BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: July 26 – August 2, 2026

282 WordPress vulnerabilities disclosed between July 26 – August 2, 2026. 19 critical, 63 high severity. 2 patched, 280 unpatched.

WPSentryAugust 2, 202660 min read

During the reporting period (July 26 – August 2, 2026), 282 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

282
Total
19
Critical
63
High
188
Medium
12
Low
2
Patched
Table of Contents 287 plugins & components

WordPress Plugin Vulnerabilities (280)

MemberGlut

critical
Vulnerability
MemberGlut — Validate the role chosen during front-end registration
Severity
critical Critical risk
Affected Versions
<=1.1.5
CVE Reference
Patch Status
No patch
Source
NVD

Masteriyo LMS

critical
Vulnerability
Masteriyo LMS — Correctly verify authorization on an unauthenticated AJAX action used to clear user sessions
Severity
critical Critical risk
Affected Versions
<=2.3.1
CVE Reference
Patch Status
No patch
Source
NVD

微信二维码登陆

critical
Vulnerability
微信二维码登陆 — Properly validate WeChat webhook requests
Severity
critical Critical risk
Affected Versions
<=1.3
CVE Reference
Patch Status
No patch
Source
NVD

Realtyna Organic IDX plugin + WPL Real Estate

critical
Vulnerability
Realtyna Organic IDX plugin + WPL Real Estate — Validate the type of uploaded files
Severity
critical Critical risk
Affected Versions
<=5.3.0
CVE Reference
Patch Status
No patch
Source
NVD

FacturaONE para WooCommerce con VeriFactu

critical
Vulnerability
FacturaONE para WooCommerce con VeriFactu — Authenticate one of its request handlers
Severity
critical Critical risk
Affected Versions
<=5.37
CVE Reference
Patch Status
No patch
Source
NVD

TrueBooker

critical
Vulnerability
TrueBooker — Validate account ownership when resetting a user's password through one of its front-end account han
Severity
critical Critical risk
Affected Versions
<=1.2.4
CVE Reference
Patch Status
No patch
Source
NVD

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

critical
Vulnerability
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — Authentication Bypass leading to Account Takeover
Severity
critical Critical risk
Affected Versions
<=3.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …

critical
Vulnerability
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … — Authentication Bypass
Severity
critical Critical risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light

critical
Vulnerability
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light — Missing Authorization
Severity
critical Critical risk
Affected Versions
<=2.4.37
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Meta Box AIO

critical
Vulnerability
Meta Box AIO — Missing Authorization
Severity
critical Critical risk
Affected Versions
<=3.8.0
CVE Reference
Patch Status
No patch
Source
NVD

Cost Calculator Builder PRO

critical
Vulnerability
Cost Calculator Builder PRO — Remote Code Execution
Severity
critical Critical risk
Affected Versions
<=4.0.3
CVE Reference
Patch Status
No patch
Source
NVD

Admin and Site Enhancements (ASE) Pro

critical
Vulnerability
Admin and Site Enhancements (ASE) Pro — Remote Code Execution
Severity
critical Critical risk
Affected Versions
<=8.9.0
CVE Reference
Patch Status
No patch
Source
NVD

Remote API

critical
Vulnerability
Remote API — Authenticate a request before deserializing user-supplied input
Severity
critical Critical risk
Affected Versions
<=0.2
CVE Reference
Patch Status
No patch
Source
NVD

Realtyna Organic IDX plugin + WPL Real Estate

critical
Vulnerability
Realtyna Organic IDX plugin + WPL Real Estate — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=5.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShopMonitor.io

critical
Vulnerability
ShopMonitor.io — Properly restrict its email-rerouting test mode
Severity
critical Critical risk
Affected Versions
<=1.2.0
CVE Reference
Patch Status
No patch
Source
NVD

FormGent

critical
Vulnerability
FormGent — Unauthorized arbitrary file deletion
Severity
critical Critical risk
Affected Versions
<=1.9.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Single Sign On For TNG

critical
Vulnerability
Single Sign On For TNG — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=2.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WooCommerce - Social Login

critical
Vulnerability
WooCommerce - Social Login — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=2.8.7
CVE Reference
Patch Status
No patch
Source
NVD

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

high
Vulnerability
Contest Gallery <= 30.0.6 - Unauthenticated Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=30.0.6
CVE Reference
Patch Status
30.0.7
Source
Wordfence
Plugin Page

Advanced Shipment Tracking for WooCommerce

high
Vulnerability
Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
Severity
high High risk
Affected Versions
<=3.9
CVE Reference
N/A
Patch Status
3.9.1
Source
Wordfence
Plugin Page

Printcart Web to Print Product Designer for WooCommerce

high
Vulnerability
Printcart Web to Print Product Designer for WooCommerce — Restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorizati
Severity
high High risk
Affected Versions
<=2.5.3
CVE Reference
Patch Status
No patch
Source
NVD

MainWP Child

high
Vulnerability
MainWP Child — Verify the requester's identity in its site-registration request handler when password authenticatio
Severity
high High risk
Affected Versions
<=6.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Clover Payment Gateway by Zaytech for WooCommerce

high
Vulnerability
Clover Payment Gateway by Zaytech for WooCommerce — Verify that an approved external payment record actually belongs to the WooCommerce order being comp
Severity
high High risk
Affected Versions
<=1.3.6
CVE Reference
Patch Status
No patch
Source
NVD

Custom Fields Account Registration For Woocommerce

high
Vulnerability
Custom Fields Account Registration For Woocommerce — Prevent its custom registration fields from writing to the user capabilities meta key on sites that
Severity
high High risk
Affected Versions
<=1.4
CVE Reference
Patch Status
No patch
Source
NVD

MPG

high
Vulnerability
MPG — Sanitise and escape a parameter before reflecting it back in the response
Severity
high High risk
Affected Versions
<=4.1.8
CVE Reference
Patch Status
No patch
Source
NVD

Download Manager

high
Vulnerability
Download Manager — Bind its temporary download token to the requesting session nor expire it promptly
Severity
high High risk
Affected Versions
<=3.3.62
CVE Reference
Patch Status
No patch
Source
NVD

bookingpress-appointment-booking-pro

high
Vulnerability
bookingpress-appointment-booking-pro — Correctly invoke its REST permission callback
Severity
high High risk
Affected Versions
<=5.7.3
CVE Reference
Patch Status
No patch
Source
NVD

