BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: July 16 – July 23, 2026

92 WordPress vulnerabilities disclosed between July 16 – July 23, 2026. 5 critical, 25 high severity. 1 patched, 91 unpatched.

WPSentryJuly 23, 202623 min read

During the reporting period (July 16 – July 23, 2026), 92 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

92
Total
5
Critical
25
High
61
Medium
1
Low
1
Patched
Table of Contents 97 plugins & components

WordPress Plugin Vulnerabilities (92)

Bricksforge

critical
Vulnerability
Bricksforge — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=3.1.8.6
CVE Reference
Patch Status
No patch
Source
NVD

Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit

critical
Vulnerability
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=2.8.4
CVE Reference
Patch Status
No patch
Source
NVD

AI Copilot

critical
Vulnerability
AI Copilot — Bind OAuth access tokens to a WordPress user
Severity
critical Critical risk
Affected Versions
<=1.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

critical
Vulnerability
Kirki — Validate a user-supplied URL before requesting it server-side
Severity
critical Critical risk
Affected Versions
<=6.0.12
CVE Reference
Patch Status
No patch
Source
NVD

Easy Form Builder by WhiteStudio

critical
Vulnerability
Easy Form Builder by WhiteStudio — Unauthenticated Privilege Escalation to Administrator
Severity
critical Critical risk
Affected Versions
<=4.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Digits: WordPress Mobile Number Signup and Login

high
Vulnerability
Digits: WordPress Mobile Number Signup and Login — Privilege Escalation
Severity
high High risk
Affected Versions
<=9.1.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Loco Translate

high
Vulnerability
Loco Translate — Cross-Site Request Forgery
Severity
high High risk
Affected Versions
<=2.8.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin

high
Vulnerability
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=7.3.1.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

high
Vulnerability
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell — Privilege Escalation
Severity
high High risk
Affected Versions
<=3.12.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Breakdance

high
Vulnerability
Breakdance — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.7.1
CVE Reference
Patch Status
No patch
Source
NVD

Kali Forms — Contact Form & Drag-and-Drop Builder

high
Vulnerability
Kali Forms — Contact Form & Drag-and-Drop Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.4.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

high
Vulnerability
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=4.16.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

high
Vulnerability
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — Sensitive Information Exposure
Severity
high High risk
Affected Versions
<=4.4.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PhonePe Payment Solutions

high
Vulnerability
PhonePe Payment Solutions — Properly verify the authenticity of incoming payment callbacks: the secret used to validate the call
Severity
high High risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD

User Registration & Membership

high
Vulnerability
User Registration & Membership — Validate that the membership tier submitted during public registration is one of the tiers allowed b
Severity
high High risk
Affected Versions
<=5.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Unlimited Elements For Elementor

high
Vulnerability
Unlimited Elements For Elementor — Sanitize or escape Google review content fetched from the Serp API before rendering it in the Google
Severity
high High risk
Affected Versions
<=2.0.11
CVE Reference
Patch Status
No patch
Source
NVD

Modern Event Calendar Pro

high
Vulnerability
Modern Event Calendar Pro — Attackers to extract sensitive data from the database
Severity
high High risk
Affected Versions
<=7.34.0
CVE Reference
Patch Status
No patch
Source
NVD

SlimStat Analytics

high
Vulnerability
SlimStat Analytics — Escape a visitor-controlled geolocation value before outputting it in its admin analytics reports
Severity
high High risk
Affected Versions
<=5.5.0
CVE Reference
Patch Status
No patch
Source
NVD

LearnPress

high
Vulnerability
LearnPress — Escape a search parameter before reflecting it into an HTML attribute
Severity
high High risk
Affected Versions
<=4.4.1
CVE Reference
Patch Status
No patch
Source
NVD

Social Login, Passkeys, Magic Link & Email OTP

high
Vulnerability
Social Login, Passkeys, Magic Link & Email OTP — Enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verif
Severity
high High risk
Affected Versions
<=1.4.1
CVE Reference
Patch Status
No patch
Source
NVD

