Easy Booking
medium
Vulnerability
Easy Booking — Re-enforce a bookable product's configured minimum booking duration on the server side when adding t
Severity
medium Medium risk
Affected Versions
<=3.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Events Made Easy
medium
Vulnerability
Events Made Easy — Bind the payment authorization token to the payment record being charged
Severity
medium Medium risk
Affected Versions
<=3.1.2
CVE Reference
Patch Status
No patch
Source
NVD
Simple Membership
medium
Vulnerability
Simple Membership — Verify that a PayPal payment notification was sent to the site's own configured merchant account bef
Severity
medium Medium risk
Affected Versions
<=4.7.7
CVE Reference
Patch Status
No patch
Source
NVD
Five Star Restaurant Reservations
medium
Vulnerability
Five Star Restaurant Reservations — Verify the authenticity of incoming payment notifications
Severity
medium Medium risk
Affected Versions
<=2.7.23
CVE Reference
Patch Status
No patch
Source
NVD
WP Hotel Booking
medium
Vulnerability
WP Hotel Booking — Ensure that room quantities and the resulting order total are non-negative when placing a booking
Severity
medium Medium risk
Affected Versions
<=2.3.3
CVE Reference
Patch Status
No patch
Source
NVD
WP Hotel Booking
medium
Vulnerability
WP Hotel Booking — Verify that a payment notification corresponds to a payment made to the site's own merchant account
Severity
medium Medium risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD
RegistrationMagic
medium
Vulnerability
RegistrationMagic — Compare the verified PayPal capture's amount
Severity
medium Medium risk
Affected Versions
<=6.0.9.5
CVE Reference
Patch Status
No patch
Source
NVD
Ninja Forms
medium
Vulnerability
Ninja Forms — Prevent user-supplied query-string input
Severity
medium Medium risk
Affected Versions
<=3.14.10
CVE Reference
Patch Status
No patch
Source
NVD
Event Booking Manager for WooCommerce (Pro)
medium
Vulnerability
Event Booking Manager for WooCommerce (Pro) — Validate the ticket price on the server during its native (non-WooCommerce) checkout
Severity
medium Medium risk
Affected Versions
<=5.0.3
CVE Reference
Patch Status
No patch
Source
NVD
DataPress (Dataverse Integration)
medium
Vulnerability
DataPress (Dataverse Integration) — Properly restrict access to its template rendering feature and exposes the viewing user's data to it
Severity
medium Medium risk
Affected Versions
<=2.91
CVE Reference
Patch Status
No patch
Source
NVD
Stream
medium
Vulnerability
Stream — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Security History
Ultra Addons for Contact Form 7
medium
Vulnerability
Ultra Addons for Contact Form 7 — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.43
CVE Reference
Patch Status
No patch
Source
NVD
Subscribe2
medium
Vulnerability
Subscribe2 — Properly escape a user-supplied value before reflecting it into a public subscription form
Severity
medium Medium risk
Affected Versions
<=10.46
CVE Reference
Patch Status
No patch
Source
NVD
Comments
medium
Vulnerability
Comments — Properly escape a user-supplied URL before outputting it inside an HTML attribute
Severity
medium Medium risk
Affected Versions
<=7.6.60
CVE Reference
Patch Status
No patch
Source
NVD
Subscriptions for WooCommerce
medium
Vulnerability
Subscriptions for WooCommerce — Verify that the requester owns the subscription being viewed before rendering its details
Severity
medium Medium risk
Affected Versions
<=2.0.1
CVE Reference
Patch Status
No patch
Source
NVD
BNE Testimonials
medium
Vulnerability
BNE Testimonials — Properly escape a shortcode attribute for a JavaScript context before echoing it into an inline scri
Severity
medium Medium risk
Affected Versions
<=2.0.8.2
CVE Reference
Patch Status
No patch
Source
NVD
Templately
medium
Vulnerability
Templately — Have an authorisation check on one of its request handlers
Severity
medium Medium risk
Affected Versions
<=3.7.1
CVE Reference
Patch Status
No patch
Source
NVD
Meow Gallery
medium
Vulnerability
Meow Gallery — Escape an attachment's alt text before outputting it into an attribute of the link it builds for lin
Severity
