BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: July 18 – July 25, 2026

109 WordPress vulnerabilities disclosed between July 18 – July 25, 2026. 7 critical, 31 high severity. 1 patched, 108 unpatched.

WPSentryJuly 25, 202626 min read

During the reporting period (July 18 – July 25, 2026), 109 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

109
Total
7
Critical
31
High
69
Medium
2
Low
1
Patched
Table of Contents 114 plugins & components

WordPress Plugin Vulnerabilities (106)

Kirki

critical
Vulnerability
Kirki — Validate a user-supplied URL before requesting it server-side
Severity
critical Critical risk
Affected Versions
<=6.0.12
CVE Reference
Patch Status
No patch
Source
NVD

Easy Form Builder by WhiteStudio

critical
Vulnerability
Easy Form Builder by WhiteStudio — Unauthenticated Privilege Escalation to Administrator
Severity
critical Critical risk
Affected Versions
<=4.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more

critical
Vulnerability
GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more — Arbitrary file uploads
Severity
critical Critical risk
Affected Versions
<=1.12.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Customer Support Ticket System & Helpdesk

critical
Vulnerability
Customer Support Ticket System & Helpdesk — Code Injection
Severity
critical Critical risk
Affected Versions
<=6.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MountDev AI MCP Connector for WordPress

critical
Vulnerability
MountDev AI MCP Connector for WordPress — Authorization bypass
Severity
critical Critical risk
Affected Versions
<=1.6.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SAML Single Sign On – SSO Login

critical
Vulnerability
SAML Single Sign On – SSO Login — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=5.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Project Management, Bug and Issue Tracking Plugin

critical
Vulnerability
Project Management, Bug and Issue Tracking Plugin — Sanitise and escape user supplied input before using it in a SQL query
Severity
critical Critical risk
Affected Versions
<=5.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Unlimited Elements For Elementor

high
Vulnerability
Unlimited Elements For Elementor — Sanitize or escape Google review content fetched from the Serp API before rendering it in the Google
Severity
high High risk
Affected Versions
<=2.0.11
CVE Reference
Patch Status
No patch
Source
NVD

Modern Event Calendar Pro

high
Vulnerability
Modern Event Calendar Pro — Attackers to extract sensitive data from the database
Severity
high High risk
Affected Versions
<=7.34.0
CVE Reference
Patch Status
No patch
Source
NVD

SlimStat Analytics

high
Vulnerability
SlimStat Analytics — Escape a visitor-controlled geolocation value before outputting it in its admin analytics reports
Severity
high High risk
Affected Versions
<=5.5.0
CVE Reference
Patch Status
No patch
Source
NVD

LearnPress

high
Vulnerability
LearnPress — Escape a search parameter before reflecting it into an HTML attribute
Severity
high High risk
Affected Versions
<=4.4.1
CVE Reference
Patch Status
No patch
Source
NVD

Social Login, Passkeys, Magic Link & Email OTP

high
Vulnerability
Social Login, Passkeys, Magic Link & Email OTP — Enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verif
Severity
high High risk
Affected Versions
<=1.4.1
CVE Reference
Patch Status
No patch
Source
NVD

Tag Groups is the Advanced Way to Display Your Taxonomy Terms

high
Vulnerability
Tag Groups is the Advanced Way to Display Your Taxonomy Terms — Properly escape one of its AJAX parameters before reflecting it in the response body served with an
Severity
high High risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Free Builder for Elementor

high
Vulnerability
Free Builder for Elementor — Sanitise submitted contact form field values before storing them and outputting them in the admin da
Severity
high High risk
Affected Versions
<=1.6.7
CVE Reference
Patch Status
No patch
Source
NVD

bpost-shipping-platform

high
Vulnerability
bpost-shipping-platform — Properly sanitize a parameter before using it in a SQL query during WooCommerce order submission
Severity
high High risk
Affected Versions
<=3.2.3
CVE Reference
Patch Status
No patch
Source
NVD

MapSVG

high
Vulnerability
MapSVG — Arbitrary file uploads
Severity
high High risk
Affected Versions
<=8.14.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms

high
Vulnerability
Ninja Forms — Unauthenticated attackers to inject arbitrary numeric values into form calculations and payment tota
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Foodbakery

high
Vulnerability
WP Foodbakery — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=4.9
CVE Reference
Patch Status
No patch
Source
NVD

Product Addons and Product Options With Custom Fields

high
Vulnerability
Product Addons and Product Options With Custom Fields — Restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served in
Severity
high High risk
Affected Versions
<=1.6.15
CVE Reference
Patch Status
No patch
Source
NVD

