BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: August 8 – August 15, 2026

170 WordPress vulnerabilities disclosed between August 8 – August 15, 2026. 19 critical, 56 high severity. 0 patched, 170 unpatched.

WPSentryAugust 15, 202636 min read

During the reporting period (August 8 – August 15, 2026), 170 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

170
Total
19
Critical
56
High
88
Medium
7
Low
0
Patched
Table of Contents 175 plugins & components

WordPress Plugin Vulnerabilities (169)

InfiniteWP Client

critical
Vulnerability
InfiniteWP Client — Properly verify the site-connection state and the authenticity of requests to its remote-management
Severity
critical Critical risk
Affected Versions
<=1.13.6
CVE Reference
Patch Status
No patch
Source
NVD

WP Directory Kit

critical
Vulnerability
WP Directory Kit — Properly sanitise and escape a parameter before using it in a SQL statement
Severity
critical Critical risk
Affected Versions
<=1.5.5
CVE Reference
Patch Status
No patch
Source
NVD

FoodBoxBooker

critical
Vulnerability
FoodBoxBooker — Properly validate the password reset request
Severity
critical Critical risk
Affected Versions
<=1.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Single Sign On For TNG

critical
Vulnerability
Single Sign On For TNG — Properly validate a password reset request
Severity
critical Critical risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD

ProSolution WP Client

critical
Vulnerability
ProSolution WP Client — Sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visi
Severity
critical Critical risk
Affected Versions
<=2.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Product Input Fields for WooCommerce

critical
Vulnerability
Product Input Fields for WooCommerce — Validate uploaded file types when its accepted-types setting is left empty
Severity
critical Critical risk
Affected Versions
<=2.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Formidable Digital Signatures

critical
Vulnerability
Formidable Digital Signatures — File deletion
Severity
critical Critical risk
Affected Versions
<=3.0.6
CVE Reference
Patch Status
No patch
Source
NVD

giftware

critical
Vulnerability
giftware — Validate the type of uploaded files in one of its upload paths
Severity
critical Critical risk
Affected Versions
<=4.2.10
CVE Reference
Patch Status
No patch
Source
NVD

wpmudev-updates

critical
Vulnerability
wpmudev-updates — Verify the integrity of the packages installed through its remote management interface
Severity
critical Critical risk
Affected Versions
<=5.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Wallet for WooCommerce

critical
Vulnerability
Wallet for WooCommerce — Verify the amount actually collected for a wallet top-up before crediting the wallet
Severity
critical Critical risk
Affected Versions
<=1.6.10
CVE Reference
Patch Status
No patch
Source
NVD

Events Manager

critical
Vulnerability
Events Manager — Properly scope its capability mapping
Severity
critical Critical risk
Affected Versions
<=7.4.1
CVE Reference
Patch Status
No patch
Source
NVD

WooCommerce Subscriptions

critical
Vulnerability
WooCommerce Subscriptions — Validate user input before unserializing it on stores with High-Performance Order Storage enabled
Severity
critical Critical risk
Affected Versions
<=9.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Customer Email Verification for WooCommerce

critical
Vulnerability
Customer Email Verification for WooCommerce — Correctly validate the email-verification activation code
Severity
critical Critical risk
Affected Versions
<=3.2.6
CVE Reference
Patch Status
No patch
Source
NVD

Link Factory

critical
Vulnerability
Link Factory — CVE-2026-15413
Severity
critical Critical risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Wishlist Member

critical
Vulnerability
Wishlist Member — Account Takeover
Severity
critical Critical risk
Affected Versions
<=3.34.1
CVE Reference
Patch Status
No patch
Source
NVD

RapiSafe – Secure Multi File Upload for Contact Form 7

critical
Vulnerability
RapiSafe – Secure Multi File Upload for Contact Form 7 — Arbitrary file deletion
Severity
critical Critical risk
Affected Versions
<=1.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

6Storage Rentals

critical
Vulnerability
6Storage Rentals — Authentication bypass
Severity
critical Critical risk
Affected Versions
<=2.27.0
CVE Reference
Patch Status
No patch
Source
NVD

User Session Synchronizer

critical
Vulnerability
User Session Synchronizer — Authentication Bypass leading to Account Takeover
Severity
critical Critical risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Profile Builder

critical
Vulnerability
User Profile Builder — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=3.16.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GeoDirectory

high
Vulnerability
GeoDirectory — Perform any authorization check when returning map marker data for a single requested listing
Severity
high High risk
Affected Versions
<=2.8.169
CVE Reference
Patch Status
No patch
Source
NVD