medium Medium risk
Affected Versions
<=5.5.2
CVE Reference
Patch Status
No patch
Source
NVD
MStore API
medium
Vulnerability
MStore API — Restrict its vendor-orders endpoint to the caller's own orders
Severity
medium Medium risk
Affected Versions
<=4.21.0
CVE Reference
Patch Status
No patch
Source
NVD
WP Maps
medium
Vulnerability
WP Maps — Perform a capability check in one of its AJAX actions and does not restrict the operation it dispatc
Severity
medium Medium risk
Affected Versions
<=4.9.7
CVE Reference
Patch Status
No patch
Source
NVD
WP Events Manager
medium
Vulnerability
WP Events Manager — Verify that an incoming payment notification originates from the site's configured merchant account
Severity
medium Medium risk
Affected Versions
<=2.2.5
CVE Reference
Patch Status
No patch
Source
NVD
Subscriptions for WooCommerce
medium
Vulnerability
Subscriptions for WooCommerce — Validate the payment amount or bind the PayPal order token to the order being completed on the WooCo
Severity
medium Medium risk
Affected Versions
<=2.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Simple CAPTCHA with Cloudflare Turnstile
medium
Vulnerability
Simple CAPTCHA with Cloudflare Turnstile — Bind its Turnstile validation cache to the single-use challenge token in its Forminator integration
Severity
medium Medium risk
Affected Versions
<=1.42.0
CVE Reference
Patch Status
No patch
Source
NVD
ShareOpenly
medium
Vulnerability
ShareOpenly — CVE-2026-48094
Severity
medium Medium risk
Affected Versions
<=1.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Code Embed
medium
Vulnerability
Code Embed — Stored Cross-Site Scripting (XSS)
Severity
medium Medium risk
Affected Versions
<=2.6.1
CVE Reference
Patch Status
No patch
Source
NVD
Easy Accordion
medium
Vulnerability
Easy Accordion — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Newsletters
medium
Vulnerability
Newsletters — Strictly compare its API authentication key
Severity
medium Medium risk
Affected Versions
<=4.16
CVE Reference
Patch Status
No patch
Source
NVD
Appointment Hour Booking
medium
Vulnerability
Appointment Hour Booking — Validate a client-supplied booking price against the server-side configured service price
Severity
medium Medium risk
Affected Versions
<=1.5.88
CVE Reference
Patch Status
No patch
Source
NVD
Link Library
medium
Vulnerability
Link Library — Sanitise and escape a parameter before reflecting it back in a response
Severity
medium Medium risk
Affected Versions
<=7.9.4
CVE Reference
Patch Status
No patch
Source
NVD
YMC Filter
medium
Vulnerability
YMC Filter — Sanitize and escape a layout builder setting before outputting it on a public endpoint
Severity
medium Medium risk
Affected Versions
<=3.12.8
CVE Reference
Patch Status
No patch
Source
NVD
YMC Filter
medium
Vulnerability
YMC Filter — Sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-
Severity
medium Medium risk
Affected Versions
<=3.12.9
CVE Reference
Patch Status
No patch
Source
NVD
WP Statistics
medium
Vulnerability
WP Statistics — Perform a capability check on a set of dashboard analytics AJAX handlers
Severity
medium Medium risk
Affected Versions
<=14.16.10
CVE Reference
Patch Status
No patch
Source
NVD
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
medium
Vulnerability
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution — Verify that a downloadable product belongs to the requesting vendor before granting download permiss
Severity
medium Medium risk
Affected Versions
<=5.0.11
CVE Reference
Patch Status
No patch
Source
NVD
WP Directory Kit
medium
Vulnerability
WP Directory Kit — Perform authorization or nonce checks on one of its authenticated AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.5.5
CVE Reference
Patch Status
No patch
Source
NVD
WP Directory Kit
medium
Vulnerability
WP Directory Kit — Perform authorization or nonce checks on one of its authenticated AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Download Monitor
medium
Vulnerability
Download Monitor — Perform authorization checks on one of its download-logging AJAX actions
Severity
medium Medium risk
Affected Versions
<=5.2.6
CVE Reference
Patch Status