Events Manager

high
Vulnerability
Events Manager — Safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-suppli
Severity
high High risk
Affected Versions
<=7.3.7
CVE Reference
Patch Status
No patch
Source
NVD

FormCraft

high
Vulnerability
FormCraft — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.9.14
CVE Reference
Patch Status
No patch
Source
NVD

SUMO Reward Points

high
Vulnerability
SUMO Reward Points — Unauthenticated Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=32.7.0
CVE Reference
Patch Status
No patch
Source
NVD

Praison AI SEO

high
Vulnerability
Praison AI SEO — Perform authorization checks on several of its REST API routes
Severity
high High risk
Affected Versions
<=5.0.7
CVE Reference
Patch Status
No patch
Source
NVD

security-ninja-premium

high
Vulnerability
security-ninja-premium — Verify the second authentication factor in one of its two-factor authentication code paths
Severity
high High risk
Affected Versions
<=5.290
CVE Reference
Patch Status
No patch
Source
NVD

ARforms

high
Vulnerability
ARforms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=7.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Lumise Product Designer for WooCommerce

high
Vulnerability
Lumise Product Designer for WooCommerce — SQL Injection
Severity
high High risk
Affected Versions
<=2.1.1
CVE Reference
Patch Status
No patch
Source
NVD

MDJM Event Management

high
Vulnerability
MDJM Event Management — Privilege Escalation
Severity
high High risk
Affected Versions
<=1.7.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPO365 | Login

high
Vulnerability
WPO365 | Login — Cross-Site Request Forgery
Severity
high High risk
Affected Versions
<=43.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Wpify Woo

high
Vulnerability
Wpify Woo — Privilege Escalation
Severity
high High risk
Affected Versions
<=5.4.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
high
Vulnerability
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content — Consistently enforce the role restriction configured on its front-end registration role-selection fi
Severity
high High risk
Affected Versions
<=4.16.18
CVE Reference
Patch Status
No patch
Source
NVD

CAFEHAUS API

high
Vulnerability
CAFEHAUS API — Have any authentication or authorisation when updating user passwords
Severity
high High risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

WowOptin: Next-Gen Popup Maker

high
Vulnerability
WowOptin: Next-Gen Popup Maker — Have proper authorization on a REST endpoint
Severity
high High risk
Affected Versions
<=1.4.38
CVE Reference
Patch Status
No patch
Source
NVD

EventON Action User

high
Vulnerability
EventON Action User — Authorization bypass
Severity
high High risk
Affected Versions
<=2.5.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

VikBooking Hotel Booking Engine & PMS

high
Vulnerability
VikBooking Hotel Booking Engine & PMS — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.8.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Appointments

high
Vulnerability
Easy Appointments — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=3.12.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPForms Pro

high
Vulnerability
WPForms Pro — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=1.10.1.1
CVE Reference
Patch Status
No patch
Source
NVD

WCPOS – Point of Sale (POS) plugin for WooCommerce

medium
Vulnerability
WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter
Severity
medium Medium risk
Affected Versions
<=1.9.8
CVE Reference
Patch Status
1.9.9
Source
Wordfence
Plugin Page

Flow Payment

medium
Vulnerability
Flow Payment — Reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order ca
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Reviews Feed

medium
Vulnerability
Reviews Feed — Neutralize WordPress shortcodes contained in third-party review content before rendering it through
Severity
medium Medium risk
Affected Versions
<=2.6.5
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

medium
Vulnerability
WP Travel — Perform capability or ownership checks on its booking cancellation action
Severity
medium Medium risk
Affected Versions
<=11.7.1
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Perform any authorisation check on one of its REST routes
Severity
medium Medium risk
Affected Versions
<=6.0.12
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Sanitise or escape the email subject and body values supplied in a request before including them in
Severity
medium Medium risk
Affected Versions
<=6.0.12
CVE Reference
Patch Status
No patch
Source
NVD

All-in-One WP Migration and Backup

medium
Vulnerability
All-in-One WP Migration and Backup — Properly sanitise a user-supplied value before using it to build a file path
Severity
medium Medium risk
Affected Versions
<=7.106
CVE Reference
Patch Status
No patch
Source
NVD

PayPlus Payment Gateway

medium
Vulnerability
PayPlus Payment Gateway — Perform authorization or order-ownership validation in one of its AJAX actions available to unauthen
Severity
medium Medium risk
Affected Versions
<=8.2.2
CVE Reference
Patch Status
No patch
Source
NVD

PayPlus Payment Gateway

medium
Vulnerability
PayPlus Payment Gateway — Perform authorization or order-ownership validation in one of its AJAX actions available to unauthen
Severity
medium Medium risk
Affected Versions
<=8.2.2
CVE Reference
Patch Status
No patch
Source
NVD