CubeWP Framework

high
Vulnerability
CubeWP Framework — Properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action
Severity
high High risk
Affected Versions
<=1.1.31
CVE Reference
Patch Status
No patch
Source
NVD

Iptanus File Upload

high
Vulnerability
Iptanus File Upload — Properly sanitise and escape a parameter before using it in a SQL statement
Severity
high High risk
Affected Versions
<=5.1.8
CVE Reference
Patch Status
No patch
Source
NVD

WP Data Access

high
Vulnerability
WP Data Access — Validate the column names it accepts on one of its unauthenticated AJAX actions
Severity
high High risk
Affected Versions
<=5.5.79
CVE Reference
Patch Status
No patch
Source
NVD

WPC Order Tip for WooCommerce

high
Vulnerability
WPC Order Tip for WooCommerce — Perform authorisation or nonce checks in one of its reporting features
Severity
high High risk
Affected Versions
<=3.3.1
CVE Reference
Patch Status
No patch
Source
NVD

WP MAPS PRO

high
Vulnerability
WP MAPS PRO — Perform a capability check in one of its AJAX actions
Severity
high High risk
Affected Versions
<=6.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

high
Vulnerability
Eventin — Properly validate a template path setting before using it to include a local file
Severity
high High risk
Affected Versions
<=4.1.20
CVE Reference
Patch Status
No patch
Source
NVD

AutoNetTV Relay

high
Vulnerability
AutoNetTV Relay — Perform any capability or authentication check before setting a WordPress administrator authenticati
Severity
high High risk
Affected Versions
<=3.0.14
CVE Reference
Patch Status
No patch
Source
NVD

HT Contact Form

high
Vulnerability
HT Contact Form — Perform any authorization check on the endpoint that returns a saved form draft
Severity
high High risk
Affected Versions
<=2.9.3
CVE Reference
Patch Status
No patch
Source
NVD

vitepos

high
Vulnerability
vitepos — CVE-2026-14237
Severity
high High risk
Affected Versions
<=3.6.0
CVE Reference
Patch Status
No patch
Source
NVD

Autopay

high
Vulnerability
Autopay — Perform any capability or nonce check before saving a styling option from a public request
Severity
high High risk
Affected Versions
<=5.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Arvow AI SEO Writer

high
Vulnerability
Arvow AI SEO Writer — Properly restrict access to one of its REST endpoints
Severity
high High risk
Affected Versions
<=1.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Squeeze

high
Vulnerability
Squeeze — Validate the file type or extension of the per-size image data written by one of its attachment-upda
Severity
high High risk
Affected Versions
<=1.7.12
CVE Reference
Patch Status
No patch
Source
NVD

Salon Booking System

high
Vulnerability
Salon Booking System — Properly validate a booking's ownership token before loading it in its booking-wizard confirmation s
Severity
high High risk
Affected Versions
<=10.30.34
CVE Reference
Patch Status
No patch
Source
NVD

File Manager

high
Vulnerability
File Manager — Properly authorise its file management commands
Severity
high High risk
Affected Versions
<=6.9.1
CVE Reference
Patch Status
No patch
Source
NVD

File Manager

high
Vulnerability
File Manager — Have authorisation checks on one of its REST API routes
Severity
high High risk
Affected Versions
<=6.9.1
CVE Reference
Patch Status
No patch
Source
NVD

File Manager

high
Vulnerability
File Manager — Perform any capability check on one of its file manager connector endpoints
Severity
high High risk
Affected Versions
<=6.9.1
CVE Reference
Patch Status
No patch
Source
NVD

BricksForge

high
Vulnerability
BricksForge — Verify the identity of the requester when processing a password change submitted through one of its
Severity
high High risk
Affected Versions
<=3.1.8.8
CVE Reference
Patch Status
No patch
Source
NVD

Login & Register Forms

high
Vulnerability
Login & Register Forms — Bind the password reset verification state to the account being reset or to the party that completed
Severity
high High risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Login & Register Forms

high
Vulnerability
Login & Register Forms — Enforce its password reset attempt limit against a server-derived value
Severity
high High risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Login & Register Forms

high
Vulnerability
Login & Register Forms — Verify that a password reset request comes from the account's owner
Severity
high High risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD

CheckView

high
Vulnerability
CheckView — Restrict its REST API authentication filter to its own routes and unconditionally discards the authe
Severity
high High risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD

Contact Form to Any API

high
Vulnerability
Contact Form to Any API — Use a random filename when copying files uploaded through contact forms into a publicly accessible d
Severity
high High risk
Affected Versions
<=3.0.7
CVE Reference
Patch Status
No patch
Source
NVD

ProSolution WP Client

high
Vulnerability
ProSolution WP Client — Sanitise a cookie value before using it in SQL queries
Severity
high High risk
Affected Versions
<=2.0.9
CVE Reference
Patch Status
No patch
Source
NVD

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

high
Vulnerability
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress — Authorization bypass
Severity
high High risk
Affected Versions
<=10.11.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

InstaWP Connect – 1-click WP Staging & Migration

high
Vulnerability
InstaWP Connect – 1-click WP Staging & Migration — Remote Code Execution
Severity
high High risk
Affected Versions
<=0.1.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

high
Vulnerability
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=2.8.169
CVE Reference
Patch Status
No patch
Source
NVD

Frontend Admin by DynamiApps

high
Vulnerability
Frontend Admin by DynamiApps — Authorization bypass
Severity
high High risk
Affected Versions
<=3.29.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect

high
Vulnerability
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect — Authentication Bypass
Severity
high High risk
Affected Versions
<=1.4.3
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

high
Vulnerability
Eventin — Perform an authorization check on its waiting-list registration handler
Severity
high High risk
Affected Versions
<=4.1.20
CVE Reference
Patch Status
No patch
Source
NVD

KiviCare

high
Vulnerability
KiviCare — Properly sanitise and escape user-supplied parameters before using them in a SQL query
Severity
high High risk
Affected Versions
<=4.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Import WP

high
Vulnerability
Import WP — Perform any authorization check on one of its export-file download handlers
Severity
high High risk
Affected Versions
<=2.14.23
CVE Reference
Patch Status
No patch
Source
NVD

Total Upkeep

high
Vulnerability
Total Upkeep — Adequately protect the secret that authorizes its backup-restore functionality and exposes it to una
Severity
high High risk
Affected Versions
<=1.17.3
CVE Reference
Patch Status
No patch
Source
NVD

PowerPress Podcasting plugin by Blubrry

high
Vulnerability
PowerPress Podcasting plugin by Blubrry — Validate one of its Podcast Episode URL settings before performing a server-side request with it
Severity
high High risk
Affected Versions
<=11.17.1
CVE Reference
Patch Status
No patch
Source
NVD

Form Maker by 10Web

high
Vulnerability
Form Maker by 10Web — Properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for
Severity
high High risk
Affected Versions
<=1.15.45
CVE Reference
Patch Status
No patch
Source
NVD

WP Photo Album Plus

high
Vulnerability
WP Photo Album Plus — Validate a client-controlled value used to build a file path in one of its public endpoint actions
Severity
high High risk
Affected Versions
<=9.2.07.002
CVE Reference
Patch Status
No patch
Source
NVD

WP Photo Album Plus

high
Vulnerability
WP Photo Album Plus — Perform any capability or nonce check on one of its public endpoint actions and builds an option nam
Severity
high High risk
Affected Versions
<=9.2.07.002
CVE Reference
Patch Status
No patch
Source
NVD

Events Manager

high
Vulnerability
Events Manager — Sanitise and escape a user-controlled value before using it in a SQL statement
Severity
high High risk
Affected Versions
<=7.4.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Directory Kit

high
Vulnerability
WP Directory Kit — Sanitise and escape a parameter before using it in a SQL statement through one of its authenticated
Severity
high High risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD

WP Directory Kit

high
Vulnerability
WP Directory Kit — Sanitise and escape a parameter before using it in a SQL statement
Severity
high High risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD

Ezoic

high
Vulnerability
Ezoic — Properly restrict access to some of its content export functionality
Severity
high High risk
Affected Versions
<=2.23.1
CVE Reference
Patch Status
No patch
Source
NVD

KiviCare

high
Vulnerability
KiviCare — Restrict the roles assignable through its unauthenticated registration endpoint
Severity
high High risk
Affected Versions
<=4.5.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Helper Premium

high
Vulnerability
WP Helper Premium — Verify the order key when rendering its custom order confirmation page or when handling the related
Severity
high High risk
Affected Versions
<=4.7.6
CVE Reference
Patch Status
No patch
Source
NVD