No patch
Source
NVD
AI Engine
medium
Vulnerability
AI Engine — Verify ownership of a guest's uploaded chatbot files before deletion
Severity
medium Medium risk
Affected Versions
<=3.6.4
CVE Reference
Patch Status
No patch
Source
NVD
AI Engine
medium
Vulnerability
AI Engine — Confine a caller-supplied file path before reading it and forwarding the contents to an external ser
Severity
medium Medium risk
Affected Versions
<=3.6.6
CVE Reference
Patch Status
No patch
Source
NVD
LWS Optimize
medium
Vulnerability
LWS Optimize — Properly escape a value submitted through an unauthenticated analytics endpoint before storing it an
Severity
medium Medium risk
Affected Versions
<=4.1.2
CVE Reference
Patch Status
No patch
Source
NVD
Solace Extra
medium
Vulnerability
Solace Extra — Perform capability or nonce checks in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.6.1
CVE Reference
Patch Status
No patch
Source
NVD
Create
medium
Vulnerability
Create — Perform an authorization check before returning content over one of its REST API routes
Severity
medium Medium risk
Affected Versions
<=2.5.4
CVE Reference
Patch Status
No patch
Source
NVD
WP Photo Album Plus
medium
Vulnerability
WP Photo Album Plus — Perform any capability or nonce check on one of its public REST endpoint actions
Severity
medium Medium risk
Affected Versions
<=9.2.07.002
CVE Reference
Patch Status
No patch
Source
NVD
Create
medium
Vulnerability
Create — Perform an authorization check before rendering content over one of its public REST API routes
Severity
medium Medium risk
Affected Versions
<=2.5.4
CVE Reference
Patch Status
No patch
Source
NVD
WP MAPS PRO
medium
Vulnerability
WP MAPS PRO — Perform a capability check in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=6.1.3
CVE Reference
Patch Status
No patch
Source
NVD
PiWeb Cancel order / Refund request for WooCommerce
medium
Vulnerability
PiWeb Cancel order / Refund request for WooCommerce — Have authorization or ownership checks when adding the contents of a previous order to the cart
Severity
medium Medium risk
Affected Versions
<=1.3.4.34
CVE Reference
Patch Status
No patch
Source
NVD
Advanced Excerpt
medium
Vulnerability
Advanced Excerpt — Sanitise and escape one of its settings before outputting it on the front end of the site
Severity
medium Medium risk
Affected Versions
<=4.5
CVE Reference
Patch Status
No patch
Source
NVD
vitepos
medium
Vulnerability
vitepos — Sanitize or parameterize an identifier taken from a REST request body before using it in a database
Severity
medium Medium risk
Affected Versions
<=3.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Podcast Player
medium
Vulnerability
Podcast Player — Validate the destination of a server-side request built from user-supplied input
Severity
medium Medium risk
Affected Versions
<=8.3.1
CVE Reference
Patch Status
No patch
Source
NVD
Customer Reviews for WooCommerce
medium
Vulnerability
Customer Reviews for WooCommerce — Perform nonce or capability checks on several settings-related AJAX actions
Severity
medium Medium risk
Affected Versions
<=5.116.0
CVE Reference
Patch Status
No patch
Source
NVD
s2Member
medium
Vulnerability
s2Member — Escape several shortcode attributes before outputting them inside an inline script context
Severity
medium Medium risk
Affected Versions
<=260805
CVE Reference
Patch Status
No patch
Source
NVD
Pinpoint Booking System
medium
Vulnerability
Pinpoint Booking System — Validate the booking price on the server side
Severity
medium Medium risk
Affected Versions
<=2.9.9.7.1
CVE Reference
Patch Status
No patch
Source
NVD
MotoPress Hotel Booking
medium
Vulnerability
MotoPress Hotel Booking — Perform any authorization or ownership check on a REST endpoint that creates payment records
Severity
medium Medium risk
Affected Versions
<=6.2.3
CVE Reference
Patch Status
No patch
Source
NVD
MotoPress Hotel Booking
medium
Vulnerability
MotoPress Hotel Booking — Verify record ownership before updating customer records
Severity
medium Medium risk
Affected Versions
<=6.2.3
CVE Reference
Patch Status
No patch
Source
NVD
Term Pages
medium
Vulnerability