MailerSend

medium
Vulnerability
MailerSend — Perform a nonce check on its configuration-delete action (it verifies the manage_options capability
Severity
medium Medium risk
Affected Versions
<=1.0.8
CVE Reference
Patch Status
No patch
Source
NVD

ThumbPress

medium
Vulnerability
ThumbPress — Perform a capability check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=6.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Elementor Website Builder

medium
Vulnerability
Elementor Website Builder — Properly check user permissions before returning post data through one of its REST endpoints
Severity
medium Medium risk
Affected Versions
<=4.1.4
CVE Reference
Patch Status
No patch
Source
NVD

Spectra Gutenberg Blocks – Website Builder for the Block Editor

medium
Vulnerability
Spectra Gutenberg Blocks – Website Builder for the Block Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.19.28
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Essential Addons for Elementor – Popular Elementor Templates & Widgets

medium
Vulnerability
Essential Addons for Elementor – Popular Elementor Templates & Widgets — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.6.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

medium
Vulnerability
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.0.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bit Form

medium
Vulnerability
Bit Form — Restrict a form file-field value to a safe path before reading the file and attaching it to a notifi
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Bit Form

medium
Vulnerability
Bit Form — Properly validate its workflow-trigger token once the associated transient has expired
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Classified Listing

medium
Vulnerability
Classified Listing — Verify that the order targeted by its payment-receipt handler belongs to the requesting user
Severity
medium Medium risk
Affected Versions
<=5.3.9
CVE Reference
Patch Status
No patch
Source
NVD

Academy LMS

medium
Vulnerability
Academy LMS — Verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers
Severity
medium Medium risk
Affected Versions
<=3.8.1
CVE Reference
Patch Status
No patch
Source
NVD

WPBot

medium
Vulnerability
WPBot — Perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers
Severity
medium Medium risk
Affected Versions
<=8.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Essential Addons for Elementor – Popular Elementor Templates & Widgets

medium
Vulnerability
Essential Addons for Elementor – Popular Elementor Templates & Widgets — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.6.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tutor LMS Elementor Addons

medium
Vulnerability
Tutor LMS Elementor Addons — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=4.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms

medium
Vulnerability
Ninja Forms — Authenticated attackers with Author-level privileges to expose stored form submissions to unauthenti
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms

medium
Vulnerability
Ninja Forms — Unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadat
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Timetics

medium
Vulnerability
Timetics — Enforce a pending or unpaid status for new bookings created through a payment method other than its
Severity
medium Medium risk
Affected Versions
<=1.0.57
CVE Reference
Patch Status
No patch
Source
NVD

Ultimate Addons for Elementor

medium
Vulnerability
Ultimate Addons for Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Contact Form 7 – Dynamic Text Extension

medium
Vulnerability
The Contact Form 7 – Dynamic Text Extension — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.0.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Compress

medium
Vulnerability
WP Compress — Validate the value of a query parameter that controls the asset CDN host before using it to build th
Severity
medium Medium risk
Affected Versions
<=7.10.04
CVE Reference
Patch Status
No patch
Source
NVD

Post Status Notifier Lite

medium
Vulnerability
Post Status Notifier Lite — Properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin
Severity
medium Medium risk
Affected Versions
<=1.13.0
CVE Reference
Patch Status
No patch
Source
NVD

WP Shortcode by MyThemeShop

medium
Vulnerability
WP Shortcode by MyThemeShop — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.4.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Webpushr Push Notifications

medium
Vulnerability
Webpushr Push Notifications — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.39.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AI Copilot – Content Generator

medium
Vulnerability
AI Copilot – Content Generator — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.5.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Registrations For The Events Calendar

medium
Vulnerability
Registrations For The Events Calendar — SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance

medium
Vulnerability
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.46.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Premium Packages – Sell Digital Products Securely

medium
Vulnerability
Premium Packages – Sell Digital Products Securely — Authentication Bypass
Severity
medium Medium risk
Affected Versions
<=7.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Header Footer Script Adder – Insert Code in Header, Body & Footer

medium
Vulnerability
Header Footer Script Adder – Insert Code in Header, Body & Footer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Lpagery

medium
Vulnerability
Lpagery — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.5.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tickera – Sell Tickets & Manage Events

medium
Vulnerability
Tickera – Sell Tickets & Manage Events — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.6.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Brands for WooCommerce

medium
Vulnerability
Brands for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Brands for WooCommerce

medium
Vulnerability
Brands for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tickera – Sell Tickets & Manage Events

medium
Vulnerability
Tickera – Sell Tickets & Manage Events — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.6.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan

medium
Vulnerability
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=7.8.6.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Grid/List View for WooCommerce

medium
Vulnerability
Grid/List View for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GutenKit Blocks

medium
Vulnerability
GutenKit Blocks — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=2.4.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Premium Packages – Sell Digital Products Securely

medium
Vulnerability
Premium Packages – Sell Digital Products Securely — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=7.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WCPOS – Point of Sale (POS) plugin for WooCommerce

medium
Vulnerability
WCPOS – Point of Sale (POS) plugin for WooCommerce — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=1.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MapSVG

medium
Vulnerability
MapSVG — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=8.14.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Participants Database

medium
Vulnerability
Participants Database — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=2.7.8.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kirki – Freeform Page Builder, Website Builder & Customizer

medium
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=6.0.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Grid Gutenberg Blocks – PostX

medium
Vulnerability
Post Grid Gutenberg Blocks – PostX — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.0.32
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder

medium
Vulnerability
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=5.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Firelight Lightbox

medium
Vulnerability
Firelight Lightbox — Stored DOM Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.20
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ProfileGrid

medium
Vulnerability
ProfileGrid — Verify PayPal IPN notifications before granting paid group membership
Severity
medium Medium risk
Affected Versions
<=5.9.9.7
CVE Reference
Patch Status
No patch
Source
NVD

ProfileGrid

medium
Vulnerability
ProfileGrid — Perform any authorization or ownership check on some of its private-message thread actions
Severity
medium Medium risk
Affected Versions
<=5.9.9.7
CVE Reference
Patch Status
No patch
Source
NVD

Payment Plugins for Stripe WooCommerce

medium
Vulnerability
Payment Plugins for Stripe WooCommerce — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Hotel Booking

medium
Vulnerability
WP Hotel Booking — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Brands for WooCommerce

medium
Vulnerability
Brands for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Visualizer – Tables & Charts Manager with Built-in AI Generator

medium
Vulnerability
Visualizer – Tables & Charts Manager with Built-in AI Generator — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fluent Support – Helpdesk & Customer Support Ticket System

medium
Vulnerability
Fluent Support – Helpdesk & Customer Support Ticket System — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Open User Map – Interactive Leaflet Maps

medium
Vulnerability
Open User Map – Interactive Leaflet Maps — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.4.45
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

VikBooking Hotel Booking Engine & PMS

medium
Vulnerability
VikBooking Hotel Booking Engine & PMS — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.8.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Rich Showcase for Google Reviews

medium
Vulnerability
Rich Showcase for Google Reviews — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.9.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SureDash – Community, Courses & Member Dashboard

medium
Vulnerability
SureDash – Community, Courses & Member Dashboard — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.10.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms – The Contact Form Builder That Grows With You

medium
Vulnerability
Ninja Forms – The Contact Form Builder That Grows With You — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.14.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Checkout Field Editor for WooCommerce (Pro)

medium
Vulnerability
Checkout Field Editor for WooCommerce (Pro) — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=3.7.7
CVE Reference
Patch Status
No patch
Source
NVD

Yoast SEO – Advanced SEO with real-time guidance and built-in AI

medium
Vulnerability
Yoast SEO – Advanced SEO with real-time guidance and built-in AI — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=28.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

All in One SEO

low
Vulnerability
All in One SEO — Correctly restrict access to some of its AI integration REST API endpoints
Severity
low Low risk
Affected Versions
<=4.9.9
CVE Reference
Patch Status
No patch
Source
NVD

ProfileGrid

low
Vulnerability
ProfileGrid — Perform a capability check on its license management actions
Severity
low Low risk
Affected Versions
<=5.9.9.7
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (3)

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education

high
Vulnerability
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education — CVE-2026-65500
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education

high
Vulnerability
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education — CVE-2026-65511
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education

medium
Vulnerability
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education — CVE-2026-65522
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: July 17 – July 24, 2026

93 WordPress vulnerabilities disclosed between July 17 – July 24, 2026. 6 critical, 24 high severity. 1 patched, 92 unpatched.

WPSentry·Jul 24, 2026
Vulnerability Report

WordPress Vulnerability Report: July 16 – July 23, 2026

92 WordPress vulnerabilities disclosed between July 16 – July 23, 2026. 5 critical, 25 high severity. 1 patched, 91 unpatched.

WPSentry·Jul 23, 2026
Vulnerability Report

WordPress Vulnerability Report: July 15 – July 22, 2026

111 WordPress vulnerabilities disclosed between July 15 – July 22, 2026. 7 critical, 27 high severity. 1 patched, 110 unpatched.

WPSentry·Jul 22, 2026
Back to Blog