BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: July 9 – July 16, 2026

203 WordPress vulnerabilities disclosed between July 9 – July 16, 2026. 11 critical, 49 high severity. 2 patched, 201 unpatched.

WPSentryJuly 16, 202645 min read

During the reporting period (July 9 – July 16, 2026), 203 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

203
Total
11
Critical
49
High
143
Medium
0
Low
2
Patched
Table of Contents 208 plugins & components

WordPress Plugin Vulnerabilities (201)

Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit

critical
Vulnerability
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
Severity
critical Critical risk
Affected Versions
<=2.8.4
CVE Reference
N/A
Patch Status
2.8.5
Source
Wordfence
Plugin Page

miniOrange OTP Login, Verification and SMS Notifications

critical
Vulnerability
miniOrange OTP Login, Verification and SMS Notifications — Authentication Bypass leading to Administrator Account Takeover
Severity
critical Critical risk
Affected Versions
<=5.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Blocksy Companion

critical
Vulnerability
Blocksy Companion — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=2.1.46
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Super Forms – Drag & Drop Form Builder

critical
Vulnerability
Super Forms – Drag & Drop Form Builder — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=6.3.313
CVE Reference
Patch Status
No patch
Source
NVD

Instant Appointment

critical
Vulnerability
Instant Appointment — Arbitrary file uploads
Severity
critical Critical risk
Affected Versions
<=1.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GEO my WP

critical
Vulnerability
GEO my WP — SQL Injection
Severity
critical Critical risk
Affected Versions
<=4.5.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)

critical
Vulnerability
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) — Authentication bypass leading to account takeover
Severity
critical Critical risk
Affected Versions
<=7.7.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Registration & Membership

critical
Vulnerability
User Registration & Membership — Verify the authenticity of incoming payment-provider webhook notifications before acting on them
Severity
critical Critical risk
Affected Versions
<=5.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Word Count and Social Shares

critical
Vulnerability
Word Count and Social Shares — Validate a user-supplied file path before deletion
Severity
critical Critical risk
Affected Versions
<=1.0
CVE Reference
Patch Status
No patch
Source
NVD

Podlove Podcast Publisher

critical
Vulnerability
Podlove Podcast Publisher — Arbitrary file uploads
Severity
critical Critical risk
Affected Versions
<=4.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SAML Single Sign On – SSO Login

critical
Vulnerability
SAML Single Sign On – SSO Login — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=5.4.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Connect Contact Form 7 and Mailchimp

high
Vulnerability
Connect Contact Form 7 and Mailchimp — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=0.9.78.06
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder

high
Vulnerability
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder — Authorization bypass
Severity
high High risk
Affected Versions
<=1.22.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

EventPrime – Events Calendar, Bookings and Tickets

high
Vulnerability
EventPrime – Events Calendar, Bookings and Tickets — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.3.4.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder

high
Vulnerability
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=3.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme

high
Vulnerability
Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme — Cross-Site Request Forgery
Severity
high High risk
Affected Versions
<=4.2.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Cost Estimation & Payment Forms Builder (E&P Forms)

high
Vulnerability
WP Cost Estimation & Payment Forms Builder (E&P Forms) — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=10.5.97
CVE Reference
Patch Status
No patch
Source
NVD

UsersWP

high
Vulnerability
UsersWP — Arbitrary File Deletion
Severity
high High risk
Affected Versions
<=1.2.65
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LoginPress Pro

high
Vulnerability
LoginPress Pro — Authentication Bypass
Severity
high High risk
Affected Versions
<=6.2.3
CVE Reference
Patch Status
No patch
Source
NVD

LoginPress Pro

high
Vulnerability
LoginPress Pro — Authentication Bypass
Severity
high High risk
Affected Versions
<=6.2.3
CVE Reference
Patch Status
No patch
Source
NVD

