BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: July 22 – July 29, 2026

155 WordPress vulnerabilities disclosed between July 22 – July 29, 2026. 13 critical, 42 high severity. 1 patched, 154 unpatched.

WPSentryJuly 29, 202637 min read

During the reporting period (July 22 – July 29, 2026), 155 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

155
Total
13
Critical
42
High
96
Medium
4
Low
1
Patched
Table of Contents 160 plugins & components

WordPress Plugin Vulnerabilities (151)

GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more

critical
Vulnerability
GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more — Arbitrary file uploads
Severity
critical Critical risk
Affected Versions
<=1.12.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Customer Support Ticket System & Helpdesk

critical
Vulnerability
Customer Support Ticket System & Helpdesk — Code Injection
Severity
critical Critical risk
Affected Versions
<=6.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MountDev AI MCP Connector for WordPress

critical
Vulnerability
MountDev AI MCP Connector for WordPress — Authorization bypass
Severity
critical Critical risk
Affected Versions
<=1.6.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SAML Single Sign On – SSO Login

critical
Vulnerability
SAML Single Sign On – SSO Login — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=5.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Project Management, Bug and Issue Tracking Plugin

critical
Vulnerability
Project Management, Bug and Issue Tracking Plugin — Sanitise and escape user supplied input before using it in a SQL query
Severity
critical Critical risk
Affected Versions
<=5.1.0
CVE Reference
Patch Status
No patch
Source
NVD

MemberGlut

critical
Vulnerability
MemberGlut — Validate the role chosen during front-end registration
Severity
critical Critical risk
Affected Versions
<=1.1.5
CVE Reference
Patch Status
No patch
Source
NVD

Masteriyo LMS

critical
Vulnerability
Masteriyo LMS — Correctly verify authorization on an unauthenticated AJAX action used to clear user sessions
Severity
critical Critical risk
Affected Versions
<=2.3.1
CVE Reference
Patch Status
No patch
Source
NVD

微信二维码登陆

critical
Vulnerability
微信二维码登陆 — Properly validate WeChat webhook requests
Severity
critical Critical risk
Affected Versions
<=1.3
CVE Reference
Patch Status
No patch
Source
NVD

Realtyna Organic IDX plugin + WPL Real Estate

critical
Vulnerability
Realtyna Organic IDX plugin + WPL Real Estate — Validate the type of uploaded files
Severity
critical Critical risk
Affected Versions
<=5.3.0
CVE Reference
Patch Status
No patch
Source
NVD

FacturaONE para WooCommerce con VeriFactu

critical
Vulnerability
FacturaONE para WooCommerce con VeriFactu — Authenticate one of its request handlers
Severity
critical Critical risk
Affected Versions
<=5.37
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

critical
Vulnerability
TrueBooker — Validate account ownership when resetting a user's password through one of its front-end account han
Severity
critical Critical risk
Affected Versions
<=1.2.4
CVE Reference
Patch Status
No patch
Source
NVD

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

critical
Vulnerability
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — Authentication Bypass leading to Account Takeover
Severity
critical Critical risk
Affected Versions
<=3.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …

critical
Vulnerability
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … — Authentication Bypass
Severity
critical Critical risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FormCraft

high
Vulnerability
FormCraft — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.9.14
CVE Reference
Patch Status
No patch
Source
NVD

SUMO Reward Points

high
Vulnerability
SUMO Reward Points — Unauthenticated Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=32.7.0
CVE Reference
Patch Status
No patch
Source
NVD

Praison AI SEO

high
Vulnerability
Praison AI SEO — Perform authorization checks on several of its REST API routes
Severity
high High risk
Affected Versions
<=5.0.7
CVE Reference
Patch Status
No patch
Source
NVD

security-ninja-premium

high
Vulnerability
security-ninja-premium — Verify the second authentication factor in one of its two-factor authentication code paths
Severity
high High risk
Affected Versions
<=5.290
CVE Reference
Patch Status
No patch
Source
NVD

ARforms

high
Vulnerability
ARforms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=7.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Lumise Product Designer for WooCommerce

high
Vulnerability
Lumise Product Designer for WooCommerce — SQL Injection
Severity
high High risk
Affected Versions
<=2.1.1
CVE Reference
Patch Status
No patch
Source
NVD