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

high
Vulnerability
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

W3 Total Cache

high
Vulnerability
W3 Total Cache — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Paymob for WooCommerce

high
Vulnerability
Paymob for WooCommerce — Properly sanitise a client-supplied identifier before using it in a SQL query within its public
Severity
high High risk
Affected Versions
<=4.1.9
CVE Reference
Patch Status
No patch
Source
NVD

Essential Addons for Elementor

high
Vulnerability
Essential Addons for Elementor — Prevent user-supplied registration fields from overwriting reserved account attributes
Severity
high High risk
Affected Versions
<=6.7.2
CVE Reference
Patch Status
No patch
Source
NVD

WP-Stats

high
Vulnerability
WP-Stats — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.56
CVE Reference
Patch Status
No patch
Source
NVD

Online Booking & Scheduling Calendar for WordPress by vcita

high
Vulnerability
Online Booking & Scheduling Calendar for WordPress by vcita — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

bLoyal: Loyalty & Promotions by bLoyal

high
Vulnerability
bLoyal: Loyalty & Promotions by bLoyal — Privilege Escalation
Severity
high High risk
Affected Versions
<=3.1.611.78
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Propovoice: All-in-One Client Management System

high
Vulnerability
Propovoice: All-in-One Client Management System — Privilege Escalation
Severity
high High risk
Affected Versions
<=1.7.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MaxUpload – Big File Uploads – Increase Maximum File Upload Size

high
Vulnerability
MaxUpload – Big File Uploads – Increase Maximum File Upload Size — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent

high
Vulnerability
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.3.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms

high
Vulnerability
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Wholesale Market

high
Vulnerability
Wholesale Market — Privilege escalation
Severity
high High risk
Affected Versions
<=2.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Payment Forms for Paystack

medium
Vulnerability
Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure
Severity
medium Medium risk
Affected Versions
<=4.0.5
CVE Reference
Patch Status
No patch
Source
Wordfence
Plugin Page

LWS Optimize

medium
Vulnerability
LWS Optimize — Properly escape a value submitted through an unauthenticated analytics endpoint before storing it an
Severity
medium Medium risk
Affected Versions
<=4.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Solace Extra

medium
Vulnerability
Solace Extra — Perform capability or nonce checks in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.6.1
CVE Reference
Patch Status
No patch
Source
NVD

Create

medium
Vulnerability
Create — Perform an authorization check before returning content over one of its REST API routes
Severity
medium Medium risk
Affected Versions
<=2.5.4
CVE Reference
Patch Status
No patch
Source
NVD

WP Photo Album Plus

medium
Vulnerability
WP Photo Album Plus — Perform any capability or nonce check on one of its public REST endpoint actions
Severity
medium Medium risk
Affected Versions
<=9.2.07.002
CVE Reference
Patch Status
No patch
Source
NVD

Create

medium
Vulnerability
Create — Perform an authorization check before rendering content over one of its public REST API routes
Severity
medium Medium risk
Affected Versions
<=2.5.4
CVE Reference
Patch Status
No patch
Source
NVD

WP MAPS PRO

medium
Vulnerability
WP MAPS PRO — Perform a capability check in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=6.1.3
CVE Reference
Patch Status
No patch
Source
NVD

PiWeb Cancel order / Refund request for WooCommerce

medium
Vulnerability
PiWeb Cancel order / Refund request for WooCommerce — Have authorization or ownership checks when adding the contents of a previous order to the cart
Severity
medium Medium risk
Affected Versions
<=1.3.4.34
CVE Reference
Patch Status
No patch
Source
NVD

Advanced Excerpt

medium
Vulnerability
Advanced Excerpt — Sanitise and escape one of its settings before outputting it on the front end of the site
Severity
medium Medium risk
Affected Versions
<=4.5
CVE Reference
Patch Status
No patch
Source
NVD

vitepos

medium
Vulnerability
vitepos — Sanitize or parameterize an identifier taken from a REST request body before using it in a database
Severity
medium Medium risk
Affected Versions
<=3.6.0
CVE Reference
Patch Status
No patch
Source
NVD