Tag Groups is the Advanced Way to Display Your Taxonomy Terms

high
Vulnerability
Tag Groups is the Advanced Way to Display Your Taxonomy Terms — Properly escape one of its AJAX parameters before reflecting it in the response body served with an
Severity
high High risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Free Builder for Elementor

high
Vulnerability
Free Builder for Elementor — Sanitise submitted contact form field values before storing them and outputting them in the admin da
Severity
high High risk
Affected Versions
<=1.6.7
CVE Reference
Patch Status
No patch
Source
NVD

bpost-shipping-platform

high
Vulnerability
bpost-shipping-platform — Properly sanitize a parameter before using it in a SQL query during WooCommerce order submission
Severity
high High risk
Affected Versions
<=3.2.3
CVE Reference
Patch Status
No patch
Source
NVD

MapSVG

high
Vulnerability
MapSVG — Arbitrary file uploads
Severity
high High risk
Affected Versions
<=8.14.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms

high
Vulnerability
Ninja Forms — Unauthenticated attackers to inject arbitrary numeric values into form calculations and payment tota
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Foodbakery

high
Vulnerability
WP Foodbakery — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=4.9
CVE Reference
Patch Status
No patch
Source
NVD

Product Addons and Product Options With Custom Fields

high
Vulnerability
Product Addons and Product Options With Custom Fields — Restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served in
Severity
high High risk
Affected Versions
<=1.6.15
CVE Reference
Patch Status
No patch
Source
NVD

Events Manager

high
Vulnerability
Events Manager — Safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-suppli
Severity
high High risk
Affected Versions
<=7.3.7
CVE Reference
Patch Status
No patch
Source
NVD

FormCraft

high
Vulnerability
FormCraft — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.9.14
CVE Reference
Patch Status
No patch
Source
NVD

SUMO Reward Points

high
Vulnerability
SUMO Reward Points — Unauthenticated Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=32.7.0
CVE Reference
Patch Status
No patch
Source
NVD

Kirki – Freeform Page Builder, Website Builder & Customizer

medium
Vulnerability
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
Severity
medium Medium risk
Affected Versions
<=6.0.13
CVE Reference
Patch Status
6.0.14
Source
Wordfence
Plugin Page

Tickera – Sell Tickets & Manage Events

medium
Vulnerability
Tickera – Sell Tickets & Manage Events — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.6.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tickera – Sell Tickets & Manage Events

medium
Vulnerability
Tickera – Sell Tickets & Manage Events — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.6.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Quiz Master Next

medium
Vulnerability
Quiz Master Next — SQL Injection
Severity
medium Medium risk
Affected Versions
<=11.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

wpForo Forum

medium
Vulnerability
wpForo Forum — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tutor LMS – eLearning and online course solution

medium
Vulnerability
Tutor LMS – eLearning and online course solution — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Delicious Recipes

medium
Vulnerability
Delicious Recipes — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.10.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

medium
Vulnerability
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=8.5.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SysBasics Customize My Account for WooCommerce – Live My Account Customizer

medium
Vulnerability
SysBasics Customize My Account for WooCommerce – Live My Account Customizer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.4.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Cache Purger

medium
Vulnerability
The Cache Purger — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.3.20
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Themify Builder

medium
Vulnerability
Themify Builder — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=7.7.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

medium
Vulnerability
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=8.5.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP TripAdvisor Review Slider

medium
Vulnerability
WP TripAdvisor Review Slider — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=14.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Bulk Delete

medium
Vulnerability
WP Bulk Delete — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.4.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booking for Appointments and Events Calendar – Amelia

medium
Vulnerability
Booking for Appointments and Events Calendar – Amelia — SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.4.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Smart Custom Fields

medium
Vulnerability
Smart Custom Fields — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Ninja Forms - Excel Export

medium
Vulnerability
Ninja Forms - Excel Export — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms - Excel Export

medium
Vulnerability
Ninja Forms - Excel Export — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=3.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fense Proxy & VPN Blocker

medium
Vulnerability
Fense Proxy & VPN Blocker — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=3.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

pCloud WP Backup

medium
Vulnerability
pCloud WP Backup — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=2.0.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms - Excel Export

medium
Vulnerability
Ninja Forms - Excel Export — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce

medium
Vulnerability
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.17.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kirki – Freeform Page Builder, Website Builder & Customizer

medium
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=6.0.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form

medium
Vulnerability
ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Hotel Booking

medium
Vulnerability
WP Hotel Booking — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