MDJM Event Management

high
Vulnerability
MDJM Event Management — Privilege Escalation
Severity
high High risk
Affected Versions
<=1.7.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPO365 | Login

high
Vulnerability
WPO365 | Login — Cross-Site Request Forgery
Severity
high High risk
Affected Versions
<=43.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Wpify Woo

high
Vulnerability
Wpify Woo — Privilege Escalation
Severity
high High risk
Affected Versions
<=5.4.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
high
Vulnerability
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content — Consistently enforce the role restriction configured on its front-end registration role-selection fi
Severity
high High risk
Affected Versions
<=4.16.18
CVE Reference
Patch Status
No patch
Source
NVD

CAFEHAUS API

high
Vulnerability
CAFEHAUS API — Have any authentication or authorisation when updating user passwords
Severity
high High risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

WowOptin: Next-Gen Popup Maker

high
Vulnerability
WowOptin: Next-Gen Popup Maker — Have proper authorization on a REST endpoint
Severity
high High risk
Affected Versions
<=1.4.38
CVE Reference
Patch Status
No patch
Source
NVD

EventON Action User

high
Vulnerability
EventON Action User — Authorization bypass
Severity
high High risk
Affected Versions
<=2.5.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

VikBooking Hotel Booking Engine & PMS

high
Vulnerability
VikBooking Hotel Booking Engine & PMS — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.8.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Appointments

high
Vulnerability
Easy Appointments — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=3.12.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPForms Pro

high
Vulnerability
WPForms Pro — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=1.10.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Fluent Forms Pro Add On Pack

high
Vulnerability
Fluent Forms Pro Add On Pack — PHP Object Injection
Severity
high High risk
Affected Versions
<=6.2.6
CVE Reference
Patch Status
No patch
Source
NVD

Printcart Web to Print Product Designer for WooCommerce

high
Vulnerability
Printcart Web to Print Product Designer for WooCommerce — Restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorizati
Severity
high High risk
Affected Versions
<=2.5.3
CVE Reference
Patch Status
No patch
Source
NVD

MainWP Child

high
Vulnerability
MainWP Child — Verify the requester's identity in its site-registration request handler when password authenticatio
Severity
high High risk
Affected Versions
<=6.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Clover Payment Gateway by Zaytech for WooCommerce

high
Vulnerability
Clover Payment Gateway by Zaytech for WooCommerce — Verify that an approved external payment record actually belongs to the WooCommerce order being comp
Severity
high High risk
Affected Versions
<=1.3.6
CVE Reference
Patch Status
No patch
Source
NVD

Custom Fields Account Registration For Woocommerce

high
Vulnerability
Custom Fields Account Registration For Woocommerce — Prevent its custom registration fields from writing to the user capabilities meta key on sites that
Severity
high High risk
Affected Versions
<=1.4
CVE Reference
Patch Status
No patch
Source
NVD

MPG

high
Vulnerability
MPG — Sanitise and escape a parameter before reflecting it back in the response
Severity
high High risk
Affected Versions
<=4.1.8
CVE Reference
Patch Status
No patch
Source
NVD

Download Manager

high
Vulnerability
Download Manager — Bind its temporary download token to the requesting session nor expire it promptly
Severity
high High risk
Affected Versions
<=3.3.62
CVE Reference
Patch Status
No patch
Source
NVD

bookingpress-appointment-booking-pro

high
Vulnerability
bookingpress-appointment-booking-pro — Correctly invoke its REST permission callback
Severity
high High risk
Affected Versions
<=5.7.3
CVE Reference
Patch Status
No patch
Source
NVD

Demi – One Click Demo Import, WP Backup & Site Migration

high
Vulnerability
Demi – One Click Demo Import, WP Backup & Site Migration — Arbitrary Directory Deletion
Severity
high High risk
Affected Versions
<=0.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Database for Contact Form 7, WPforms, Elementor forms

high
Vulnerability
Database for Contact Form 7, WPforms, Elementor forms — Properly sanitise and escape a parameter before reflecting it back in an admin page
Severity
high High risk
Affected Versions
<=1.5.3
CVE Reference
Patch Status
No patch
Source
NVD