LoginPress Pro

high
Vulnerability
LoginPress Pro — Authentication bypass
Severity
high High risk
Affected Versions
<=6.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Post Export Import with Media

high
Vulnerability
Post Export Import with Media — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=1.13.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Salon Booking System – Free Version

high
Vulnerability
Salon Booking System – Free Version — Cross-Site Request Forgery
Severity
high High risk
Affected Versions
<=10.30.32
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SureForms – Drag and Drop Form Builder for WordPress

high
Vulnerability
SureForms – Drag and Drop Form Builder for WordPress — Improper Input Validation
Severity
high High risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

high
Vulnerability
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — Blind SQL Injection
Severity
high High risk
Affected Versions
<=2.10.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Chat Help – Click to Chat Button & Form

high
Vulnerability
Chat Help – Click to Chat Button & Form — Sensitive Information Exposure
Severity
high High risk
Affected Versions
<=3.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Business Intelligence Lite

high
Vulnerability
WP Business Intelligence Lite — Authorization bypass
Severity
high High risk
Affected Versions
<=3.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TelSender

high
Vulnerability
TelSender — DOM-Based Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.14.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Hide My WP Lite

high
Vulnerability
Hide My WP Lite — Arbitrary File Read
Severity
high High risk
Affected Versions
<=1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SEO Plugin by Squirrly SEO

high
Vulnerability
SEO Plugin by Squirrly SEO — Arbitrary Post Creation and Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=14.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Grid Builder

high
Vulnerability
WP Grid Builder — Privilege Escalation
Severity
high High risk
Affected Versions
<=2.3.3
CVE Reference
Patch Status
No patch
Source
NVD

Motors – Car Dealership & Classified Listings Plugin

high
Vulnerability
Motors – Car Dealership & Classified Listings Plugin — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.4.112
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel

high
Vulnerability
WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel — Remote Code Execution
Severity
high High risk
Affected Versions
<=8.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LA-Studio Element Kit for Elementor

high
Vulnerability
LA-Studio Element Kit for Elementor — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.6.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Simple JWT Login – Allows you to use JWT on REST endpoints.

high
Vulnerability
Simple JWT Login – Allows you to use JWT on REST endpoints. — Authentication Bypass to Privilege Escalation
Severity
high High risk
Affected Versions
<=3.6.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booking Package

high
Vulnerability
Booking Package — Generic SQL Injection
Severity
high High risk
Affected Versions
<=1.7.20
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Swiss Toolkit For WP

high
Vulnerability
Swiss Toolkit For WP — Arbitrary file upload
Severity
high High risk
Affected Versions
<=1.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Planyo Online Reservation System

high
Vulnerability
Planyo Online Reservation System — Server-Side Request Forgery leading to Local File Inclusion
Severity
high High risk
Affected Versions
<=3.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Form Vibes – Database Manager for Forms

high
Vulnerability
Form Vibes – Database Manager for Forms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.5.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SureCart

high
Vulnerability
SureCart — Privilege escalation
Severity
high High risk
Affected Versions
<=4.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Code Engine

high
Vulnerability
Code Engine — Remote Code Execution
Severity
high High risk
Affected Versions
<=0.3.5
CVE Reference
Patch Status
No patch
Source
NVD

Essential Addons for Elementor – Popular Elementor Templates & Widgets

high
Vulnerability
Essential Addons for Elementor – Popular Elementor Templates & Widgets — Authenticated Account Takeover
Severity
high High risk
Affected Versions
<=6.6.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales

high
Vulnerability
WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales — Time-based blind SQL Injection
Severity
high High risk
Affected Versions
<=2.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CorvusPay WooCommerce Payment Gateway

high
Vulnerability
CorvusPay WooCommerce Payment Gateway — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.7.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

W3 Total Cache

high
Vulnerability
W3 Total Cache — Directory Traversal
Severity
high High risk
Affected Versions
<=2.9.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Genolve – AI image AI video generation

high
Vulnerability
Genolve – AI image AI video generation — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=5.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Registration & Membership

high
Vulnerability
User Registration & Membership — Perform an authorization check on a membership-upgrade action and derives the user to modify from a
Severity
high High risk
Affected Versions
<=5.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

high
Vulnerability
Tutor LMS — CVE-2026-12275
Severity
high High risk
Affected Versions
<=3.9.13
CVE Reference
Patch Status
No patch
Source
NVD

Library Management System

high
Vulnerability
Library Management System — Sanitize and escape a user-supplied parameter before using it in a SQL statement
Severity
high High risk
Affected Versions
<=3.5.8
CVE Reference
Patch Status
No patch
Source
NVD

PDF Generator

high
Vulnerability
PDF Generator — Server Side Request Forgery
Severity
high High risk
Affected Versions
<=1.6.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Forminator

high
Vulnerability
Forminator — DOM-Based XSS
Severity
high High risk
Affected Versions
<=1.55.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Forminator

high
Vulnerability
Forminator — Path Traversal
Severity
high High risk
Affected Versions
<=1.55.0.2
CVE Reference
Patch Status
No patch
Source
NVD