NEX-Forms

medium
Vulnerability
NEX-Forms — Sanitise and escape some submitted form data before storing it and outputting it back in the admin d
Severity
medium Medium risk
Affected Versions
<=9.2.3
CVE Reference
Patch Status
No patch
Source
NVD

User Registration & Membership

medium
Vulnerability
User Registration & Membership — Perform a capability check for unauthenticated callers on one of its membership payment actions and
Severity
medium Medium risk
Affected Versions
<=5.2.3
CVE Reference
Patch Status
No patch
Source
NVD

WPS Bookings for WooCommerce

medium
Vulnerability
WPS Bookings for WooCommerce — Verify that a booking order belongs to the requesting user before cancelling it
Severity
medium Medium risk
Affected Versions
<=3.11.7
CVE Reference
Patch Status
No patch
Source
NVD

Royal Addons for Elementor

medium
Vulnerability
Royal Addons for Elementor — Check the post status of menu items or the templates they reference in one of its REST endpoints
Severity
medium Medium risk
Affected Versions
<=1.7.1063
CVE Reference
Patch Status
No patch
Source
NVD

HubSpot All-In-One Marketing – Forms, Popups, Live Chat

medium
Vulnerability
HubSpot All-In-One Marketing – Forms, Popups, Live Chat — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=11.3.62
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

W3SC Elementor to Zoho CRM

medium
Vulnerability
W3SC Elementor to Zoho CRM — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Flow Payment

medium
Vulnerability
Flow Payment — Reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order ca
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Reviews Feed

medium
Vulnerability
Reviews Feed — Neutralize WordPress shortcodes contained in third-party review content before rendering it through
Severity
medium Medium risk
Affected Versions
<=2.6.5
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

medium
Vulnerability
WP Travel — Perform capability or ownership checks on its booking cancellation action
Severity
medium Medium risk
Affected Versions
<=11.7.1
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Perform any authorisation check on one of its REST routes
Severity
medium Medium risk
Affected Versions
<=6.0.12
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Sanitise or escape the email subject and body values supplied in a request before including them in
Severity
medium Medium risk
Affected Versions
<=6.0.12
CVE Reference
Patch Status
No patch
Source
NVD

All-in-One WP Migration and Backup

medium
Vulnerability
All-in-One WP Migration and Backup — Properly sanitise a user-supplied value before using it to build a file path
Severity
medium Medium risk
Affected Versions
<=7.106
CVE Reference
Patch Status
No patch
Source
NVD

PayPlus Payment Gateway

medium
Vulnerability
PayPlus Payment Gateway — Perform authorization or order-ownership validation in one of its AJAX actions available to unauthen
Severity
medium Medium risk
Affected Versions
<=8.2.2
CVE Reference
Patch Status
No patch
Source
NVD

PayPlus Payment Gateway

medium
Vulnerability
PayPlus Payment Gateway — Perform authorization or order-ownership validation in one of its AJAX actions available to unauthen
Severity
medium Medium risk
Affected Versions
<=8.2.2
CVE Reference
Patch Status
No patch
Source
NVD

MailerSend

medium
Vulnerability
MailerSend — Perform a nonce check on its configuration-delete action (it verifies the manage_options capability
Severity
medium Medium risk
Affected Versions
<=1.0.8
CVE Reference
Patch Status
No patch
Source
NVD

ThumbPress

medium
Vulnerability
ThumbPress — Perform a capability check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=6.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Elementor Website Builder

medium
Vulnerability
Elementor Website Builder — Properly check user permissions before returning post data through one of its REST endpoints
Severity
medium Medium risk
Affected Versions
<=4.1.4
CVE Reference
Patch Status
No patch
Source
NVD