Term Pages — Properly sanitise and escape a parameter before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=2.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Saitama Addon Pack
medium
Vulnerability
Saitama Addon Pack — Sanitise and escape certain post metadata values before outputting them
Severity
medium Medium risk
Affected Versions
<=1.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Accept PayPal & Stripe with Subscriptions for WooCommerce
medium
Vulnerability
Accept PayPal & Stripe with Subscriptions for WooCommerce — Verify that the PayPal account which received a payment matches the merchant's configured account be
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD
CubeWP Framework
medium
Vulnerability
CubeWP Framework — Perform a per-object read authorization check
Severity
medium Medium risk
Affected Versions
<=1.1.30
CVE Reference
Patch Status
No patch
Source
NVD
JetEngine
medium
Vulnerability
JetEngine — Sanitise uploaded SVG files before storing and serving them
Severity
medium Medium risk
Affected Versions
<=3.8.13.1
CVE Reference
Patch Status
No patch
Source
NVD
Salon Booking System
medium
Vulnerability
Salon Booking System — Verify that a requested booking belongs to the caller on one of its REST API endpoints
Severity
medium Medium risk
Affected Versions
<=10.30.33
CVE Reference
Patch Status
No patch
Source
NVD
Salon Booking System
medium
Vulnerability
Salon Booking System — Properly restrict access to some of its booking-modification AJAX actions and does not verify owners
Severity
medium Medium risk
Affected Versions
<=10.30.33
CVE Reference
Patch Status
No patch
Source
NVD
Salon Booking System
medium
Vulnerability
Salon Booking System — Perform any capability check or validate an OAuth state value on its Google Calendar authorization c
Severity
medium Medium risk
Affected Versions
<=10.30.33
CVE Reference
Patch Status
No patch
Source
NVD
FoodBoxBooker
medium
Vulnerability
FoodBoxBooker — Verify that the user account being updated belongs to the user making the request
Severity
medium Medium risk
Affected Versions
<=1.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Library Management System
medium
Vulnerability
Library Management System — Sanitize and escape a user-supplied parameter before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=3.6.7
CVE Reference
Patch Status
No patch
Source
NVD
RSS Aggregator by Feedzy
medium
Vulnerability
RSS Aggregator by Feedzy — Verify that the requesting user owns or is allowed to edit the import job named in the request
Severity
medium Medium risk
Affected Versions
<=5.2.6
CVE Reference
Patch Status
No patch
Source
NVD
Block User Account
medium
Vulnerability
Block User Account — Enforce its account block on every authentication path
Severity
medium Medium risk
Affected Versions
<=2.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro
medium
Vulnerability
Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro — Unauthenticated sensitive information exposure
Severity
medium Medium risk
Affected Versions
<=3.4.3
CVE Reference
Patch Status
No patch
Source
NVD
Duplicate Post
medium
Vulnerability
Duplicate Post — Perform per-object authorisation checks in its bulk copy and delete operations
Severity
medium Medium risk
Affected Versions
<=1.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Sucuri Security
medium
Vulnerability
Sucuri Security — Authenticated administrators to delete arbitrary files by supplying directory traversal sequences in
Severity
medium Medium risk
Affected Versions
<=2.7.3
CVE Reference
Patch Status
No patch
Source
NVD
Kirki – Freeform Page Builder, Website Builder & Customizer
medium
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Ray Enterprise Translation
medium
Vulnerability
Ray Enterprise Translation — Perform any capability or nonce checks on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.7.3
CVE Reference
Patch Status
No patch
Source
NVD
Ray Enterprise Translation
medium
Vulnerability
Ray Enterprise Translation — Perform any capability or nonce checks on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.7.3
CVE Reference
Patch Status
No patch
Source
NVD
LearnPress
medium