AI Engine

high
Vulnerability
AI Engine — Sanitize a user-supplied filename before using it to write a downloaded file
Severity
high High risk
Affected Versions
<=3.5.5
CVE Reference
Patch Status
No patch
Source
NVD

Newsletters

high
Vulnerability
Newsletters — Prevent deserialization of untrusted input that is stored through a public form
Severity
high High risk
Affected Versions
<=4.15
CVE Reference
Patch Status
No patch
Source
NVD

Shibboleth

high
Vulnerability
Shibboleth — Fail closed when its HTTP header identity mode is enabled without an anti-spoofing key
Severity
high High risk
Affected Versions
<=2.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Quotes llama

high
Vulnerability
Quotes llama — Properly sanitize and escape a user-supplied parameter before using it in a SQL query
Severity
high High risk
Affected Versions
<=3.1.6
CVE Reference
Patch Status
No patch
Source
NVD

Gravity Forms

high
Vulnerability
Gravity Forms — Directory Traversal
Severity
high High risk
Affected Versions
<=2.10.4
CVE Reference
Patch Status
No patch
Source
NVD

Advance Product Search- Voice & Ajax Search for WooCommerce

high
Vulnerability
Advance Product Search- Voice & Ajax Search for WooCommerce — Generic SQL Injection
Severity
high High risk
Affected Versions
<=1.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

RPB Chessboard

high
Vulnerability
RPB Chessboard — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=8.1.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Notification for Telegram

medium
Vulnerability
Notification for Telegram <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Action
Severity
medium Medium risk
Affected Versions
<=3.5.1
CVE Reference
Patch Status
3.5.2
Source
Wordfence
Plugin Page

Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration

medium
Vulnerability
Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration — Unauthorized plugin installation and activation
Severity
medium Medium risk
Affected Versions
<=3.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

medium
Vulnerability
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=10.10.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration

medium
Vulnerability
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.3.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration

medium
Vulnerability
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=4.3.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support

medium
Vulnerability
ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.17.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

medium
Vulnerability
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell — Local File Inclusion
Severity
medium Medium risk
Affected Versions
<=3.12.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultimate Post

medium
Vulnerability
Ultimate Post — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.0.31
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mang Board WP

medium
Vulnerability
Mang Board WP — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

medium
Vulnerability
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=7.9.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Customer Reviews for WooCommerce

medium
Vulnerability
Customer Reviews for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.113.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails

medium
Vulnerability
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.24.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Download Manager

medium
Vulnerability
Download Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.61
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Block, Suspend, Report for BuddyPress

medium
Vulnerability
Block, Suspend, Report for BuddyPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.6.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bookero.pl – system rezerwacji online

medium
Vulnerability
Bookero.pl – system rezerwacji online — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Age Verification & Identity Verification by Token of Trust

medium
Vulnerability
Age Verification & Identity Verification by Token of Trust — Unauthorized access
Severity
medium Medium risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Backup and Staging by WP Time Capsule

medium
Vulnerability
Backup and Staging by WP Time Capsule — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=1.22.26
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Hydra Booking – Appointment Scheduling & Booking Calendar

medium
Vulnerability
Hydra Booking – Appointment Scheduling & Booking Calendar — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=1.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Blocks for ACF Fields

medium
Vulnerability
Blocks for ACF Fields — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=1.6.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

DSGVO All in one for WP

medium
Vulnerability
DSGVO All in one for WP — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=4.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Invoice

medium
Vulnerability
Easy Invoice — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=2.1.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CorvusPay WooCommerce Payment Gateway

medium
Vulnerability
CorvusPay WooCommerce Payment Gateway — Payment Bypass
Severity
medium Medium risk
Affected Versions
<=2.7.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CorvusPay WooCommerce Payment Gateway

medium
Vulnerability
CorvusPay WooCommerce Payment Gateway — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.7.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

DHL eCommerce (Benelux) for WooCommerce

medium
Vulnerability
DHL eCommerce (Benelux) for WooCommerce — Unauthorized modification and loss of data
Severity
medium Medium risk
Affected Versions
<=2.2.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Employee, Leave and Recruitment Management System – Crew HRM

medium
Vulnerability
Employee, Leave and Recruitment Management System – Crew HRM — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Colissimo Officiel : Méthodes de livraison pour WooCommerce

medium
Vulnerability
Colissimo Officiel : Méthodes de livraison pour WooCommerce — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=2.9.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Hotel Booking

medium
Vulnerability
WP Hotel Booking — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System

medium
Vulnerability
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.0.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fluent Forms

medium
Vulnerability
Fluent Forms — Incorrect authorization
Severity
medium Medium risk
Affected Versions
<=6.2.1
CVE Reference
Patch Status
No patch
Source
NVD