Podcast Player

medium
Vulnerability
Podcast Player — Validate the destination of a server-side request built from user-supplied input
Severity
medium Medium risk
Affected Versions
<=8.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Customer Reviews for WooCommerce

medium
Vulnerability
Customer Reviews for WooCommerce — Perform nonce or capability checks on several settings-related AJAX actions
Severity
medium Medium risk
Affected Versions
<=5.116.0
CVE Reference
Patch Status
No patch
Source
NVD

s2Member

medium
Vulnerability
s2Member — Escape several shortcode attributes before outputting them inside an inline script context
Severity
medium Medium risk
Affected Versions
<=260805
CVE Reference
Patch Status
No patch
Source
NVD

Pinpoint Booking System

medium
Vulnerability
Pinpoint Booking System — Validate the booking price on the server side
Severity
medium Medium risk
Affected Versions
<=2.9.9.7.1
CVE Reference
Patch Status
No patch
Source
NVD

MotoPress Hotel Booking

medium
Vulnerability
MotoPress Hotel Booking — Perform any authorization or ownership check on a REST endpoint that creates payment records
Severity
medium Medium risk
Affected Versions
<=6.2.3
CVE Reference
Patch Status
No patch
Source
NVD

MotoPress Hotel Booking

medium
Vulnerability
MotoPress Hotel Booking — Verify record ownership before updating customer records
Severity
medium Medium risk
Affected Versions
<=6.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Term Pages

medium
Vulnerability
Term Pages — Properly sanitise and escape a parameter before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=2.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Saitama Addon Pack

medium
Vulnerability
Saitama Addon Pack — Sanitise and escape certain post metadata values before outputting them
Severity
medium Medium risk
Affected Versions
<=1.0.8
CVE Reference
Patch Status
No patch
Source
NVD

Accept PayPal & Stripe with Subscriptions for WooCommerce

medium
Vulnerability
Accept PayPal & Stripe with Subscriptions for WooCommerce — Verify that the PayPal account which received a payment matches the merchant's configured account be
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD

CubeWP Framework

medium
Vulnerability
CubeWP Framework — Perform a per-object read authorization check
Severity
medium Medium risk
Affected Versions
<=1.1.30
CVE Reference
Patch Status
No patch
Source
NVD

JetEngine

medium
Vulnerability
JetEngine — Sanitise uploaded SVG files before storing and serving them
Severity
medium Medium risk
Affected Versions
<=3.8.13.1
CVE Reference
Patch Status
No patch
Source
NVD

Salon Booking System

medium
Vulnerability
Salon Booking System — Verify that a requested booking belongs to the caller on one of its REST API endpoints
Severity
medium Medium risk
Affected Versions
<=10.31.0
CVE Reference
Patch Status
No patch
Source
NVD

Salon Booking System

medium
Vulnerability
Salon Booking System — Properly restrict access to some of its booking-modification AJAX actions and does not verify owners
Severity
medium Medium risk
Affected Versions
<=10.30.34
CVE Reference
Patch Status
No patch
Source
NVD

Salon Booking System

medium
Vulnerability
Salon Booking System — Perform any capability check or validate an OAuth state value on its Google Calendar authorization c
Severity
medium Medium risk
Affected Versions
<=10.30.33
CVE Reference
Patch Status
No patch
Source
NVD

FoodBoxBooker

medium
Vulnerability
FoodBoxBooker — Verify that the user account being updated belongs to the user making the request
Severity
medium Medium risk
Affected Versions
<=1.0.8
CVE Reference
Patch Status
No patch
Source
NVD

Library Management System

medium
Vulnerability
Library Management System — Sanitize and escape a user-supplied parameter before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=3.6.7
CVE Reference
Patch Status
No patch
Source
NVD

RSS Aggregator by Feedzy

medium
Vulnerability
RSS Aggregator by Feedzy — Verify that the requesting user owns or is allowed to edit the import job named in the request
Severity
medium Medium risk
Affected Versions
<=5.2.6
CVE Reference
Patch Status
No patch
Source
NVD

Block User Account

medium
Vulnerability
Block User Account — Enforce its account block on every authentication path
Severity
medium Medium risk
Affected Versions
<=2.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro

medium
Vulnerability
Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro — Unauthenticated sensitive information exposure
Severity
medium Medium risk
Affected Versions
<=3.4.3
CVE Reference
Patch Status
No patch
Source
NVD

Duplicate Post

medium
Vulnerability
Duplicate Post — Perform per-object authorisation checks in its bulk copy and delete operations
Severity
medium Medium risk
Affected Versions
<=1.5.5
CVE Reference
Patch Status
No patch
Source
NVD