Demi – One Click Demo Import, WP Backup & Site Migration

high
Vulnerability
Demi – One Click Demo Import, WP Backup & Site Migration — Arbitrary Directory Deletion
Severity
high High risk
Affected Versions
<=0.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Database for Contact Form 7, WPforms, Elementor forms

high
Vulnerability
Database for Contact Form 7, WPforms, Elementor forms — Properly sanitise and escape a parameter before reflecting it back in an admin page
Severity
high High risk
Affected Versions
<=1.5.3
CVE Reference
Patch Status
No patch
Source
NVD

Tablesome Table

high
Vulnerability
Tablesome Table — Perform any authentication
Severity
high High risk
Affected Versions
<=1.1.31
CVE Reference
Patch Status
No patch
Source
NVD

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

high
Vulnerability
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=2.15.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Fast Total Search – The Power of Indexed Search

high
Vulnerability
WP Fast Total Search – The Power of Indexed Search — Generic SQL Injection
Severity
high High risk
Affected Versions
<=1.80.280
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Premium Packages – Sell Digital Products Securely

high
Vulnerability
Premium Packages – Sell Digital Products Securely — SQL Injection
Severity
high High risk
Affected Versions
<=6.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TrueBooker – Appointment Booking and Scheduler System

high
Vulnerability
TrueBooker – Appointment Booking and Scheduler System — Generic SQL Injection
Severity
high High risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Online Scheduling and Appointment Booking System – Bookly

high
Vulnerability
Online Scheduling and Appointment Booking System – Bookly — Time-based SQL Injection
Severity
high High risk
Affected Versions
<=27.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PickPlugins Question Answer

high
Vulnerability
PickPlugins Question Answer — SQL Injection
Severity
high High risk
Affected Versions
<=1.2.73
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress

high
Vulnerability
Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress — Privilege Escalation
Severity
high High risk
Affected Versions
<=4.4.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Web Directory Free

high
Vulnerability
Web Directory Free — Generic SQL Injection
Severity
high High risk
Affected Versions
<=1.7.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart

high
Vulnerability
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder

high
Vulnerability
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder — Missing Authorization
Severity
high High risk
Affected Versions
<=7.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Password Policy

high
Vulnerability
WP Password Policy — Privilege Escalation
Severity
high High risk
Affected Versions
<=3.7.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Wholesale for WooCommerce

high
Vulnerability
Wholesale for WooCommerce — Privilege Escalation
Severity
high High risk
Affected Versions
<=2.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Digital Downloads

high
Vulnerability
Easy Digital Downloads — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=3.6.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

wp-media-folder-addon

high
Vulnerability
wp-media-folder-addon — Validate a user-supplied parameter before using it in a file read operation in two AJAX actions avai
Severity
high High risk
Affected Versions
<=4.1.6
CVE Reference
Patch Status
No patch
Source
NVD

UsersWP

high
Vulnerability
UsersWP — Validate the selected authentication provider in its two-factor login handler
Severity
high High risk
Affected Versions
<=1.2.67
CVE Reference
Patch Status
No patch
Source
NVD

WOLF

high
Vulnerability
WOLF — Perform a nonce or capability check on one of its AJAX actions
Severity
high High risk
Affected Versions
<=1.1.0
CVE Reference
Patch Status
No patch
Source
NVD

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)

high
Vulnerability
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) — Bind the one-time code used by its optional email-verification (Profile Completion) feature to the a
Severity
high High risk
Affected Versions
<=7.8.0
CVE Reference
Patch Status
No patch
Source
NVD

Database for CF7

high
Vulnerability
Database for CF7 — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.2.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GTM4WP – A Google Tag Manager (GTM)

high
Vulnerability
GTM4WP – A Google Tag Manager (GTM) — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.22.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

high
Vulnerability
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.2.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce)

high
Vulnerability
Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD

FleekDash V2

high
Vulnerability
FleekDash V2 — Authorization bypass
Severity
high High risk
Affected Versions
<=2.6.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

BuddyPress

high
Vulnerability
BuddyPress — Deserialization of Untrusted Data
Severity
high High risk
Affected Versions
<=14.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Travel Engine

high
Vulnerability
WP Travel Engine — Perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin befor
Severity
high High risk
Affected Versions
<=6.8.2
CVE Reference
Patch Status
No patch
Source
NVD

ProfileGrid

high
Vulnerability
ProfileGrid — Restrict which group an anonymous visitor may register into through its front-end registration
Severity
high High risk
Affected Versions
<=5.9.9.8
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

high
Vulnerability
Eventin — Properly authorize order creation and accepts an attacker-supplied order status
Severity
high High risk
Affected Versions
<=4.1.16
CVE Reference
Patch Status
No patch
Source
NVD

Online Scheduling and Appointment Booking System

high
Vulnerability
Online Scheduling and Appointment Booking System — Sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking reque
Severity
high High risk
Affected Versions
<=27.8
CVE Reference
Patch Status
No patch
Source
NVD

Customer Switching

high
Vulnerability
Customer Switching — Securely bind an active user-switching session to the operator who initiated it
Severity
high High risk
Affected Versions
<=2.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Subscriptions for WooCommerce

high
Vulnerability
Subscriptions for WooCommerce — Missing Authorization
Severity
high High risk
Affected Versions
<=2.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultimate Member

high
Vulnerability
Ultimate Member — Filter administrator-level capabilities from the roles it makes selectable on its registration forms
Severity
high High risk
Affected Versions
<=2.12.1
CVE Reference
Patch Status
No patch
Source
NVD

miniOrange 2FA

high
Vulnerability
miniOrange 2FA — Validate the submitted one-time password against the targeted user's stored secret
Severity
high High risk
Affected Versions
<=6.2.6
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

high
Vulnerability
Kirki — Restrict which classes may be instantiated when it deserialises data that unauthenticated users can
Severity
high High risk
Affected Versions
<=6.0.13
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

high
Vulnerability
Kirki — Properly sanitise and escape a value taken from the request before using it in a SQL statement
Severity
high High risk
Affected Versions
<=6.0.13
CVE Reference
Patch Status
No patch
Source
NVD

ElementsKit Elementor Addons

high
Vulnerability
ElementsKit Elementor Addons — Prevent a custom-widget definition saved by a user with administrative capabilities from being writt
Severity
high High risk
Affected Versions
<=3.10.01
CVE Reference
Patch Status
No patch
Source
NVD

Frontend Admin by DynamiApps

high
Vulnerability
Frontend Admin by DynamiApps — CVE-2026-13609
Severity
high High risk
Affected Versions
<=3.29.9
CVE Reference
Patch Status
No patch
Source
NVD