Tablesome Table

high
Vulnerability
Tablesome Table — Perform any authentication
Severity
high High risk
Affected Versions
<=1.1.31
CVE Reference
Patch Status
No patch
Source
NVD

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

high
Vulnerability
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=2.15.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Fast Total Search – The Power of Indexed Search

high
Vulnerability
WP Fast Total Search – The Power of Indexed Search — Generic SQL Injection
Severity
high High risk
Affected Versions
<=1.80.280
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Premium Packages – Sell Digital Products Securely

high
Vulnerability
Premium Packages – Sell Digital Products Securely — SQL Injection
Severity
high High risk
Affected Versions
<=6.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TrueBooker – Appointment Booking and Scheduler System

high
Vulnerability
TrueBooker – Appointment Booking and Scheduler System — Generic SQL Injection
Severity
high High risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Online Scheduling and Appointment Booking System – Bookly

high
Vulnerability
Online Scheduling and Appointment Booking System – Bookly — Time-based SQL Injection
Severity
high High risk
Affected Versions
<=27.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PickPlugins Question Answer

high
Vulnerability
PickPlugins Question Answer — SQL Injection
Severity
high High risk
Affected Versions
<=1.2.73
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress

high
Vulnerability
Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress — Privilege Escalation
Severity
high High risk
Affected Versions
<=4.4.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Web Directory Free

high
Vulnerability
Web Directory Free — Generic SQL Injection
Severity
high High risk
Affected Versions
<=1.7.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart

high
Vulnerability
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder

high
Vulnerability
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder — Missing Authorization
Severity
high High risk
Affected Versions
<=7.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Password Policy

high
Vulnerability
WP Password Policy — Privilege Escalation
Severity
high High risk
Affected Versions
<=3.7.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Wholesale for WooCommerce

high
Vulnerability
Wholesale for WooCommerce — Privilege Escalation
Severity
high High risk
Affected Versions
<=2.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Digital Downloads

high
Vulnerability
Easy Digital Downloads — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=3.6.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WCPOS – Point of Sale (POS) plugin for WooCommerce

medium
Vulnerability
WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter
Severity
medium Medium risk
Affected Versions
<=1.9.8
CVE Reference
Patch Status
1.9.9
Source
Wordfence
Plugin Page

Ultimate Addons for Elementor

medium
Vulnerability
Ultimate Addons for Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Contact Form 7 – Dynamic Text Extension

medium
Vulnerability
The Contact Form 7 – Dynamic Text Extension — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.0.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Compress

medium
Vulnerability
WP Compress — Validate the value of a query parameter that controls the asset CDN host before using it to build th
Severity
medium Medium risk
Affected Versions
<=7.10.04
CVE Reference
Patch Status
No patch
Source
NVD

Post Status Notifier Lite

medium
Vulnerability
Post Status Notifier Lite — Properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin
Severity
medium Medium risk
Affected Versions
<=1.13.0
CVE Reference
Patch Status
No patch
Source
NVD

WP Shortcode by MyThemeShop

medium
Vulnerability
WP Shortcode by MyThemeShop — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.4.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Webpushr Push Notifications

medium
Vulnerability
Webpushr Push Notifications — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.39.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AI Copilot – Content Generator

medium
Vulnerability
AI Copilot – Content Generator — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.5.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Registrations For The Events Calendar

medium
Vulnerability
Registrations For The Events Calendar — SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance

medium
Vulnerability
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.46.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Premium Packages – Sell Digital Products Securely

medium
Vulnerability
Premium Packages – Sell Digital Products Securely — Authentication Bypass
Severity
medium Medium risk
Affected Versions
<=7.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Header Footer Script Adder – Insert Code in Header, Body & Footer

medium
Vulnerability
Header Footer Script Adder – Insert Code in Header, Body & Footer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Lpagery

medium
Vulnerability
Lpagery — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.5.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tickera – Sell Tickets & Manage Events

medium
Vulnerability
Tickera – Sell Tickets & Manage Events — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.6.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Brands for WooCommerce