Sucuri Security

medium
Vulnerability
Sucuri Security — Authenticated administrators to delete arbitrary files by supplying directory traversal sequences in
Severity
medium Medium risk
Affected Versions
<=2.7.3
CVE Reference
Patch Status
No patch
Source
NVD

Kirki – Freeform Page Builder, Website Builder & Customizer

medium
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Ray Enterprise Translation

medium
Vulnerability
Ray Enterprise Translation — Perform any capability or nonce checks on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.7.3
CVE Reference
Patch Status
No patch
Source
NVD

Ray Enterprise Translation

medium
Vulnerability
Ray Enterprise Translation — Perform any capability or nonce checks on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.7.3
CVE Reference
Patch Status
No patch
Source
NVD

LearnPress

medium
Vulnerability
LearnPress — Verify that a user is enrolled in a course before processing AI-assistant requests against that cour
Severity
medium Medium risk
Affected Versions
<=4.4.4
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Properly restrict access to stored customer records
Severity
medium Medium risk
Affected Versions
<=4.1.20
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Properly restrict access to individual order records
Severity
medium Medium risk
Affected Versions
<=4.1.20
CVE Reference
Patch Status
No patch
Source
NVD

KiviCare

medium
Vulnerability
KiviCare — Verify that the requesting user owns the records being accessed
Severity
medium Medium risk
Affected Versions
<=4.5.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Crowdfunding

medium
Vulnerability
WP Crowdfunding — Verify ownership of a campaign before
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Crowdfunding

medium
Vulnerability
WP Crowdfunding — Verify order ownership before returning order details
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Crowdfunding

medium
Vulnerability
WP Crowdfunding — Check the campaign-submission capability in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Patterns Kit

medium
Vulnerability
Patterns Kit — Escape a link attribute before its client-side script inserts it into the page
Severity
medium Medium risk
Affected Versions
<=1.0.3
CVE Reference
Patch Status
No patch
Source
NVD

Cookie Consent

medium
Vulnerability
Cookie Consent — Correctly enforce its intended administrator-only capability check on its consent-settings REST rout
Severity
medium Medium risk
Affected Versions
<=0.0.10
CVE Reference
Patch Status
No patch
Source
NVD

Welcart e-Commerce

medium
Vulnerability
Welcart e-Commerce — Sanitise or escape a product field before outputting it on the product pages
Severity
medium Medium risk
Affected Versions
<=2.11.34
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel Engine

medium
Vulnerability
WP Travel Engine — Perform authorization or ownership checks when loading a caller-supplied booking identifier in one o
Severity
medium Medium risk
Affected Versions
<=6.8.5
CVE Reference
Patch Status
No patch
Source
NVD

WP Photo Album Plus

medium
Vulnerability
WP Photo Album Plus — Sanitise and escape a parameter before reflecting it into an inline script block
Severity
medium Medium risk
Affected Versions
<=9.2.07.002
CVE Reference
Patch Status
No patch
Source
NVD

User Access Manager

medium
Vulnerability
User Access Manager — Apply its access restrictions to REST API requests
Severity
medium Medium risk
Affected Versions
<=2.3.15
CVE Reference
Patch Status
No patch
Source
NVD

Cookie Consent

medium
Vulnerability
Cookie Consent — Correctly enforce its intended administrator-only capability check on the REST route that stores its
Severity
medium Medium risk
Affected Versions
<=0.0.10
CVE Reference
Patch Status
No patch
Source
NVD

WPC Admin Columns

medium
Vulnerability
WPC Admin Columns — Have authorisation checks in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.3.4
CVE Reference
Patch Status
No patch
Source
NVD

WP Photo Album Plus

medium
Vulnerability
WP Photo Album Plus — Check that the current user is allowed to upload into the album they target when it processes a fron
Severity
medium Medium risk
Affected Versions
<=9.2.09.002
CVE Reference
Patch Status
No patch
Source
NVD

ProSolution WP Client

medium
Vulnerability
ProSolution WP Client — Validate a user-supplied URL
Severity
medium Medium risk
Affected Versions
<=2.0.9
CVE Reference
Patch Status
No patch
Source
NVD

ProSolution WP Client

medium
Vulnerability
ProSolution WP Client — Perform capability checks on two administrative AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.0.9
CVE Reference
Patch Status
No patch
Source
NVD