GiveWP

high
Vulnerability
GiveWP — Properly restrict access to a REST API endpoint that returns recurring-donation records
Severity
high High risk
Affected Versions
<=4.16.3
CVE Reference
Patch Status
No patch
Source
NVD

Demi

high
Vulnerability
Demi — CVE-2026-14333
Severity
high High risk
Affected Versions
<=0.0.7
CVE Reference
Patch Status
No patch
Source
NVD

FlxWoo

high
Vulnerability
FlxWoo — Verify with the payment processor that a checkout session was actually paid before marking the assoc
Severity
high High risk
Affected Versions
<=3.1.1
CVE Reference
Patch Status
No patch
Source
NVD

JS Help Desk

high
Vulnerability
JS Help Desk — Perform any authorization
Severity
high High risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD

Geeky Bot

high
Vulnerability
Geeky Bot — Perform an authorization check on one of its AJAX actions
Severity
high High risk
Affected Versions
<=1.2.8
CVE Reference
Patch Status
No patch
Source
NVD

Product Feed Manager For WooCommerce

high
Vulnerability
Product Feed Manager For WooCommerce — Properly sanitise and escape product-feed custom filter rules before using them in a SQL query
Severity
high High risk
Affected Versions
<=7.6.1
CVE Reference
Patch Status
No patch
Source
NVD

Realtyna Organic IDX

high
Vulnerability
Realtyna Organic IDX — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=5.3.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation

high
Vulnerability
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation — Directory Traversal
Severity
high High risk
Affected Versions
<=2.9.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Subscriptions for WooCommerce

high
Vulnerability
Subscriptions for WooCommerce — Privilege Escalation
Severity
high High risk
Affected Versions
<=2.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AI Engine – The Chatbot, AI Framework & MCP for WordPress

high
Vulnerability
AI Engine – The Chatbot, AI Framework & MCP for WordPress — Cross-Site Request Forgery
Severity
high High risk
Affected Versions
<=3.6.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder

high
Vulnerability
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.3.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Nex Forms – Ultimate Form Builder – Lite

high
Vulnerability
Nex Forms – Ultimate Form Builder – Lite — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=9.2.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kali Forms — Contact Form & Drag-and-Drop Builder

high
Vulnerability
Kali Forms — Contact Form & Drag-and-Drop Builder — Remote Code Execution
Severity
high High risk
Affected Versions
<=2.4.20
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Pronamic Pay

high
Vulnerability
Pronamic Pay — Privilege Escalation
Severity
high High risk
Affected Versions
<=10.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CubeWP Framework

high
Vulnerability
CubeWP Framework — Directory Traversal
Severity
high High risk
Affected Versions
<=1.1.30
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Access Manager

high
Vulnerability
User Access Manager — Directory Traversal
Severity
high High risk
Affected Versions
<=2.3.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Ads

medium
Vulnerability
Advanced Ads — Sanitize and escape a shortcode parameter before outputting it in the page
Severity
medium Medium risk
Affected Versions
<=2.0.23
CVE Reference
Patch Status
No patch
Source
NVD

Document Gallery

medium
Vulnerability
Document Gallery — Properly sanitise and escape user input before reflecting it back in the response of an unauthentica
Severity
medium Medium risk
Affected Versions
<=5.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Events Calendar

medium
Vulnerability
Events Calendar — Perform an authorization check on one of its Event Aggregator import REST API routes and skips an in
Severity
medium Medium risk
Affected Versions
<=6.16.5.1
CVE Reference
Patch Status
No patch
Source
NVD

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments

medium
Vulnerability
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments — Unauthenticated Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.6.12.2
CVE Reference
Patch Status
No patch
Source
NVD

Sina Extension for Elementor

medium
Vulnerability
Sina Extension for Elementor — Escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before r
Severity
medium Medium risk
Affected Versions
<=3.10.2
CVE Reference
Patch Status
No patch
Source
NVD

Smart Manager

medium
Vulnerability
Smart Manager — Properly encode a post field before rendering it into an HTML attribute in its management grid
Severity
medium Medium risk
Affected Versions
<=8.92.0
CVE Reference
Patch Status
No patch
Source
NVD

Contact Form 7

medium
Vulnerability
Contact Form 7 — Validate the host of a user-supplied return URL before using it as the success and cancel redirect t
Severity
medium Medium risk
Affected Versions
<=2.5
CVE Reference
Patch Status
No patch
Source
NVD

User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration

medium
Vulnerability
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration — Correctly verify ownership before deleting an attachment
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

Quiz and Survey Master (QSM)

medium
Vulnerability
Quiz and Survey Master (QSM) — Implement rate limiting or standard failed-login auditing on its front-end credential-check function
Severity
medium Medium risk
Affected Versions
<=11.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Calendar

medium
Vulnerability
Calendar — Properly escape a user-supplied event field before outputting it inside an HTML attribute on a publi
Severity
medium Medium risk
Affected Versions
<=1.3.18
CVE Reference
Patch Status
No patch
Source
NVD

PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer

medium
Vulnerability
PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=1.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FluentCart A New Era of eCommerce

medium
Vulnerability
FluentCart A New Era of eCommerce — Verify that a subscription belongs to the requesting customer in several of its payment-method endpo
Severity
medium Medium risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD

Demi – One Click Demo Import, WP Backup & Site Migration

medium
Vulnerability
Demi – One Click Demo Import, WP Backup & Site Migration — Arbitrary Directory Copy
Severity
medium Medium risk
Affected Versions
<=0.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent

medium
Vulnerability
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=4.3.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Form Integration — Connect Forms to 200+ Apps

medium
Vulnerability
Advanced Form Integration — Connect Forms to 200+ Apps — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

medium
Vulnerability
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.4.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

medium
Vulnerability
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.4.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Chaty Pro

medium
Vulnerability
Chaty Pro — Authenticated Time-Based Blind SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

medium
Vulnerability
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

medium
Vulnerability
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

medium
Vulnerability
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

medium
Vulnerability
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.9.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Taskbuilder – Project Management & Task Management Tool With Kanban Board

medium
Vulnerability
Taskbuilder – Project Management & Task Management Tool With Kanban Board — SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.0.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Shortcodify

medium
Vulnerability
Shortcodify — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.4.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Storegrowth Sales Booster

medium
Vulnerability
Storegrowth Sales Booster — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart

medium
Vulnerability
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tutor LMS – eLearning and online course solution

medium
Vulnerability
Tutor LMS – eLearning and online course solution — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

medium
Vulnerability
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=8.5.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Chatbot

medium
Vulnerability
Chatbot — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=8.5.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page
medium
Vulnerability
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Plugin Organizer

medium
Vulnerability
Plugin Organizer — SQL Injection
Severity
medium Medium risk
Affected Versions
<=10.2.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Media Cleaner: Clean your WordPress!