medium
Vulnerability
Brands for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Brands for WooCommerce

medium
Vulnerability
Brands for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tickera – Sell Tickets & Manage Events

medium
Vulnerability
Tickera – Sell Tickets & Manage Events — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.6.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan

medium
Vulnerability
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=7.8.6.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Grid/List View for WooCommerce

medium
Vulnerability
Grid/List View for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GutenKit Blocks

medium
Vulnerability
GutenKit Blocks — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=2.4.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Premium Packages – Sell Digital Products Securely

medium
Vulnerability
Premium Packages – Sell Digital Products Securely — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=7.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WCPOS – Point of Sale (POS) plugin for WooCommerce

medium
Vulnerability
WCPOS – Point of Sale (POS) plugin for WooCommerce — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=1.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MapSVG

medium
Vulnerability
MapSVG — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=8.14.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Participants Database

medium
Vulnerability
Participants Database — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=2.7.8.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kirki – Freeform Page Builder, Website Builder & Customizer

medium
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=6.0.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Grid Gutenberg Blocks – PostX

medium
Vulnerability
Post Grid Gutenberg Blocks – PostX — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.0.32
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder

medium
Vulnerability
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=5.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Firelight Lightbox

medium
Vulnerability
Firelight Lightbox — Stored DOM Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.20
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ProfileGrid

medium
Vulnerability
ProfileGrid — Verify PayPal IPN notifications before granting paid group membership
Severity
medium Medium risk
Affected Versions
<=5.9.9.7
CVE Reference
Patch Status
No patch
Source
NVD

ProfileGrid

medium
Vulnerability
ProfileGrid — Perform any authorization or ownership check on some of its private-message thread actions
Severity
medium Medium risk
Affected Versions
<=5.9.9.7
CVE Reference
Patch Status
No patch
Source
NVD

Payment Plugins for Stripe WooCommerce

medium
Vulnerability
Payment Plugins for Stripe WooCommerce — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Hotel Booking

medium
Vulnerability
WP Hotel Booking — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Brands for WooCommerce

medium
Vulnerability
Brands for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Visualizer – Tables & Charts Manager with Built-in AI Generator

medium
Vulnerability
Visualizer – Tables & Charts Manager with Built-in AI Generator — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fluent Support – Helpdesk & Customer Support Ticket System

medium
Vulnerability
Fluent Support – Helpdesk & Customer Support Ticket System — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Open User Map – Interactive Leaflet Maps

medium
Vulnerability
Open User Map – Interactive Leaflet Maps — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.4.45
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

VikBooking Hotel Booking Engine & PMS

medium
Vulnerability
VikBooking Hotel Booking Engine & PMS — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.8.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Rich Showcase for Google Reviews

medium
Vulnerability
Rich Showcase for Google Reviews — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.9.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SureDash – Community, Courses & Member Dashboard

medium
Vulnerability
SureDash – Community, Courses & Member Dashboard — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.10.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms – The Contact Form Builder That Grows With You

medium
Vulnerability
Ninja Forms – The Contact Form Builder That Grows With You — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.14.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Checkout Field Editor for WooCommerce (Pro)

medium
Vulnerability
Checkout Field Editor for WooCommerce (Pro) — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=3.7.7
CVE Reference
Patch Status
No patch
Source
NVD

Yoast SEO – Advanced SEO with real-time guidance and built-in AI

medium
Vulnerability
Yoast SEO – Advanced SEO with real-time guidance and built-in AI — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=28.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Ads

medium
Vulnerability
Advanced Ads — Sanitize and escape a shortcode parameter before outputting it in the page
Severity
medium Medium risk
Affected Versions
<=2.0.23
CVE Reference
Patch Status
No patch
Source
NVD

Document Gallery

medium
Vulnerability
Document Gallery — Properly sanitise and escape user input before reflecting it back in the response of an unauthentica
Severity
medium Medium risk
Affected Versions
<=5.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Events Calendar

medium
Vulnerability
Events Calendar — Perform an authorization check on one of its Event Aggregator import REST API routes and skips an in
Severity
medium Medium risk
Affected Versions
<=6.16.5.1
CVE Reference
Patch Status
No patch
Source
NVD