Spectra Gutenberg Blocks – Website Builder for the Block Editor

medium
Vulnerability
Spectra Gutenberg Blocks – Website Builder for the Block Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.19.28
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Essential Addons for Elementor – Popular Elementor Templates & Widgets

medium
Vulnerability
Essential Addons for Elementor – Popular Elementor Templates & Widgets — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.6.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

medium
Vulnerability
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.0.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bit Form

medium
Vulnerability
Bit Form — Restrict a form file-field value to a safe path before reading the file and attaching it to a notifi
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Bit Form

medium
Vulnerability
Bit Form — Properly validate its workflow-trigger token once the associated transient has expired
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Classified Listing

medium
Vulnerability
Classified Listing — Verify that the order targeted by its payment-receipt handler belongs to the requesting user
Severity
medium Medium risk
Affected Versions
<=5.3.9
CVE Reference
Patch Status
No patch
Source
NVD

Academy LMS

medium
Vulnerability
Academy LMS — Verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers
Severity
medium Medium risk
Affected Versions
<=3.8.1
CVE Reference
Patch Status
No patch
Source
NVD

WPBot

medium
Vulnerability
WPBot — Perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers
Severity
medium Medium risk
Affected Versions
<=8.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Essential Addons for Elementor – Popular Elementor Templates & Widgets

medium
Vulnerability
Essential Addons for Elementor – Popular Elementor Templates & Widgets — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.6.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tutor LMS Elementor Addons

medium
Vulnerability
Tutor LMS Elementor Addons — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=4.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms

medium
Vulnerability
Ninja Forms — Authenticated attackers with Author-level privileges to expose stored form submissions to unauthenti
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms

medium
Vulnerability
Ninja Forms — Unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadat
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Timetics

medium
Vulnerability
Timetics — Enforce a pending or unpaid status for new bookings created through a payment method other than its
Severity
medium Medium risk
Affected Versions
<=1.0.57
CVE Reference
Patch Status
No patch
Source
NVD

Ultimate Addons for Elementor

medium
Vulnerability
Ultimate Addons for Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Contact Form 7 – Dynamic Text Extension

medium
Vulnerability
The Contact Form 7 – Dynamic Text Extension — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.0.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Praison AI SEO

medium
Vulnerability
Praison AI SEO — Perform authorization checks on several of its REST API routes
Severity
medium Medium risk
Affected Versions
<=5.0.7
CVE Reference
Patch Status
No patch
Source
NVD

security-ninja-premium

medium
Vulnerability
security-ninja-premium — Verify the second authentication factor in one of its two-factor authentication code paths
Severity
medium Medium risk
Affected Versions
<=5.290
CVE Reference
Patch Status
No patch
Source
NVD

WP Compress

medium
Vulnerability
WP Compress — Validate the value of a query parameter that controls the asset CDN host before using it to build th
Severity
medium Medium risk
Affected Versions
<=7.10.04
CVE Reference
Patch Status
No patch
Source
NVD

Post Status Notifier Lite

medium
Vulnerability
Post Status Notifier Lite — Properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin
Severity
medium Medium risk
Affected Versions
<=1.13.0
CVE Reference
Patch Status
No patch
Source
NVD

All in One SEO

low
Vulnerability
All in One SEO — Correctly restrict access to some of its AI integration REST API endpoints
Severity
low Low risk
Affected Versions
<=4.9.9
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (0)

No vulnerabilities reported in this category this week.

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: July 15 – July 22, 2026

111 WordPress vulnerabilities disclosed between July 15 – July 22, 2026. 7 critical, 27 high severity. 1 patched, 110 unpatched.

WPSentry·Jul 22, 2026
Vulnerability Report

WordPress Vulnerability Report: July 14 – July 21, 2026

107 WordPress vulnerabilities disclosed between July 14 – July 21, 2026. 8 critical, 23 high severity. 1 patched, 106 unpatched.

WPSentry·Jul 21, 2026
Vulnerability Report

WordPress Vulnerability Report: July 13 – July 20, 2026

110 WordPress vulnerabilities disclosed between July 13 – July 20, 2026. 7 critical, 23 high severity. 1 patched, 109 unpatched.

WPSentry·Jul 20, 2026
Back to Blog