medium
Vulnerability
Media Cleaner: Clean your WordPress! — Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=7.0.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SpeedyCache

medium
Vulnerability
SpeedyCache — Arbitrary File Read
Severity
medium Medium risk
Affected Versions
<=1.3.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletters Lite

medium
Vulnerability
Newsletters Lite — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletters Lite

medium
Vulnerability
Newsletters Lite — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Contact Form to Any API

medium
Vulnerability
Contact Form to Any API — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WowStore – Store Builder & Product Blocks for WooCommerce

medium
Vulnerability
WowStore – Store Builder & Product Blocks for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.4.24
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WowStore – Store Builder & Product Blocks for WooCommerce

medium
Vulnerability
WowStore – Store Builder & Product Blocks for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.4.24
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar

medium
Vulnerability
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=5.3.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Photo Album Plus

medium
Vulnerability
WP Photo Album Plus — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=9.2.04.002
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Survey Form Block

medium
Vulnerability
Survey Form Block — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShinyStat Analytics

medium
Vulnerability
ShinyStat Analytics — Perform any authorization check on one of its REST API endpoints
Severity
medium Medium risk
Affected Versions
<=1.0.17
CVE Reference
Patch Status
No patch
Source
NVD

PhotoSwipe

medium
Vulnerability
PhotoSwipe — CVE-2026-13605
Severity
medium Medium risk
Affected Versions
<=4.1.1.1
CVE Reference
Patch Status
No patch
Source
NVD

PayU CommercePro Plugin

medium
Vulnerability
PayU CommercePro Plugin — Verify the payment-gateway signature before applying order modifications
Severity
medium Medium risk
Affected Versions
<=3.8.9
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

medium
Vulnerability
Easy Appointments — Verify that the appointment targeted by its customer-data update action belongs to the current user;
Severity
medium Medium risk
Affected Versions
<=3.12.26
CVE Reference
Patch Status
No patch
Source
NVD

WP-Lister Lite for eBay

medium
Vulnerability
WP-Lister Lite for eBay — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.8.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Facturación Electrónica Costa Rica

medium
Vulnerability
Facturación Electrónica Costa Rica — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=2.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Klubraum Membership Request

medium
Vulnerability
Klubraum Membership Request — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=1.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MasterStudy LMS WordPress Plugin – for Online Courses and Education

medium
Vulnerability
MasterStudy LMS WordPress Plugin – for Online Courses and Education — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.7.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP CTA

medium
Vulnerability
WP CTA — Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=2.1.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPC Badge Management for WooCommerce

medium
Vulnerability
WPC Badge Management for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booking System Trafft

medium
Vulnerability
Booking System Trafft — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.0.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Improved Save Button

medium
Vulnerability
Improved Save Button — Second-order SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Persian Elementor (المنتور فارسی)

medium
Vulnerability
Persian Elementor (المنتور فارسی) — Price Manipulation
Severity
medium Medium risk
Affected Versions
<=2.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Points and Rewards for WooCommerce

medium
Vulnerability
Points and Rewards for WooCommerce — Have authorisation checks in place on a wallet and points update action that is available to unauthe
Severity
medium Medium risk
Affected Versions
<=2.10.1
CVE Reference
Patch Status
No patch
Source
NVD

Frontend Admin by DynamiApps

medium
Vulnerability
Frontend Admin by DynamiApps — Perform capability checks on its taxonomy term creation
Severity
medium Medium risk
Affected Versions
<=3.29.7
CVE Reference
Patch Status
No patch
Source
NVD

WP Ghost (Hide My WP Ghost)

medium
Vulnerability
WP Ghost (Hide My WP Ghost) — Verify that client IP information comes from a trusted proxy before trusting attacker-controllable H
Severity
medium Medium risk
Affected Versions
<=7.0.05
CVE Reference
Patch Status
No patch
Source
NVD

Fluent Forms

medium
Vulnerability
Fluent Forms — Sanitise and escape one of its form field configuration settings before outputting it inside an inli
Severity
medium Medium risk
Affected Versions
<=6.2.6
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

medium
Vulnerability
WP Travel — Verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a
Severity
medium Medium risk
Affected Versions
<=11.8.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

medium
Vulnerability
WP Travel — Verify that the booking requested on its customer account dashboard belongs to the current user
Severity
medium Medium risk
Affected Versions
<=11.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Animation Addons for Elementor

medium
Vulnerability
Animation Addons for Elementor — Sanitise uploaded SVG/SVGZ files
Severity
medium Medium risk
Affected Versions
<=2.7.0
CVE Reference
Patch Status
No patch
Source
NVD

Essential Addons for Elementor

medium
Vulnerability
Essential Addons for Elementor — Validate the HTML tag name of the Pricing Table widget title before outputting it
Severity
medium Medium risk
Affected Versions
<=6.6.10
CVE Reference
Patch Status
No patch
Source
NVD

Essential Addons for Elementor

medium
Vulnerability
Essential Addons for Elementor — Perform authorization
Severity
medium Medium risk
Affected Versions
<=6.6.10
CVE Reference
Patch Status
No patch
Source
NVD

LifterLMS

medium
Vulnerability
LifterLMS — Strip event-handler attributes from a course pricing field before storing and rendering it
Severity
medium Medium risk
Affected Versions
<=10.0.10
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

medium
Vulnerability
Easy Appointments — Verify ownership or capability when returning stored customer details
Severity
medium Medium risk
Affected Versions
<=3.12.26
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

medium
Vulnerability
Easy Appointments — Require a sufficient capability on one of its appointment-listing REST endpoints
Severity
medium Medium risk
Affected Versions
<=3.12.26
CVE Reference
Patch Status
No patch
Source
NVD

LifterLMS

medium
Vulnerability
LifterLMS — Perform a capability check in one of its select2 query AJAX handlers
Severity
medium Medium risk
Affected Versions
<=10.0.10
CVE Reference
Patch Status
No patch
Source
NVD

tourmaster

medium
Vulnerability
tourmaster — Perform a nonce check when storing a custom-filter label taken from a request parameter
Severity
medium Medium risk
Affected Versions
<=5.4.8
CVE Reference
Patch Status
No patch
Source
NVD