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments

medium
Vulnerability
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments — Unauthenticated Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.6.12.2
CVE Reference
Patch Status
No patch
Source
NVD

Sina Extension for Elementor

medium
Vulnerability
Sina Extension for Elementor — Escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before r
Severity
medium Medium risk
Affected Versions
<=3.10.2
CVE Reference
Patch Status
No patch
Source
NVD

Smart Manager

medium
Vulnerability
Smart Manager — Properly encode a post field before rendering it into an HTML attribute in its management grid
Severity
medium Medium risk
Affected Versions
<=8.92.0
CVE Reference
Patch Status
No patch
Source
NVD

Contact Form 7

medium
Vulnerability
Contact Form 7 — Validate the host of a user-supplied return URL before using it as the success and cancel redirect t
Severity
medium Medium risk
Affected Versions
<=2.5
CVE Reference
Patch Status
No patch
Source
NVD

User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration

medium
Vulnerability
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration — Correctly verify ownership before deleting an attachment
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

Quiz and Survey Master (QSM)

medium
Vulnerability
Quiz and Survey Master (QSM) — Implement rate limiting or standard failed-login auditing on its front-end credential-check function
Severity
medium Medium risk
Affected Versions
<=11.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Calendar

medium
Vulnerability
Calendar — Properly escape a user-supplied event field before outputting it inside an HTML attribute on a publi
Severity
medium Medium risk
Affected Versions
<=1.3.18
CVE Reference
Patch Status
No patch
Source
NVD

PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer

medium
Vulnerability
PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=1.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FluentCart A New Era of eCommerce

medium
Vulnerability
FluentCart A New Era of eCommerce — Verify that a subscription belongs to the requesting customer in several of its payment-method endpo
Severity
medium Medium risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD

Demi – One Click Demo Import, WP Backup & Site Migration

medium
Vulnerability
Demi – One Click Demo Import, WP Backup & Site Migration — Arbitrary Directory Copy
Severity
medium Medium risk
Affected Versions
<=0.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent

medium
Vulnerability
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=4.3.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Form Integration — Connect Forms to 200+ Apps

medium
Vulnerability
Advanced Form Integration — Connect Forms to 200+ Apps — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

medium
Vulnerability
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.4.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

medium
Vulnerability
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.4.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Chaty Pro

medium
Vulnerability
Chaty Pro — Authenticated Time-Based Blind SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

medium
Vulnerability
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

medium
Vulnerability
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

medium
Vulnerability
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

medium
Vulnerability
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.9.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Taskbuilder – Project Management & Task Management Tool With Kanban Board

medium
Vulnerability
Taskbuilder – Project Management & Task Management Tool With Kanban Board — SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.0.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Shortcodify

medium
Vulnerability
Shortcodify — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.4.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Storegrowth Sales Booster

medium
Vulnerability
Storegrowth Sales Booster — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart

medium
Vulnerability
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tutor LMS – eLearning and online course solution

medium
Vulnerability
Tutor LMS – eLearning and online course solution — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

medium
Vulnerability
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=8.5.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Chatbot

medium
Vulnerability
Chatbot — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=8.5.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
medium
Vulnerability
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Plugin Organizer

medium
Vulnerability
Plugin Organizer — SQL Injection
Severity
medium Medium risk
Affected Versions
<=10.2.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Media Cleaner: Clean your WordPress!

medium
Vulnerability
Media Cleaner: Clean your WordPress! — Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=7.0.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SpeedyCache

medium
Vulnerability
SpeedyCache — Arbitrary File Read
Severity
medium Medium risk
Affected Versions
<=1.3.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletters Lite

medium
Vulnerability
Newsletters Lite — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletters Lite

medium
Vulnerability
Newsletters Lite — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Contact Form to Any API

medium
Vulnerability
Contact Form to Any API — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WowStore – Store Builder & Product Blocks for WooCommerce

medium
Vulnerability
WowStore – Store Builder & Product Blocks for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.4.24
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WowStore – Store Builder & Product Blocks for WooCommerce

medium
Vulnerability
WowStore – Store Builder & Product Blocks for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.4.24
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar

medium
Vulnerability
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=5.3.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Photo Album Plus

medium
Vulnerability
WP Photo Album Plus — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=9.2.04.002
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Survey Form Block

medium
Vulnerability
Survey Form Block — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShinyStat Analytics

medium
Vulnerability
ShinyStat Analytics — Perform any authorization check on one of its REST API endpoints
Severity
medium Medium risk
Affected Versions
<=1.0.17
CVE Reference
Patch Status
No patch
Source
NVD

wp-media-folder-addon

medium
Vulnerability
wp-media-folder-addon — Validate a user-supplied parameter before using it in a file read operation in two AJAX actions avai
Severity
medium Medium risk
Affected Versions
<=4.1.6
CVE Reference
Patch Status
No patch
Source
NVD

PhotoSwipe

medium
Vulnerability
PhotoSwipe — CVE-2026-13605
Severity
medium Medium risk
Affected Versions
<=4.1.1.1
CVE Reference
Patch Status
No patch
Source
NVD

UsersWP

medium
Vulnerability
UsersWP — Validate the selected authentication provider in its two-factor login handler
Severity
medium Medium risk
Affected Versions
<=1.2.67
CVE Reference
Patch Status
No patch
Source
NVD

PayU CommercePro Plugin

medium
Vulnerability
PayU CommercePro Plugin — Verify the payment-gateway signature before applying order modifications
Severity
medium Medium risk
Affected Versions
<=3.8.9
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

medium
Vulnerability
Easy Appointments — Verify that the appointment targeted by its customer-data update action belongs to the current user;
Severity
medium Medium risk
Affected Versions
<=3.12.26
CVE Reference
Patch Status
No patch
Source
NVD

WOLF

medium
Vulnerability
WOLF — Perform a nonce or capability check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.1.0
CVE Reference
Patch Status
No patch
Source
NVD

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)

medium
Vulnerability
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) — Bind the one-time code used by its optional email-verification (Profile Completion) feature to the a
Severity
medium Medium risk
Affected Versions
<=7.8.0
CVE Reference
Patch Status
No patch
Source
NVD

ProfileGrid

low
Vulnerability
ProfileGrid — Perform a capability check on its license management actions
Severity
low Low risk
Affected Versions
<=5.9.9.7
CVE Reference
Patch Status
No patch
Source
NVD

WPBot

low
Vulnerability
WPBot — Validate administrator-configured field identifiers before using them in a SQL query
Severity
low Low risk
Affected Versions
<=8.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Event Tickets and Registration

low
Vulnerability
Event Tickets and Registration — Properly escape event titles before outputting them in a ticket history log
Severity
low Low risk
Affected Versions
<=5.28.4
CVE Reference
Patch Status
No patch
Source
NVD

Quiz and Survey Master (QSM)

low
Vulnerability
Quiz and Survey Master (QSM) — Perform a capability check before deleting output templates
Severity
low Low risk
Affected Versions
<=11.1.5
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (4)

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education

high
Vulnerability
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education — CVE-2026-65500
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education

high
Vulnerability
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education — CVE-2026-65511
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education

medium
Vulnerability
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education — CVE-2026-65522
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Streamit

medium
Vulnerability
Streamit — Perform any authorization or nonce verification on one of its unauthenticated AJAX routes
Severity
medium Medium risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: July 29 – August 5, 2026

284 WordPress vulnerabilities disclosed between July 29 – August 5, 2026. 24 critical, 54 high severity. 4 patched, 280 unpatched.

WPSentry·Aug 5, 2026
Vulnerability Report

WordPress Vulnerability Report: July 28 – August 4, 2026

296 WordPress vulnerabilities disclosed between July 28 – August 4, 2026. 19 critical, 61 high severity. 2 patched, 294 unpatched.

WPSentry·Aug 4, 2026
Vulnerability Report

WordPress Vulnerability Report: July 27 – August 3, 2026

287 WordPress vulnerabilities disclosed between July 27 – August 3, 2026. 14 critical, 55 high severity. 2 patched, 285 unpatched.

WPSentry·Aug 3, 2026
Back to Blog