Vulnerability
LearnPress — Verify that a user is enrolled in a course before processing AI-assistant requests against that cour
Severity
medium Medium risk
Affected Versions
<=4.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Eventin
medium
Vulnerability
Eventin — Properly restrict access to stored customer records
Severity
medium Medium risk
Affected Versions
<=4.1.20
CVE Reference
Patch Status
No patch
Source
NVD
Eventin
medium
Vulnerability
Eventin — Properly restrict access to individual order records
Severity
medium Medium risk
Affected Versions
<=4.1.20
CVE Reference
Patch Status
No patch
Source
NVD
KiviCare
medium
Vulnerability
KiviCare — Verify that the requesting user owns the records being accessed
Severity
medium Medium risk
Affected Versions
<=4.5.2
CVE Reference
Patch Status
No patch
Source
NVD
WP Crowdfunding
medium
Vulnerability
WP Crowdfunding — Verify ownership of a campaign before
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
WP Crowdfunding
medium
Vulnerability
WP Crowdfunding — Verify order ownership before returning order details
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
WP Crowdfunding
medium
Vulnerability
WP Crowdfunding — Check the campaign-submission capability in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Patterns Kit
medium
Vulnerability
Patterns Kit — Escape a link attribute before its client-side script inserts it into the page
Severity
medium Medium risk
Affected Versions
<=1.0.3
CVE Reference
Patch Status
No patch
Source
NVD
Cookie Consent
medium
Vulnerability
Cookie Consent — Correctly enforce its intended administrator-only capability check on its consent-settings REST rout
Severity
medium Medium risk
Affected Versions
<=0.0.10
CVE Reference
Patch Status
No patch
Source
NVD
Welcart e-Commerce
medium
Vulnerability
Welcart e-Commerce — Sanitise or escape a product field before outputting it on the product pages
Severity
medium Medium risk
Affected Versions
<=2.11.34
CVE Reference
Patch Status
No patch
Source
NVD
WP Travel Engine
medium
Vulnerability
WP Travel Engine — Perform authorization or ownership checks when loading a caller-supplied booking identifier in one o
Severity
medium Medium risk
Affected Versions
<=6.8.5
CVE Reference
Patch Status
No patch
Source
NVD
WP Photo Album Plus
medium
Vulnerability
WP Photo Album Plus — Sanitise and escape a parameter before reflecting it into an inline script block
Severity
medium Medium risk
Affected Versions
<=9.2.07.002
CVE Reference
Patch Status
No patch
Source
NVD
User Access Manager
medium
Vulnerability
User Access Manager — Apply its access restrictions to REST API requests
Severity
medium Medium risk
Affected Versions
<=2.3.15
CVE Reference
Patch Status
No patch
Source
NVD
Cookie Consent
medium
Vulnerability
Cookie Consent — Correctly enforce its intended administrator-only capability check on the REST route that stores its
Severity
medium Medium risk
Affected Versions
<=0.0.10
CVE Reference
Patch Status
No patch
Source
NVD
WPC Admin Columns
medium
Vulnerability
WPC Admin Columns — Have authorisation checks in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.3.4
CVE Reference
Patch Status
No patch
Source
NVD
WP Photo Album Plus
medium
Vulnerability
WP Photo Album Plus — Check that the current user is allowed to upload into the album they target when it processes a fron
Severity
medium Medium risk
Affected Versions
<=9.2.09.002
CVE Reference
Patch Status
No patch
Source
NVD
ProSolution WP Client
medium
Vulnerability
ProSolution WP Client — Validate a user-supplied URL
Severity
medium Medium risk
Affected Versions
<=2.0.9
CVE Reference
Patch Status
No patch
Source
NVD
ProSolution WP Client
medium
Vulnerability
ProSolution WP Client — Perform capability checks on two administrative AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.0.9
CVE Reference
Patch Status
No patch
Source
NVD
Order Sync with Zendesk for WooCommerce
medium
Vulnerability
Order Sync with Zendesk for WooCommerce — Perform any capability check on one of its REST API endpoints
Severity
medium Medium risk
Affected Versions
<=2.2.3
CVE Reference
Patch Status
No patch
Source
NVD