Order Sync with Zendesk for WooCommerce

medium
Vulnerability
Order Sync with Zendesk for WooCommerce — Perform any capability check on one of its REST API endpoints
Severity
medium Medium risk
Affected Versions
<=2.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Royal Addons for Elementor

medium
Vulnerability
Royal Addons for Elementor — Validate a widget setting used to build an HTML tag before outputting it
Severity
medium Medium risk
Affected Versions
<=1.7.1065
CVE Reference
Patch Status
No patch
Source
NVD

Wallet System for WooCommerce

medium
Vulnerability
Wallet System for WooCommerce — Validate a user-supplied wallet amount against the customer's actual stored balance during checkout
Severity
medium Medium risk
Affected Versions
<=2.7.10
CVE Reference
Patch Status
No patch
Source
NVD

Welcart e-Commerce

medium
Vulnerability
Welcart e-Commerce — Verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthentic
Severity
medium Medium risk
Affected Versions
<=2.11.33
CVE Reference
Patch Status
No patch
Source
NVD

Payment Gateway for PayPal on WooCommerce

medium
Vulnerability
Payment Gateway for PayPal on WooCommerce — Verify that payment actually succeeded before completing an order in its PayPal return handler: it r
Severity
medium Medium risk
Affected Versions
<=9.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Properly authorise its front-end form submission REST routes and passes attacker-controlled input th
Severity
medium Medium risk
Affected Versions
<=6.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Payment Button for PayPal

medium
Vulnerability
Payment Button for PayPal — Enforce the merchant-configured price server-side and trusts a client-supplied payment amount
Severity
medium Medium risk
Affected Versions
<=1.2.3.44
CVE Reference
Patch Status
No patch
Source
NVD

Quick Paypal Payments

medium
Vulnerability
Quick Paypal Payments — Verify the paid amount
Severity
medium Medium risk
Affected Versions
<=5.7.50
CVE Reference
Patch Status
No patch
Source
NVD

Draft List is a

medium
Vulnerability
Draft List is a — Stored Cross-Site Scripting (XSS)
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Food Menu

medium
Vulnerability
Food Menu — Perform any capability or ownership check on its reservation-status update action
Severity
medium Medium risk
Affected Versions
<=6.0.2
CVE Reference
Patch Status
No patch
Source
NVD

ShopEngine Elementor WooCommerce Builder Addon

medium
Vulnerability
ShopEngine Elementor WooCommerce Builder Addon — Protect one of its authentication endpoints against CSRF
Severity
medium Medium risk
Affected Versions
<=4.9.3
CVE Reference
Patch Status
No patch
Source
NVD

Prevent Direct Access – Protect WordPress Files

medium
Vulnerability
Prevent Direct Access – Protect WordPress Files — Unauthorized access of protected files
Severity
medium Medium risk
Affected Versions
<=2.8.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PPWP – Password Protect Pages

medium
Vulnerability
PPWP – Password Protect Pages — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.9.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ecwid by Lightspeed Ecommerce Shopping Cart

medium
Vulnerability
Ecwid by Lightspeed Ecommerce Shopping Cart — Perform a capability check or nonce verification on one of its store-management actions
Severity
medium Medium risk
Affected Versions
<=7.0.9
CVE Reference
Patch Status
No patch
Source
NVD

Astro Booking Engine

medium
Vulnerability
Astro Booking Engine — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display

medium
Vulnerability
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Embed Google Photos album

medium
Vulnerability
Embed Google Photos album — Escape a shortcode attribute value before outputting it inside an HTML attribute
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Epeken All Kurir for Woocommerce

medium
Vulnerability
Epeken All Kurir for Woocommerce — Verify that a payment-confirmation request originates from the owner of the targeted order
Severity
medium Medium risk
Affected Versions
<=2.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder

medium
Vulnerability
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Pinpoint Booking System – Version 2

medium
Vulnerability
Pinpoint Booking System – Version 2 — Price Manipulation
Severity
medium Medium risk
Affected Versions
<=2.9.9.6.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Image Uploader for Welcart

medium
Vulnerability
Image Uploader for Welcart — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booking calendar, Appointment Booking System

medium
Vulnerability
Booking calendar, Appointment Booking System — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.2.36
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

