BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: September 16 – September 23, 2026

294 WordPress vulnerabilities disclosed between September 16 – September 23, 2026. 13 critical, 67 high severity. 0 patched, 294 unpatched.

WPSentrySeptember 23, 202662 min read

During the reporting period (September 16 – September 23, 2026), 294 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

294
Total
13
Critical
67
High
195
Medium
19
Low
0
Patched
Table of Contents 299 plugins & components

WordPress Plugin Vulnerabilities (292)

Multi Uploader for Gravity Forms

critical
Vulnerability
Multi Uploader for Gravity Forms — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=1.1.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Private Feed Key

critical
Vulnerability
Private Feed Key — Verify that the key used to authenticate a feed request is one it issued
Severity
critical Critical risk
Affected Versions
<=0.1
CVE Reference
Patch Status
No patch
Source
NVD

Pressengine

critical
Vulnerability
Pressengine — Stop its login handler from issuing a session when authentication fails
Severity
critical Critical risk
Affected Versions
<=1.0
CVE Reference
Patch Status
No patch
Source
NVD

Login with QR

critical
Vulnerability
Login with QR — Verify that the code used to log a user in is one it issued
Severity
critical Critical risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

wpShopGermany IT-RECHT KANZLEI

critical
Vulnerability
wpShopGermany IT-RECHT KANZLEI — Generate its API authentication token securely
Severity
critical Critical risk
Affected Versions
<=2.4
CVE Reference
Patch Status
No patch
Source
NVD

AF Companion

critical
Vulnerability
AF Companion — Validate the type of files uploaded through one of its import features
Severity
critical Critical risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Gravity Forms

critical
Vulnerability
Gravity Forms — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=3.1.0.4
CVE Reference
Patch Status
No patch
Source
NVD

WP Recipe Maker

critical
Vulnerability
WP Recipe Maker — Arbitrary Shortcode Execution
Severity
critical Critical risk
Affected Versions
<=10.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder

critical
Vulnerability
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Arbitrary shortcode execution
Severity
critical Critical risk
Affected Versions
<=1.57.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Botiga Pro

critical
Vulnerability
Botiga Pro — Perform any authorisation checks on one of its REST routes
Severity
critical Critical risk
Affected Versions
<=1.6.5
CVE Reference
Patch Status
No patch
Source
NVD

Web to Print Online Designer

critical
Vulnerability
Web to Print Online Designer — Validate the type or extension of uploaded files
Severity
critical Critical risk
Affected Versions
<=2.15.0
CVE Reference
Patch Status
No patch
Source
NVD

Meta Box AIO

critical
Vulnerability
Meta Box AIO — Privilege Escalation to Administrator
Severity
critical Critical risk
Affected Versions
<=3.11.0
CVE Reference
Patch Status
No patch
Source
NVD

Give Tributes

critical
Vulnerability
Give Tributes — PHP Object Injection
Severity
critical Critical risk
Affected Versions
<=2.3.1
CVE Reference
Patch Status
No patch
Source
NVD
high
Vulnerability
Paid Downloads — Arbitrary File Upload
Severity
high High risk
Affected Versions
<=3.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Dictionary

high
Vulnerability
Dictionary — Escape user input before reflecting it back in the responses of several directly accessible scripts
Severity
high High risk
Affected Versions
<=1.0
CVE Reference
Patch Status
No patch
Source
NVD

Choose User Role at Registration

high
Vulnerability
Choose User Role at Registration — Validate the role requested at registration against the roles an administrator chose to offer
Severity
high High risk
Affected Versions
<=1.3.3
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

high
Vulnerability
WPLP Cookie Consent — Escape a value submitted through a public endpoint for the JavaScript context it is later output in
Severity
high High risk
Affected Versions
<=4.4.4
CVE Reference
Patch Status
No patch
Source
NVD

Dewa Kirim

high
Vulnerability
Dewa Kirim — Escape delivery coordinates submitted at checkout before outputting them inside an inline script
Severity
high High risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Dictionary

high
Vulnerability
Dictionary — Have authorisation
Severity
high High risk
Affected Versions
<=1.0
CVE Reference
Patch Status
No patch
Source
NVD

PuppyFW

high
Vulnerability
PuppyFW — Have proper authorisation on one of its REST routes
Severity
high High risk
Affected Versions
<=0.4.4
CVE Reference
Patch Status
No patch
Source
NVD

Realtyna Organic IDX plugin + WPL Real Estate

high
Vulnerability
Realtyna Organic IDX plugin + WPL Real Estate — Sanitise and escape some of its parameters before reflecting them back in the page
Severity
high High risk
Affected Versions
<=5.4.2
CVE Reference
Patch Status
No patch
Source
NVD