WP Delicious

medium
Vulnerability
WP Delicious — Perform an authorization check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.10.2
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

medium
Vulnerability
Tutor LMS — Properly verify that a user has access to the course a Q&A thread belongs to before returning or wri
Severity
medium Medium risk
Affected Versions
<=4.0.0
CVE Reference
Patch Status
No patch
Source
NVD

GiveWP

medium
Vulnerability
GiveWP — Escape a donation-form template setting before outputting it in an HTML attribute
Severity
medium Medium risk
Affected Versions
<=4.16.3
CVE Reference
Patch Status
No patch
Source
NVD

WP Real IP-based Access Control

medium
Vulnerability
WP Real IP-based Access Control — Perform any capability or nonce checks before storing one of its option values
Severity
medium Medium risk
Affected Versions
<=1.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Sync Post With Other Site

medium
Vulnerability
Sync Post With Other Site — Correctly enforce the page-editing capability on a REST route that creates and updates posts
Severity
medium Medium risk
Affected Versions
<=1.9.3
CVE Reference
Patch Status
No patch
Source
NVD

WP Hotel Booking

medium
Vulnerability
WP Hotel Booking — Sanitise and escape a search parameter on an administrative listing before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD

MotoPress Hotel Booking

medium
Vulnerability
MotoPress Hotel Booking — Perform a capability check before returning a booking's full customer details in one of its AJAX act
Severity
medium Medium risk
Affected Versions
<=6.0.4
CVE Reference
Patch Status
No patch
Source
NVD

Appointment Booking Plugin

medium
Vulnerability
Appointment Booking Plugin — Restrict which booking fields an unauthenticated visitor can set through its public booking funnel
Severity
medium Medium risk
Affected Versions
<=5.6.8
CVE Reference
Patch Status
No patch
Source
NVD

Search Atlas SEO

medium
Vulnerability
Search Atlas SEO — Perform a capability or nonce check in one of its AJAX handlers
Severity
medium Medium risk
Affected Versions
<=2.6.12
CVE Reference
Patch Status
No patch
Source
NVD

RegistrationMagic

medium
Vulnerability
RegistrationMagic — Properly validate that a one-time password presented in a cookie belongs to the identity being reque
Severity
medium Medium risk
Affected Versions
<=6.0.9.4
CVE Reference
Patch Status
No patch
Source
NVD

RegistrationMagic

medium
Vulnerability
RegistrationMagic — Perform authorization
Severity
medium Medium risk
Affected Versions
<=6.0.9.4
CVE Reference
Patch Status
No patch
Source
NVD

Ultimate Addons for WPBakery Page Builder

medium
Vulnerability
Ultimate Addons for WPBakery Page Builder — Perform a capability or nonce check before deleting a site's custom-uploaded icon font packs
Severity
medium Medium risk
Affected Versions
<=3.21.4
CVE Reference
Patch Status
No patch
Source
NVD

FuseWP

medium
Vulnerability
FuseWP — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=1.1.24.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Academy LMS

medium
Vulnerability
Academy LMS — Restrict access to quiz attempt records to their owner
Severity
medium Medium risk
Affected Versions
<=3.8.2
CVE Reference
Patch Status
No patch
Source
NVD

wpForo Forum

medium
Vulnerability
wpForo Forum — Verify that an AI chat conversation belongs to the requesting user before deleting its messages
Severity
medium Medium risk
Affected Versions
<=3.1.2
CVE Reference
Patch Status
No patch
Source
NVD

GiveWP

medium
Vulnerability
GiveWP — Restrict the set of available payment gateways to those enabled by the administrator
Severity
medium Medium risk
Affected Versions
<=4.16.3
CVE Reference
Patch Status
No patch
Source
NVD

Check & Log Email

medium
Vulnerability
Check & Log Email — Properly sanitize and escape parameters before using them in SQL queries
Severity
medium Medium risk
Affected Versions
<=2.0.15
CVE Reference
Patch Status
No patch
Source
NVD

Lightbox with PhotoSwipe

medium
Vulnerability
Lightbox with PhotoSwipe — Sanitise or escape a link data attribute before rendering it into the image lightbox caption in the
Severity
medium Medium risk
Affected Versions
<=5.9.0
CVE Reference
Patch Status
No patch
Source
NVD

Mailgun for

medium
Vulnerability
Mailgun for — Perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Events Made Easy

medium
Vulnerability
Events Made Easy — Verify that the requester is authorized to modify the targeted record when handling an unauthenticat
Severity
medium Medium risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD

NewStatPress

medium
Vulnerability
NewStatPress — Sanitise and escape data derived from unauthenticated visitor requests before storing it and later o
Severity
medium Medium risk
Affected Versions
<=1.4.5
CVE Reference
Patch Status
No patch
Source
NVD
medium
Vulnerability
Paid Membership Subscriptions — Perform capability or nonce checks on one of its payment-related AJAX actions
Severity
medium Medium risk
Affected Versions
<=3.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Ultimate Addons for WPBakery Page Builder

medium
Vulnerability
Ultimate Addons for WPBakery Page Builder — CVE-2026-14921
Severity
medium Medium risk
Affected Versions
<=3.21.5
CVE Reference
Patch Status
No patch
Source
NVD

JS Help Desk

medium
Vulnerability
JS Help Desk — Perform authorization or ownership checks before returning support-ticket content in a nonce-gated s
Severity
medium Medium risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD

JS Help Desk

medium
Vulnerability
JS Help Desk — Verify ownership of the targeted reply before updating it
Severity
medium Medium risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD

JS Help Desk

medium
Vulnerability
JS Help Desk — Perform a capability check on a user-listing handler
Severity
medium Medium risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD

JS Help Desk

medium
Vulnerability
JS Help Desk — Verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user ca
Severity
medium Medium risk
Affected Versions
<=3.1.5
CVE Reference
Patch Status
No patch
Source
NVD

BuddyPress

medium
Vulnerability
BuddyPress — Properly enforce authorization on its private messaging endpoints
Severity
medium Medium risk
Affected Versions
<=14.5.0
CVE Reference
Patch Status
No patch
Source
NVD

MailPress

medium
Vulnerability
MailPress — Unauthorized access
Severity
medium Medium risk
Affected Versions
<=1.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MailerPress – Newsletter, email marketing & AI automation

medium
Vulnerability
MailerPress – Newsletter, email marketing & AI automation — Unauthorized access
Severity
medium Medium risk
Affected Versions
<=1.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

medium
Vulnerability
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=6.2.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SendPulse Email Marketing Newsletter

medium
Vulnerability
SendPulse Email Marketing Newsletter — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Pinpoint Booking System – Version 2

medium
Vulnerability
Pinpoint Booking System – Version 2 — Blind SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.9.9.6.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SureForms – Contact Form, Payment Form & Other Custom Form Builder

medium
Vulnerability
SureForms – Contact Form, Payment Form & Other Custom Form Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bit Form

medium
Vulnerability
Bit Form — Sanitise one of its conversational-form display settings before rendering it on the public-facing fo
Severity
medium Medium risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD

Spectra Legacy

medium
Vulnerability
Spectra Legacy — Validate or escape several block style attributes before using them to build the CSS it outputs on t
Severity
medium Medium risk
Affected Versions
<=2.20.0
CVE Reference
Patch Status
No patch
Source
NVD

Builderall for

medium
Vulnerability
Builderall for — Bind the state value of its public OAuth authentication routes to the initiating user session
Severity
medium Medium risk
Affected Versions
<=3.0.2
CVE Reference
Patch Status
No patch
Source
NVD

wpForo Forum

medium
Vulnerability
wpForo Forum — Sanitize and escape a user profile field before outputting it inside an HTML attribute on the public
Severity
medium Medium risk
Affected Versions
<=3.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Direct Payments for WooCommerce

medium
Vulnerability
Direct Payments for WooCommerce — Verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handle
Severity
medium Medium risk
Affected Versions
<=2.5.3
CVE Reference
Patch Status
No patch
Source
NVD

Demo Import

medium
Vulnerability
Demo Import — Validate the type of files uploaded during demo-content import (the WordPress file-type test is disa
Severity
medium Medium risk
Affected Versions
<=1.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Everest Toolkit

medium
Vulnerability
Everest Toolkit — Validate the type of files uploaded during demo-content import (the WordPress file-type test is disa
Severity
medium Medium risk
Affected Versions
<=1.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Buckaroo Woocommerce Payments Plugin

medium
Vulnerability
Buckaroo Woocommerce Payments Plugin — Perform any capability check or nonce validation on an AJAX action that processes payment capture re
Severity
medium Medium risk
Affected Versions
<=4.9.0
CVE Reference
Patch Status
No patch
Source
NVD

Participants Database

medium
Vulnerability
Participants Database — Properly sanitize and escape a user-supplied parameter before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=2.7.8.4
CVE Reference
Patch Status
No patch
Source
NVD

Pixelavo

medium
Vulnerability
Pixelavo — An unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook a
Severity
medium Medium risk
Affected Versions
<=1.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Dynamic Pricing With Discount Rules for WooCommerce

medium
Vulnerability
Dynamic Pricing With Discount Rules for WooCommerce — Validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input
Severity
medium Medium risk
Affected Versions
<=5.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Podlove Podcast Publisher

medium
Vulnerability
Podlove Podcast Publisher — Perform nonce validation on some of its administrative create and delete actions
Severity
medium Medium risk
Affected Versions
<=4.5.3
CVE Reference
Patch Status
No patch
Source
NVD

Brizy

medium
Vulnerability
Brizy — Properly verify authorization on a request handler before returning post content
Severity
medium Medium risk
Affected Versions
<=2.8.18
CVE Reference
Patch Status
No patch
Source
NVD

Fluent Support

medium
Vulnerability
Fluent Support — Perform a per-ticket access check before reassigning a ticket's customer
Severity
medium Medium risk
Affected Versions
<=2.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Booking for Appointments and Events Calendar

medium
Vulnerability
Booking for Appointments and Events Calendar — Restrict which fields can be written through its customer import
Severity
medium Medium risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD

Download Manager

medium
Vulnerability
Download Manager — Properly escape a package's title before outputting it in the front-end package templates
Severity
medium Medium risk
Affected Versions
<=3.3.66
CVE Reference
Patch Status
No patch
Source
NVD

Chat On Desk Order Notifications

medium
Vulnerability
Chat On Desk Order Notifications — Verify that the one-time password has been validated before processing a password-reset request
Severity
medium Medium risk
Affected Versions
<=1.0.9
CVE Reference
Patch Status
No patch
Source
NVD

Pixel Tag Manager for WooCommerce

medium
Vulnerability
Pixel Tag Manager for WooCommerce — Perform an authorization check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Authora : Easy login with mobile number

medium
Vulnerability
Authora : Easy login with mobile number — Keep its one-time login code confidential
Severity
medium Medium risk
Affected Versions
<=1.7.7
CVE Reference
Patch Status
No patch
Source
NVD

DynamicKit for Elementor

medium
Vulnerability
DynamicKit for Elementor — Validate the host of a user-supplied URL used as the base of the password-reset link it emails
Severity
medium Medium risk
Affected Versions
<=1.0.3
CVE Reference
Patch Status
No patch
Source
NVD

Event Tickets and Registration

medium
Vulnerability
Event Tickets and Registration — Perform any authorization check on one of its order-management REST endpoints
Severity
medium Medium risk
Affected Versions
<=5.29.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Event Tickets and Registration

medium
Vulnerability
Event Tickets and Registration — Properly verify authorization on some of its seating actions
Severity
medium Medium risk
Affected Versions
<=5.29.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Login & Register Forms

medium
Vulnerability
Login & Register Forms — Properly enforce the rate limit on its password-reset verification-code flow
Severity
medium Medium risk
Affected Versions
<=3.2.5
CVE Reference
Patch Status
No patch
Source
NVD

Mapster WP Maps

medium
Vulnerability
Mapster WP Maps — Perform any authorization or post-status check on a public REST endpoint
Severity
medium Medium risk
Affected Versions
<=1.24.0
CVE Reference
Patch Status
No patch
Source
NVD

YOP Poll

medium
Vulnerability
YOP Poll — Validate the connection's origin IP address and instead trusts client-controlled forwarding headers
Severity
medium Medium risk
Affected Versions
<=7.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Codeless Page Builder

medium
Vulnerability
Codeless Page Builder — Sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering conten
Severity
medium Medium risk
Affected Versions
<=1.1.4
CVE Reference
Patch Status
No patch
Source
NVD

HUSKY

medium
Vulnerability
HUSKY — Sanitize a stored setting value against directory traversal before concatenating it into a file incl
Severity
medium Medium risk
Affected Versions
<=1.4.1
CVE Reference
Patch Status
No patch
Source
NVD

Admin Columns for ACF Fields

medium
Vulnerability
Admin Columns for ACF Fields — Escape Advanced Custom Fields values before outputting them in the WordPress admin list-table column
Severity
medium Medium risk
Affected Versions
<=0.3.2
CVE Reference
Patch Status
No patch
Source
NVD