KiviCare – Clinic & Patient Management System (EHR)

medium
Vulnerability
KiviCare – Clinic & Patient Management System (EHR) — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Hydra Booking — Appointment Scheduling & Booking Calendar

medium
Vulnerability
Hydra Booking — Appointment Scheduling & Booking Calendar — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

medium
Vulnerability
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder — Blind SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.15.44
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms

medium
Vulnerability
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms

medium
Vulnerability
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

medium
Vulnerability
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe — Second-Order SQL Injection
Severity
medium Medium risk
Affected Versions
<=30.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Beaver Builder Page Builder – Drag and Drop Website Builder

medium
Vulnerability
Beaver Builder Page Builder – Drag and Drop Website Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.10.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Groundhogg — CRM, Newsletters, and Marketing Automation

medium
Vulnerability
Groundhogg — CRM, Newsletters, and Marketing Automation — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.5.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ECS

medium
Vulnerability
ECS — Check the post status or any capability when rendering an Elementor document requested through one o
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

ECS

medium
Vulnerability
ECS — Perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

Simply Schedule Appointments

medium
Vulnerability
Simply Schedule Appointments — Restrict the user records returned by some of its REST endpoints to those the requester is entitled
Severity
medium Medium risk
Affected Versions
<=1.6.12.17
CVE Reference
Patch Status
No patch
Source
NVD

Product Feed PRO for WooCommerce by AdTribes

medium
Vulnerability
Product Feed PRO for WooCommerce by AdTribes — Perform an authorization check on one of its REST read routes
Severity
medium Medium risk
Affected Versions
<=13.5.7
CVE Reference
Patch Status
No patch
Source
NVD

Backup Migration

medium
Vulnerability
Backup Migration — Properly restrict a post-restore automatic login mechanism
Severity
medium Medium risk
Affected Versions
<=2.1.7
CVE Reference
Patch Status
No patch
Source
NVD

ECS

medium
Vulnerability
ECS — Have capability or ownership checks on its dynamic repeater actions
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

Slim SEO

low
Vulnerability
Slim SEO — Restrict a post-meta preview feature to posts the user is allowed to edit
Severity
low Low risk
Affected Versions
<=4.9.11
CVE Reference
Patch Status
No patch
Source
NVD

Nexter Blocks

low
Vulnerability
Nexter Blocks — Restrict who can save global CSS through one of its REST endpoints
Severity
low Low risk
Affected Versions
<=5.0.2
CVE Reference
Patch Status
No patch
Source
NVD

LearnPress

low
Vulnerability
LearnPress — Validate a user-supplied URL before the server fetches it
Severity
low Low risk
Affected Versions
<=4.4.4
CVE Reference
Patch Status
No patch
Source
NVD

Booking for Appointments and Events Calendar

low
Vulnerability
Booking for Appointments and Events Calendar — Verify that an authenticated employee (provider) is related to the customer whose record is being ac
Severity
low Low risk
Affected Versions
<=9.7
CVE Reference
Patch Status
No patch
Source
NVD

Accept PayPal & Stripe with Subscriptions for WooCommerce

low
Vulnerability
Accept PayPal & Stripe with Subscriptions for WooCommerce — Validate the amount actually paid against the order total in its PayPal Data Transfer return handler
Severity
low Low risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Estatik Real Estate Plugin

low
Vulnerability
Estatik Real Estate Plugin — Validate the same recipient list that it later uses to address the message sent by its property requ
Severity
low Low risk
Affected Versions
<=4.3.4
CVE Reference
Patch Status
No patch
Source
NVD

Booking for Appointments and Events Calendar

low
Vulnerability
Booking for Appointments and Events Calendar — Verify that an authenticated employee (provider) is assigned to the appointment being accessed
Severity
low Low risk
Affected Versions
<=2.4.6
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (1)

Samex - Clean, Minimal Shop WooCommerce

high
Vulnerability
Samex - Clean, Minimal Shop WooCommerce — CVE-2026-28154
Severity
high High risk
Affected Versions
<=2.5
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: August 25 – September 1, 2026

171 WordPress vulnerabilities disclosed between August 25 – September 1, 2026. 15 critical, 57 high severity. 0 patched, 171 unpatched.

WPSentry·Sep 1, 2026
Vulnerability Report

WordPress Vulnerability Report: August 24 – August 31, 2026

171 WordPress vulnerabilities disclosed between August 24 – August 31, 2026. 15 critical, 50 high severity. 0 patched, 171 unpatched.

WPSentry·Aug 31, 2026
Vulnerability Report

WordPress Vulnerability Report: August 23 – August 30, 2026

170 WordPress vulnerabilities disclosed between August 23 – August 30, 2026. 15 critical, 50 high severity. 0 patched, 170 unpatched.

WPSentry·Aug 30, 2026
Back to Blog