Royal Addons for Elementor
medium
Vulnerability
Royal Addons for Elementor — Validate a widget setting used to build an HTML tag before outputting it
Severity
medium Medium risk
Affected Versions
<=1.7.1065
CVE Reference
Patch Status
No patch
Source
NVD
Wallet System for WooCommerce
medium
Vulnerability
Wallet System for WooCommerce — Validate a user-supplied wallet amount against the customer's actual stored balance during checkout
Severity
medium Medium risk
Affected Versions
<=2.7.10
CVE Reference
Patch Status
No patch
Source
NVD
Welcart e-Commerce
medium
Vulnerability
Welcart e-Commerce — Verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthentic
Severity
medium Medium risk
Affected Versions
<=2.11.33
CVE Reference
Patch Status
No patch
Source
NVD
Payment Gateway for PayPal on WooCommerce
medium
Vulnerability
Payment Gateway for PayPal on WooCommerce — Verify that payment actually succeeded before completing an order in its PayPal return handler: it r
Severity
medium Medium risk
Affected Versions
<=9.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Kirki
medium
Vulnerability
Kirki — Properly authorise its front-end form submission REST routes and passes attacker-controlled input th
Severity
medium Medium risk
Affected Versions
<=6.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Payment Button for PayPal
medium
Vulnerability
Payment Button for PayPal — Enforce the merchant-configured price server-side and trusts a client-supplied payment amount
Severity
medium Medium risk
Affected Versions
<=1.2.3.44
CVE Reference
Patch Status
No patch
Source
NVD
Quick Paypal Payments
medium
Vulnerability
Quick Paypal Payments — Verify the paid amount
Severity
medium Medium risk
Affected Versions
<=5.7.50
CVE Reference
Patch Status
No patch
Source
NVD
Draft List is a
medium
Vulnerability
Draft List is a — Stored Cross-Site Scripting (XSS)
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Food Menu
medium
Vulnerability
Food Menu — Perform any capability or ownership check on its reservation-status update action
Severity
medium Medium risk
Affected Versions
<=6.0.2
CVE Reference
Patch Status
No patch
Source
NVD
KiviCare
medium
Vulnerability
KiviCare — Restrict the roles assignable through its unauthenticated registration endpoint
Severity
medium Medium risk
Affected Versions
<=4.5.2
CVE Reference
Patch Status
No patch
Source
NVD
Customer Email Verification for WooCommerce
medium
Vulnerability
Customer Email Verification for WooCommerce — Correctly validate the email-verification activation code
Severity
medium Medium risk
Affected Versions
<=3.2.6
CVE Reference
Patch Status
No patch
Source
NVD
Booking for Appointments and Events Calendar
medium
Vulnerability
Booking for Appointments and Events Calendar — Verify that an authenticated employee (provider) is assigned to the appointment being accessed
Severity
medium Medium risk
Affected Versions
<=2.4.6
CVE Reference
Patch Status
No patch
Source
NVD
WP Helper Premium
medium
Vulnerability
WP Helper Premium — Verify the order key when rendering its custom order confirmation page or when handling the related
Severity
medium Medium risk
Affected Versions
<=4.7.6
CVE Reference
Patch Status
No patch
Source
NVD
ShopEngine Elementor WooCommerce Builder Addon
medium
Vulnerability
ShopEngine Elementor WooCommerce Builder Addon — Protect one of its authentication endpoints against CSRF
Severity
medium Medium risk
Affected Versions
<=4.9.3
CVE Reference
Patch Status
No patch
Source
NVD
Prevent Direct Access – Protect WordPress Files
medium
Vulnerability
Prevent Direct Access – Protect WordPress Files — Unauthorized access of protected files
Severity
medium Medium risk
Affected Versions
<=2.8.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
Passster
low
Vulnerability
Passster — Restrict low-privilege users holding the edit_posts capability from reading globally password-protec
Severity
low Low risk
Affected Versions
<=4.3.7
CVE Reference
Patch Status
No patch
Source
NVD
Easy Appointments
low
Vulnerability
Easy Appointments — Correctly validate shortcode input in one of its block-rendering actions
Severity
low Low risk
Affected Versions