WPvivid Backup for MainWP

medium
Vulnerability
WPvivid Backup for MainWP — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=0.9.33
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

King Addons for Elementor

medium
Vulnerability
King Addons for Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=51.1.62
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Plus Addons for Elementor

medium
Vulnerability
Plus Addons for Elementor — Authenticated (Contributor+) Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.4.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gutenberg Blocks with AI by Kadence WP – Page Builder Features

medium
Vulnerability
Gutenberg Blocks with AI by Kadence WP – Page Builder Features — Unauthorized post publication
Severity
medium Medium risk
Affected Versions
<=3.5.32
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

rtMedia for WordPress, BuddyPress and bbPress

medium
Vulnerability
rtMedia for WordPress, BuddyPress and bbPress — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.6.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booking calendar, Appointment Booking System

medium
Vulnerability
Booking calendar, Appointment Booking System — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.2.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Sudoku Shortcode

medium
Vulnerability
Sudoku Shortcode — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

affiliate-toolkit – WP Affiliate Plugin with Amazon

medium
Vulnerability
affiliate-toolkit – WP Affiliate Plugin with Amazon — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.7.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue)

medium
Vulnerability
Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.77
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Animation Addons for Elementor

medium
Vulnerability
Animation Addons for Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.6.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

BuddyHolis TableSearch

medium
Vulnerability
BuddyHolis TableSearch — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ARMember

medium
Vulnerability
ARMember — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=4.0.27
CVE Reference
Patch Status
No patch
Source
NVD

All-in-One Video Gallery

medium
Vulnerability
All-in-One Video Gallery — Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=4.8.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LA-Studio Element Kit for Elementor

medium
Vulnerability
LA-Studio Element Kit for Elementor — Check whether user registration is enabled on the site before creating an account through one of its
Severity
medium Medium risk
Affected Versions
<=1.6.1
CVE Reference
Patch Status
No patch
Source
NVD

Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms

medium
Vulnerability
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms — Local File Inclusion
Severity
medium Medium risk
Affected Versions
<=1.26.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Appointments

medium
Vulnerability
Easy Appointments — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.12.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Highlighting Code Block

medium
Vulnerability
Highlighting Code Block — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FlowForms – Conversational Form Builder

medium
Vulnerability
FlowForms – Conversational Form Builder — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=1.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

medium
Vulnerability
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.1.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GDPR Cookie Consent

medium
Vulnerability
GDPR Cookie Consent — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=4.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent

medium
Vulnerability
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Import and export users and customers

medium
Vulnerability
Import and export users and customers — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=2.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot

medium
Vulnerability
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GW AI Website Builder

medium
Vulnerability
GW AI Website Builder — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Hostel

medium
Vulnerability
Hostel — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference

medium
Vulnerability
GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=1.1.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Upload Files During Checkout

medium
Vulnerability
Easy Upload Files During Checkout — Unauthorized access
Severity
medium Medium risk
Affected Versions
<=3.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ICS Calendar

medium
Vulnerability
ICS Calendar — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=12.0.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

KiviCare – Clinic & Patient Management System (EHR)

medium
Vulnerability
KiviCare – Clinic & Patient Management System (EHR) — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails

medium
Vulnerability
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.24.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

JoomSport – for Sports: Team & League, Football, Hockey & more

medium
Vulnerability
JoomSport – for Sports: Team & League, Football, Hockey & more — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.7.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress

medium
Vulnerability
Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

medium
Vulnerability
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.2.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Invoice123

medium
Vulnerability
Invoice123 — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.7.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WordPress Infinite Scroll – Ajax Load More

medium
Vulnerability
WordPress Infinite Scroll – Ajax Load More — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

medium
Vulnerability
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.1.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

UnderConstructionPage PRO

medium
Vulnerability
UnderConstructionPage PRO — Arbitrary File Read
Severity
medium Medium risk
Affected Versions
<=5.76
CVE Reference
Patch Status
No patch
Source
NVD