To Do List Member

high
Vulnerability
To Do List Member — Load WordPress and therefore applies no authentication
Severity
high High risk
Affected Versions
<=1.6
CVE Reference
Patch Status
No patch
Source
NVD

Yo

high
Vulnerability
Yo — Sanitize or parameterize the username request parameter before using it in a SQL query
Severity
high High risk
Affected Versions
<=1.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP

high
Vulnerability
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP — CVE-2026-54239
Severity
high High risk
Affected Versions
<=1.8.11
CVE Reference
Patch Status
No patch
Source
NVD

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF

high
Vulnerability
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF — PHP Object Injection
Severity
high High risk
Affected Versions
<=6.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

All-in-One WP Migration and Backup

high
Vulnerability
All-in-One WP Migration and Backup — Perform any capability check on several of its AJAX actions
Severity
high High risk
Affected Versions
<=7.111
CVE Reference
Patch Status
No patch
Source
NVD

Easy Form Builder by WhiteStudio

high
Vulnerability
Easy Form Builder by WhiteStudio — Validate a submitted value against the stored configuration for some of its form types
Severity
high High risk
Affected Versions
<=4.2.0
CVE Reference
Patch Status
No patch
Source
NVD

VikBooking Hotel Booking Engine & PMS

high
Vulnerability
VikBooking Hotel Booking Engine & PMS — Restrict the type of files unauthenticated visitors may attach to its live chat
Severity
high High risk
Affected Versions
<=1.8.15
CVE Reference
Patch Status
No patch
Source
NVD

wp shortcut link and advertisement baner

high
Vulnerability
wp shortcut link and advertisement baner — Sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauth
Severity
high High risk
Affected Versions
<=1.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Price Drop Alert for Woo Commerce

high
Vulnerability
Price Drop Alert for Woo Commerce — Sanitize and escape parameters before using them in a SQL query on an AJAX action available to unaut
Severity
high High risk
Affected Versions
<=1.1
CVE Reference
Patch Status
No patch
Source
NVD

Product Question and Answer

high
Vulnerability
Product Question and Answer — Sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthe
Severity
high High risk
Affected Versions
<=1.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Tz Weekly Radio Schedule

high
Vulnerability
Tz Weekly Radio Schedule — Sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to
Severity
high High risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Tz Weekly Radio Schedule

high
Vulnerability
Tz Weekly Radio Schedule — Sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to
Severity
high High risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD

iGMS Direct Booking

high
Vulnerability
iGMS Direct Booking — Authorise or escape its widget appearance settings
Severity
high High risk
Affected Versions
<=2.0
CVE Reference
Patch Status
No patch
Source
NVD

Filter Gallery

high
Vulnerability
Filter Gallery — Verify the nonce on several of its AJAX handlers when the nonce field is omitted
Severity
high High risk
Affected Versions
<=1.1.5
CVE Reference
Patch Status
No patch
Source
NVD

Filter Gallery

high
Vulnerability
Filter Gallery — Authorization bypass
Severity
high High risk
Affected Versions
<=1.1.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booking Calendar

high
Vulnerability
Booking Calendar — Privilege Escalation
Severity
high High risk
Affected Versions
<=11.8.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mapster WP Maps

high
Vulnerability
Mapster WP Maps — Arbitrary User Meta Write
Severity
high High risk
Affected Versions
<=1.23.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Printcart Web to Print Product Designer for WooCommerce

high
Vulnerability
Printcart Web to Print Product Designer for WooCommerce — Directory Traversal
Severity
high High risk
Affected Versions
<=2.8.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Multi Store Locator Pro

high
Vulnerability
WP Multi Store Locator Pro — Generic SQL Injection
Severity
high High risk
Affected Versions
<=4.5.1
CVE Reference
Patch Status
No patch
Source
NVD

WCFM Marketplace – Multivendor Marketplace for WooCommerce

high
Vulnerability
WCFM Marketplace – Multivendor Marketplace for WooCommerce — Generic SQL Injection
Severity
high High risk
Affected Versions
<=3.8.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Location Manager

high
Vulnerability
Location Manager — Generic SQL Injection
Severity
high High risk
Affected Versions
<=2.3.38
CVE Reference
Patch Status
No patch
Source
NVD