User Profile Builder

medium
Vulnerability
User Profile Builder — Correctly bind the automatic login performed after user registration to the newly created account
Severity
medium Medium risk
Affected Versions
<=3.16.4
CVE Reference
Patch Status
No patch
Source
NVD

Support Genix

medium
Vulnerability
Support Genix — Prevent directory traversal in its ticket-attachment download route
Severity
medium Medium risk
Affected Versions
<=1.4.48
CVE Reference
Patch Status
No patch
Source
NVD

Theme Editor

medium
Vulnerability
Theme Editor — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=3.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Jeg Kit for Elementor

medium
Vulnerability
Jeg Kit for Elementor — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=3.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WooCommerce PayPal Payments

medium
Vulnerability
WooCommerce PayPal Payments — Sensitive Information Disclosure
Severity
medium Medium risk
Affected Versions
<=3.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

RealHomes Memberships

medium
Vulnerability
RealHomes Memberships — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.0.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder

medium
Vulnerability
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.9.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GenerateBlocks

medium
Vulnerability
GenerateBlocks — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Database Collation Fix

medium
Vulnerability
Database Collation Fix — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.2.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kirki – Freeform Page Builder, Website Builder & Customizer

medium
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Path Traversal (Zip Slip)
Severity
medium Medium risk
Affected Versions
<=6.0.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Powerkit – Supercharge your WordPress Site

medium
Vulnerability
Powerkit – Supercharge your WordPress Site — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Powerkit – Supercharge your WordPress Site

medium
Vulnerability
Powerkit – Supercharge your WordPress Site — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Powerkit – Supercharge your WordPress Site

medium
Vulnerability
Powerkit – Supercharge your WordPress Site — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Woo Labels – Product Labels & Badges for WooCommerce

medium
Vulnerability
Advanced Woo Labels – Product Labels & Badges for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.48
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

medium
Vulnerability
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Icegram Mailer

medium
Vulnerability
Icegram Mailer — SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.0.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Icegram Engage – Popups, Optins, CTAs & Lead Generation

medium
Vulnerability
Icegram Engage – Popups, Optins, CTAs & Lead Generation — Second-order SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.1.42
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

medium
Vulnerability
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.9.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

medium
Vulnerability
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.9.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync

medium
Vulnerability
GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Property Listings

medium
Vulnerability
Easy Property Listings — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.24
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Download Manager

medium
Vulnerability
Download Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.66
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPvivid Backup & Migration

medium
Vulnerability
WPvivid Backup & Migration — SQL Injection
Severity
medium Medium risk
Affected Versions
<=0.9.131
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

medium
Vulnerability
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.2.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…

medium
Vulnerability
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=3.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Payment forms, Buy now buttons, and Invoicing System | GetPaid

medium
Vulnerability
Payment forms, Buy now buttons, and Invoicing System | GetPaid — Local File Inclusion
Severity
medium Medium risk
Affected Versions
<=2.8.56
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PixelYourSite – Your smart PIXEL (TAG) & API Manager

medium
Vulnerability
PixelYourSite – Your smart PIXEL (TAG) & API Manager — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=11.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

medium
Vulnerability
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.7.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Wp Responsive Thumbnail Slider

medium
Vulnerability
Wp Responsive Thumbnail Slider — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

medium
Vulnerability
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.7.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CubeWP Framework

medium
Vulnerability
CubeWP Framework — SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.1.30
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Charitable

medium
Vulnerability
Charitable — Sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute
Severity
medium Medium risk
Affected Versions
<=1.8.5.3
CVE Reference
Patch Status
No patch
Source
NVD

Clever Mega Menu for Visual Composer

medium
Vulnerability
Clever Mega Menu for Visual Composer — Perform a nonce or capability check in an AJAX action that updates navigation menu item metadata
Severity
medium Medium risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD

webtoffee-cookie-consent

medium
Vulnerability
webtoffee-cookie-consent — Perform authorization checks on several of its REST API routes
Severity
medium Medium risk
Affected Versions
<=3.5.3
CVE Reference
Patch Status
No patch
Source
NVD

Element Pack Addons for Elementor

medium
Vulnerability
Element Pack Addons for Elementor — Sanitize option values passed through certain data attributes before a bundled front-end library re-
Severity
medium Medium risk
Affected Versions
<=8.7.13
CVE Reference
Patch Status
No patch
Source
NVD

King Addons for Elementor

medium
Vulnerability
King Addons for Elementor — Escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticate
Severity
medium Medium risk
Affected Versions
<=51.1.76
CVE Reference
Patch Status
No patch
Source
NVD

JetEngine

medium
Vulnerability
JetEngine — Escape a post meta value before outputting it through one of its shortcodes
Severity
medium Medium risk
Affected Versions
<=3.8.12
CVE Reference
Patch Status
No patch
Source
NVD

FluentBoards

medium
Vulnerability
FluentBoards — Verify that the items selected for a board import operation belong to a board the requesting user is
Severity
medium Medium risk
Affected Versions
<=1.95.3
CVE Reference
Patch Status
No patch
Source
NVD

Five Star Restaurant Reservations

medium
Vulnerability
Five Star Restaurant Reservations — Perform a capability check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.7.23
CVE Reference
Patch Status
No patch
Source
NVD

SMS Alert

medium
Vulnerability
SMS Alert — Bind its "mobile verified" session flag to the phone number that was actually verified: after an att
Severity
medium Medium risk
Affected Versions
<=3.9.8
CVE Reference
Patch Status
No patch
Source
NVD

Gallery for Google Photos

medium
Vulnerability
Gallery for Google Photos — Properly restrict access to the stored third-party OAuth credentials of the connected account
Severity
medium Medium risk
Affected Versions
<=1.2.1
CVE Reference
Patch Status
No patch
Source
NVD

AI ChatBot for WooCommerce

medium
Vulnerability
AI ChatBot for WooCommerce — Perform any authorization or nonce check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=4.8.4
CVE Reference
Patch Status
No patch
Source
NVD

Meta Box

medium
Vulnerability
Meta Box — Verify that a user is authorized to delete the supplied attachment before deleting it
Severity
medium Medium risk
Affected Versions
<=5.13.1
CVE Reference
Patch Status
No patch
Source
NVD

RT Mega Menu

medium
Vulnerability
RT Mega Menu — Perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item s
Severity
medium Medium risk
Affected Versions
<=1.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Simple Restrict

medium
Vulnerability
Simple Restrict — Enforce its content-restriction permission check on the REST API the way it does on the front end
Severity
medium Medium risk
Affected Versions
<=1.2.9
CVE Reference
Patch Status
No patch
Source
NVD