Points and Rewards for WooCommerce

medium
Vulnerability
Points and Rewards for WooCommerce — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.10.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Members – Membership & User Role Editor Plugin

medium
Vulnerability
Members – Membership & User Role Editor Plugin — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=3.2.22
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin

medium
Vulnerability
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.1.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

KiviCare – Clinic & Patient Management System (EHR)

medium
Vulnerability
KiviCare – Clinic & Patient Management System (EHR) — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

KiviCare – Clinic & Patient Management System (EHR)

medium
Vulnerability
KiviCare – Clinic & Patient Management System (EHR) — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Lockme OAuth2 calendars integration

medium
Vulnerability
Lockme OAuth2 calendars integration — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.11.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SimpLy Gallery Block & Lightbox

medium
Vulnerability
SimpLy Gallery Block & Lightbox — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mux Video Uploader

medium
Vulnerability
Mux Video Uploader — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=1.1.4
CVE Reference
Patch Status
No patch
Source
NVD

MyParcel

medium
Vulnerability
MyParcel — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.25.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Starboard Suite Reservation Calendars

medium
Vulnerability
Starboard Suite Reservation Calendars — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Premium Addons for Elementor – Powerful Elementor Templates & Widgets

medium
Vulnerability
Premium Addons for Elementor – Powerful Elementor Templates & Widgets — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.11.84
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PDF Invoices & Packing Slips for WooCommerce

medium
Vulnerability
PDF Invoices & Packing Slips for WooCommerce — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=5.14.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Solace Extra

medium
Vulnerability
Solace Extra — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Themify Builder

medium
Vulnerability
Themify Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.7.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Themify Builder

medium
Vulnerability
Themify Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.7.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base

medium
Vulnerability
ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base — Unauthorized cache deletion
Severity
medium Medium risk
Affected Versions
<=2.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SurfLink - Ultimate Link Manager

medium
Vulnerability
SurfLink - Ultimate Link Manager — Unauthorized data modification
Severity
medium Medium risk
Affected Versions
<=2.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AI Chatbot & Workflow Automation by AIWU

medium
Vulnerability
AI Chatbot & Workflow Automation by AIWU — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=1.4.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AI Chatbot & Workflow Automation by AIWU

medium
Vulnerability
AI Chatbot & Workflow Automation by AIWU — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.4.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Affilia – Affiliate Program & Referral Tracking for WordPress

medium
Vulnerability
Affilia – Affiliate Program & Referral Tracking for WordPress — Unauthorized access
Severity
medium Medium risk
Affected Versions
<=3.3.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Notification for Telegram

medium
Vulnerability
Notification for Telegram — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Print, PDF, Email by PrintFriendly

medium
Vulnerability
Print, PDF, Email by PrintFriendly — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.5.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Catalyst Connect Zoho CRM Client Portal

medium
Vulnerability
Catalyst Connect Zoho CRM Client Portal — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WCFM – Frontend Manager for WooCommerce

medium
Vulnerability
WCFM – Frontend Manager for WooCommerce — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=6.7.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Cost Calculator Builder

medium
Vulnerability
Cost Calculator Builder — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=4.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Widgets for Google Reviews

medium
Vulnerability
Widgets for Google Reviews — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=13.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

White Label CMS

medium
Vulnerability
White Label CMS — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.7.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Hotel Booking

medium
Vulnerability
WP Hotel Booking — Insufficient Verification of Data Authenticity
Severity
medium Medium risk
Affected Versions
<=2.3.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Wallet for WooCommerce

medium
Vulnerability
Wallet for WooCommerce — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.6.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WCFM Marketplace – Multivendor Marketplace for WooCommerce

medium
Vulnerability
WCFM Marketplace – Multivendor Marketplace for WooCommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.7.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Easy Pay – Payment and Donation form Builder for Square

medium
Vulnerability
WP Easy Pay – Payment and Donation form Builder for Square — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WCFM – Frontend Manager for WooCommerce

medium
Vulnerability
WCFM – Frontend Manager for WooCommerce — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=6.7.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

bbp Style Pack

medium
Vulnerability
bbp Style Pack — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.4.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

fresh Podcaster

medium
Vulnerability
fresh Podcaster — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

NEX-Forms – Ultimate Forms

medium
Vulnerability
NEX-Forms – Ultimate Forms — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=9.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Breeze Cache

medium
Vulnerability
Breeze Cache — Unauthenticated Stored Cross-Site Scripting (XSS)
Severity
medium Medium risk
Affected Versions
<=2.5.6
CVE Reference
Patch Status
No patch
Source
NVD