<=3.12.28
CVE Reference
Patch Status
No patch
Source
NVD
Slim SEO
low
Vulnerability
Slim SEO — Restrict a post-meta preview feature to posts the user is allowed to edit
Severity
low Low risk
Affected Versions
<=4.9.11
CVE Reference
Patch Status
No patch
Source
NVD
Nexter Blocks
low
Vulnerability
Nexter Blocks — Restrict who can save global CSS through one of its REST endpoints
Severity
low Low risk
Affected Versions
<=5.0.2
CVE Reference
Patch Status
No patch
Source
NVD
LearnPress
low
Vulnerability
LearnPress — Validate a user-supplied URL before the server fetches it
Severity
low Low risk
Affected Versions
<=4.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Booking for Appointments and Events Calendar
low
Vulnerability
Booking for Appointments and Events Calendar — Verify that an authenticated employee (provider) is related to the customer whose record is being ac
Severity
low Low risk
Affected Versions
<=9.7
CVE Reference
Patch Status
No patch
Source
NVD
Accept PayPal & Stripe with Subscriptions for WooCommerce
low
Vulnerability
Accept PayPal & Stripe with Subscriptions for WooCommerce — Validate the amount actually paid against the order total in its PayPal Data Transfer return handler
Severity
low Low risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Estatik Real Estate Plugin
low
Vulnerability
Estatik Real Estate Plugin — Validate the same recipient list that it later uses to address the message sent by its property requ
Severity
low Low risk
Affected Versions
<=4.3.4
CVE Reference
Patch Status
No patch
Source
NVD
WordPress Theme Vulnerabilities (1)
Accelerate
medium
Vulnerability
Accelerate — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=1.5.3
CVE Reference
Patch Status
No patch
Source
NVD
WordPress Core Vulnerabilities (7)
WordPress
medium
Vulnerability
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element
Severity
medium Medium risk
Affected Versions
<=4.7.33
CVE Reference
N/A
Patch Status
4.7.34
Source
Wordfence
WordPress
medium
Vulnerability
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite
Severity
medium Medium risk
Affected Versions
<=4.7.33
CVE Reference
N/A
Patch Status
4.7.34
Source
Wordfence
WordPress
medium
Vulnerability
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
Severity
medium Medium risk
Affected Versions
<=4.7.33
CVE Reference
N/A
Patch Status
4.7.34
Source
Wordfence
WordPress
medium
Vulnerability
WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
Severity
medium Medium risk
Affected Versions
<=4.7.33
CVE Reference
N/A
Patch Status
4.7.34
Source
Wordfence
WordPress
medium
Vulnerability
WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection
Severity
medium Medium risk
Affected Versions
<=4.7.33
CVE Reference
N/A
Patch Status
4.7.34
Source
Wordfence
WordPress
medium
Vulnerability
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass
Severity
medium Medium risk
Affected Versions
<=4.7.33
CVE Reference
N/A
Patch Status
4.7.34
Source
Wordfence
WordPress
medium
Vulnerability
WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=4.7.33
CVE Reference
N/A
Patch Status
4.7.34
Source
Wordfence
Recommendations
1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.
Set up uptime monitoring and periodic security scans to catch issues early.
Methodology
This report is compiled automatically from multiple trusted sources:
NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans
Tags
Related Posts
Vulnerability Report
WordPress Vulnerability Report: August 25 – September 1, 2026
171 WordPress vulnerabilities disclosed between August 25 – September 1, 2026. 15 critical, 57 high severity. 0 patched, 171 unpatched.
WPSentry·Sep 1, 2026
Vulnerability Report
WordPress Vulnerability Report: August 24 – August 31, 2026
171 WordPress vulnerabilities disclosed between August 24 – August 31, 2026. 15 critical, 50 high severity. 0 patched, 171 unpatched.
WPSentry·Aug 31, 2026
Vulnerability Report
WordPress Vulnerability Report: August 23 – August 30, 2026
170 WordPress vulnerabilities disclosed between August 23 – August 30, 2026. 15 critical, 50 high severity. 0 patched, 170 unpatched.
WPSentry·Aug 30, 2026