LWS Optimize

medium
Vulnerability
LWS Optimize — Perform a capability check on its cache-clearing actions
Severity
medium Medium risk
Affected Versions
<=3.4
CVE Reference
Patch Status
No patch
Source
NVD

Event Booking Manager for WooCommerce

medium
Vulnerability
Event Booking Manager for WooCommerce — Prevent the deserialization of user-controlled input in some of its event content fields
Severity
medium Medium risk
Affected Versions
<=5.3.7
CVE Reference
Patch Status
No patch
Source
NVD

Event Booking Manager for WooCommerce

medium
Vulnerability
Event Booking Manager for WooCommerce — Sanitise or escape event timeline content submitted by users with post-editing access before storing
Severity
medium Medium risk
Affected Versions
<=5.3.7
CVE Reference
Patch Status
No patch
Source
NVD

Event Booking Manager for WooCommerce

medium
Vulnerability
Event Booking Manager for WooCommerce — Properly verify authorization on the object being modified when quick-editing events
Severity
medium Medium risk
Affected Versions
<=5.3.7
CVE Reference
Patch Status
No patch
Source
NVD

POUCO Import Users

medium
Vulnerability
POUCO Import Users — Perform any capability or nonce checks on AJAX actions available to unauthenticated users that creat
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

login-social

medium
Vulnerability
login-social — Validate password-reset requests against a reset key or the requester's identity
Severity
medium Medium risk
Affected Versions
<=1.0.4
CVE Reference
Patch Status
No patch
Source
NVD

Narrative Publisher

medium
Vulnerability
Narrative Publisher — Restrict write access to a REST-exposed post meta field or escape it when rendering
Severity
medium Medium risk
Affected Versions
<=1.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Product Attachment for WooCommerce

medium
Vulnerability
Product Attachment for WooCommerce — Perform any authorization check before streaming media library files
Severity
medium Medium risk
Affected Versions
<=2.3.3
CVE Reference
Patch Status
No patch
Source
NVD

ProfileGrid

medium
Vulnerability
ProfileGrid — Verify that a notification belongs to the requesting user before deleting it
Severity
medium Medium risk
Affected Versions
<=5.9.9.8
CVE Reference
Patch Status
No patch
Source
NVD

Frontend File Manager Plugin

medium
Vulnerability
Frontend File Manager Plugin — Perform nonce validation on one of its file-metadata update actions
Severity
medium Medium risk
Affected Versions
<=23.6
CVE Reference
Patch Status
No patch
Source
NVD

Simply Schedule Appointments

medium
Vulnerability
Simply Schedule Appointments — Correctly restrict a bulk appointment operation to the requester's own records
Severity
medium Medium risk
Affected Versions
<=1.6.12.6
CVE Reference
Patch Status
No patch
Source
NVD

WPBot

low
Vulnerability
WPBot — Validate administrator-configured field identifiers before using them in a SQL query
Severity
low Low risk
Affected Versions
<=8.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Event Tickets and Registration

low
Vulnerability
Event Tickets and Registration — Properly escape event titles before outputting them in a ticket history log
Severity
low Low risk
Affected Versions
<=5.28.4
CVE Reference
Patch Status
No patch
Source
NVD

Quiz and Survey Master (QSM)

low
Vulnerability
Quiz and Survey Master (QSM) — Perform a capability check before deleting output templates
Severity
low Low risk
Affected Versions
<=11.1.5
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

low
Vulnerability
Easy Appointments — Perform a per-request capability or nonce check on one of its customer-listing handlers
Severity
low Low risk
Affected Versions
<=3.12.26
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

low
Vulnerability
Easy Appointments — Perform capability checks in several of its appointment-management actions
Severity
low Low risk
Affected Versions
<=3.12.26
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

low
Vulnerability
Easy Appointments — Perform any capability or nonce check in one of its connection-deletion actions
Severity
low Low risk
Affected Versions
<=3.12.26
CVE Reference
Patch Status
No patch
Source
NVD

Bit Form

low
Vulnerability
Bit Form — Enforce a form's active/published status on its public form-submission handlers
Severity
low Low risk
Affected Versions
<=3.1.2
CVE Reference
Patch Status
No patch
Source
NVD

ElementsKit Elementor Addons

low
Vulnerability
ElementsKit Elementor Addons — Sanitize or escape certain megamenu menu-item settings before storing them and outputting them on th
Severity
low Low risk
Affected Versions
<=3.10.01
CVE Reference
Patch Status
No patch
Source
NVD
low
Vulnerability
Paid Membership Subscriptions — Protect the member and payment export files it writes to a predictable location in the uploads direc
Severity
low Low risk
Affected Versions
<=3.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Support Genix

low
Vulnerability
Support Genix — Properly authorize access to support-ticket attachment downloads
Severity
low Low risk
Affected Versions
<=1.4.48
CVE Reference
Patch Status
No patch
Source
NVD

FluentCart A New Era of eCommerce

low
Vulnerability
FluentCart A New Era of eCommerce — Perform any authorization or ownership check before rendering customer order documents keyed on a se
Severity
low Low risk
Affected Versions
<=1.5.3
CVE Reference
Patch Status
No patch
Source
NVD

WP Go Maps

low
Vulnerability
WP Go Maps — Properly sanitise and escape a parameter before using it in a SQL query
Severity
low Low risk
Affected Versions
<=10.1.04
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (2)

Streamit

critical
Vulnerability
Streamit — Perform any authorization or nonce verification on one of its unauthenticated AJAX routes
Severity
critical Critical risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Lenxel WP

medium
Vulnerability
Lenxel WP — Perform any authorization or ownership check on its password-reset action
Severity
medium Medium risk
Affected Versions
<=1.0.31
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: July 29 – August 5, 2026

284 WordPress vulnerabilities disclosed between July 29 – August 5, 2026. 24 critical, 54 high severity. 4 patched, 280 unpatched.

WPSentry·Aug 5, 2026
Vulnerability Report

WordPress Vulnerability Report: July 28 – August 4, 2026

296 WordPress vulnerabilities disclosed between July 28 – August 4, 2026. 19 critical, 61 high severity. 2 patched, 294 unpatched.

WPSentry·Aug 4, 2026
Vulnerability Report

WordPress Vulnerability Report: July 27 – August 3, 2026

287 WordPress vulnerabilities disclosed between July 27 – August 3, 2026. 14 critical, 55 high severity. 2 patched, 285 unpatched.

WPSentry·Aug 3, 2026
Back to Blog