Database for Contact Form 7, WPforms, Elementor forms

medium
Vulnerability
Database for Contact Form 7, WPforms, Elementor forms — Restrict the PHP classes allowed when unserializing an attacker-supplied form-field value
Severity
medium Medium risk
Affected Versions
<=1.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

medium
Vulnerability
Tutor LMS — Verify ownership of the targeted quiz attempt before writing to it
Severity
medium Medium risk
Affected Versions
<=3.9.13
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

medium
Vulnerability
Tutor LMS — Perform any authorization or post-target validation before creating a comment in one of its handlers
Severity
medium Medium risk
Affected Versions
<=3.9.13
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS

medium
Vulnerability
Tutor LMS — Verify that the requesting user is allowed to edit a target post before overwriting it in one of its
Severity
medium Medium risk
Affected Versions
<=3.9.13
CVE Reference
Patch Status
No patch
Source
NVD

WP Job Portal

medium
Vulnerability
WP Job Portal — Perform capability or ownership checks before
Severity
medium Medium risk
Affected Versions
<=2.5.5
CVE Reference
Patch Status
No patch
Source
NVD

WP Job Portal

medium
Vulnerability
WP Job Portal — Verify ownership when returning an employer's contact email for a given job
Severity
medium Medium risk
Affected Versions
<=2.5.5
CVE Reference
Patch Status
No patch
Source
NVD

Smart Slider 3

medium
Vulnerability
Smart Slider 3 — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=3.5.1.37
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Avada (Fusion) Builder

medium
Vulnerability
Avada (Fusion) Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.15.5
CVE Reference
Patch Status
No patch
Source
NVD

News Kit Addons For Elementor

medium
Vulnerability
News Kit Addons For Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FoodBook Lite - Online Food Ordering System

medium
Vulnerability
FoodBook Lite - Online Food Ordering System — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Customer Area

medium
Vulnerability
WP Customer Area — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=8.3.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultimate Before After Image Slider & Gallery

medium
Vulnerability
Ultimate Before After Image Slider & Gallery — Escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (
Severity
medium Medium risk
Affected Versions
<=4.7.1
CVE Reference
Patch Status
No patch
Source
NVD

SureForms

medium
Vulnerability
SureForms — Properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payme
Severity
medium Medium risk
Affected Versions
<=2.11.1
CVE Reference
Patch Status
No patch
Source
NVD

WP 2FA

medium
Vulnerability
WP 2FA — Verify that the email address supplied during two-factor authentication setup belongs to the user
Severity
medium Medium risk
Affected Versions
<=3.1.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Academy LMS – WordPress LMS Plugin for Complete eLearning Solution

medium
Vulnerability
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kali Forms — Contact Form & Drag-and-Drop Builder

medium
Vulnerability
Kali Forms — Contact Form & Drag-and-Drop Builder — Verify that a file upload is made against an existing form configured with a file-upload field
Severity
medium Medium risk
Affected Versions
<=2.4.17
CVE Reference
Patch Status
No patch
Source
NVD

Kali Forms — Contact Form & Drag-and-Drop Builder

medium
Vulnerability
Kali Forms — Contact Form & Drag-and-Drop Builder — Perform a per-object capability check in its post-duplication AJAX action
Severity
medium Medium risk
Affected Versions
<=2.4.17
CVE Reference
Patch Status
No patch
Source
NVD

Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages

medium
Vulnerability
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages — Cross-Site Request Forgery
Severity
medium Medium risk
Affected Versions
<=1.5.3.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

List category posts

medium
Vulnerability
List category posts — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=0.95.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions

medium
Vulnerability
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.0.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MxChat – AI Chatbot & Content Generation for WordPress

medium
Vulnerability
MxChat – AI Chatbot & Content Generation for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.2.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GiveWP – Donation Plugin and Fundraising Platform

medium
Vulnerability
GiveWP – Donation Plugin and Fundraising Platform — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.16.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Catch Themes Demo Import

medium
Vulnerability
Catch Themes Demo Import — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=3.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ

medium
Vulnerability
Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces

medium
Vulnerability
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.6.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SEO Booster

medium
Vulnerability
SEO Booster — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=7.3.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SEO Booster

medium
Vulnerability
SEO Booster — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=7.3.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

BetterDocs

medium
Vulnerability
BetterDocs — Sanitise an AI-generated documentation summary before storing and outputting it
Severity
medium Medium risk
Affected Versions
<=4.5.5
CVE Reference
Patch Status
No patch
Source
NVD

Appointment Booking Plugin

medium
Vulnerability
Appointment Booking Plugin — Validate a CSRF nonce on several state-changing actions handled by its central request dispatcher
Severity
medium Medium risk
Affected Versions
<=5.6.3
CVE Reference
Patch Status
No patch
Source
NVD

WP Job Portal

medium
Vulnerability
WP Job Portal — Properly sanitize and escape a parameter before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=2.5.5
CVE Reference
Patch Status
No patch
Source
NVD

Happy Coders OTP Login for WooCommerce

medium
Vulnerability
Happy Coders OTP Login for WooCommerce — Verify that a one-time password was actually validated before authenticating a user based on a suppl
Severity
medium Medium risk
Affected Versions
<=2.8
CVE Reference
Patch Status
No patch
Source
NVD

AI Engine

medium
Vulnerability
AI Engine — Verify that a user owns the chatbot conversation referenced by a client-supplied identifier
Severity
medium Medium risk
Affected Versions
<=3.5.5
CVE Reference
Patch Status
No patch
Source
NVD

Redux Framework

medium
Vulnerability
Redux Framework — Restrict which user meta keys can be written when saving custom profile fields
Severity
medium Medium risk
Affected Versions
<=4.5.13
CVE Reference
Patch Status
No patch
Source
NVD

Abandoned Cart Lite for WooCommerce

medium
Vulnerability
Abandoned Cart Lite for WooCommerce — Protect the integrity of its cart-recovery tokens or bind them to the requesting account
Severity
medium Medium risk
Affected Versions
<=6.8.2
CVE Reference
Patch Status
No patch
Source
NVD

Customer Reviews for WooCommerce

medium
Vulnerability
Customer Reviews for WooCommerce — Perform authentication
Severity
medium Medium risk
Affected Versions
<=5.113.0
CVE Reference
Patch Status
No patch
Source
NVD

Header Footer Builder for Elementor

medium
Vulnerability
Header Footer Builder for Elementor — Require an administrative capability for its dashboard template-import action (it allows any edit_po
Severity
medium Medium risk
Affected Versions
<=1.2.1
CVE Reference
Patch Status
No patch
Source
NVD

RTMKit

medium
Vulnerability
RTMKit — Perform a capability check in one of its AJAX actions and resolves a request-supplied post identifie
Severity
medium Medium risk
Affected Versions
<=2.0.9
CVE Reference
Patch Status
No patch
Source
NVD

RTMKit

medium
Vulnerability
RTMKit — Perform a proper capability check on one of its -builder AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.0.9
CVE Reference
Patch Status
No patch
Source
NVD

FunnelKit

medium
Vulnerability
FunnelKit — Escape a user-supplied parameter before reflecting it into the HTML response of one of its page-buil
Severity
medium Medium risk
Affected Versions
<=3.15.0.6
CVE Reference
Patch Status
No patch
Source
NVD

FunnelKit

medium
Vulnerability
FunnelKit — Validate a user-supplied path before deleting a file during a template-import operation
Severity
medium Medium risk
Affected Versions
<=3.15.0.6
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (2)

EscortWP escortwp

high
Vulnerability
EscortWP escortwp — CVE-2026-12685
Severity
high High risk
Affected Versions
<=3.6.2
CVE Reference
Patch Status
No patch
Source
NVD

Context Blog

medium
Vulnerability
Context Blog — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=1.3.5
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: July 8 – July 15, 2026

197 WordPress vulnerabilities disclosed between July 8 – July 15, 2026. 10 critical, 52 high severity. 2 patched, 195 unpatched.

WPSentry·Jul 15, 2026
Vulnerability Report

WordPress Vulnerability Report: July 1 – July 8, 2026

103 WordPress vulnerabilities disclosed between July 1 – July 8, 2026. 9 critical, 37 high severity. 0 patched, 103 unpatched.

WPSentry·Jul 8, 2026
Vulnerability Report

WordPress Vulnerability Report: June 26 – July 3, 2026

142 WordPress vulnerabilities disclosed between June 26 – July 3, 2026. 8 critical, 37 high severity. 2 patched, 140 unpatched.

WPSentry·Jul 3, 2026
Back to Blog