Complianz GDPR/CCPA Cookie Consent Banner

high
Vulnerability
Complianz GDPR/CCPA Cookie Consent Banner — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=7.5.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

high
Vulnerability
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits — Authorization bypass
Severity
high High risk
Affected Versions
<=3.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

high
Vulnerability
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.2.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder

high
Vulnerability
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.24.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Asset CleanUp: Page Speed Booster

high
Vulnerability
Asset CleanUp: Page Speed Booster — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.4.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Photo Album Plus

high
Vulnerability
WP Photo Album Plus — Remote Code Execution
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Save as PDF Plugin by PDFCrowd

high
Vulnerability
Save as PDF Plugin by PDFCrowd — Arbitrary Function Invocation
Severity
high High risk
Affected Versions
<=4.6.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Import Export Lite

high
Vulnerability
WP Import Export Lite — Verify that the user running an import is permitted to create or modify user accounts and assign rol
Severity
high High risk
Affected Versions
<=3.9.35
CVE Reference
Patch Status
No patch
Source
NVD

Estatik Real Estate Plugin

high
Vulnerability
Estatik Real Estate Plugin — Sanitise and escape several values decoded from a request parameter before reflecting them back in a
Severity
high High risk
Affected Versions
<=4.3.5
CVE Reference
Patch Status
No patch
Source
NVD

Unbounce Landing Pages

high
Vulnerability
Unbounce Landing Pages — Perform any authorisation check when updating the configuration its front-end proxy relies on
Severity
high High risk
Affected Versions
<=1.1.5
CVE Reference
Patch Status
No patch
Source
NVD

Ultimate Member

high
Vulnerability
Ultimate Member — Escape a value derived from user supplied profile names before outputting it in the page title
Severity
high High risk
Affected Versions
<=2.13.1
CVE Reference
Patch Status
No patch
Source
NVD

UsersWP

high
Vulnerability
UsersWP — Verify that a social login provider has confirmed ownership of an email address before using it to r
Severity
high High risk
Affected Versions
<=1.5.10
CVE Reference
Patch Status
No patch
Source
NVD

Master Blocks

high
Vulnerability
Master Blocks — Have authorisation on one of its REST routes
Severity
high High risk
Affected Versions
<=1.5.0
CVE Reference
Patch Status
No patch
Source
NVD

VikRentItems Flexible Rental Management System

high
Vulnerability
VikRentItems Flexible Rental Management System — Sanitise and escape some of its parameters before using them in SQL statements
Severity
high High risk
Affected Versions
<=1.2.4
CVE Reference
Patch Status
No patch
Source
NVD

MgoSync

high
Vulnerability
MgoSync — Have authorization controls on one of its REST API endpoints
Severity
high High risk
Affected Versions
<=2.1.7
CVE Reference
Patch Status
No patch
Source
NVD

Quill Forms | Conversational Multi Step Forms, Surveys & quizzes

high
Vulnerability
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.7.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Welcomizer

high
Vulnerability
The Welcomizer — Remote Code Execution
Severity
high High risk
Affected Versions
<=2.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

high
Vulnerability
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — Arbitrary shortcode execution
Severity
high High risk
Affected Versions
<=4.17.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

YS LeadGen

high
Vulnerability
YS LeadGen — Sensitive Information Exposure
Severity
high High risk
Affected Versions
<=2.1.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Photo Gallery, Sliders, Proofing and

high
Vulnerability
Photo Gallery, Sliders, Proofing and — Correctly validate the extensions of files extracted from an uploaded archive
Severity
high High risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD

SAML Single Sign On

high
Vulnerability
SAML Single Sign On — Honour the configured criterion for linking an incoming single sign-on identity to a WordPress accou
Severity
high High risk
Affected Versions
<=6.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Unlimited Elements For Elementor

high
Vulnerability
Unlimited Elements For Elementor — Perform a capability check on an AJAX action and deserializes attacker-controlled stored data throug
Severity
high High risk
Affected Versions
<=2.0.20
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

high
Vulnerability
Forminator Forms — Restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC reques
Severity
high High risk
Affected Versions
<=1.57.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Tripzzy

high
Vulnerability
Tripzzy — Have authorisation checks
Severity
high High risk
Affected Versions
<=1.5.1
CVE Reference
Patch Status
No patch
Source
NVD

Import and export users and customers

high
Vulnerability
Import and export users and customers — Correctly enforce the promote_users capability when assigning roles during a CSV import
Severity
high High risk
Affected Versions
<=2.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Import and export users and customers

high
Vulnerability
Import and export users and customers — Enforce the promote_users capability in its front-end import functionality
Severity
high High risk
Affected Versions
<=2.5.2
CVE Reference
Patch Status
No patch
Source
NVD

CMP – Coming Soon & Maintenance Plugin by NiteoThemes

high
Vulnerability
CMP – Coming Soon & Maintenance Plugin by NiteoThemes — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=4.1.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TranslatePress – Translate Multilingual sites with AI Translation

high
Vulnerability
TranslatePress – Translate Multilingual sites with AI Translation — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.3.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms

high
Vulnerability
Ninja Forms — Prevent user-submitted form field values from being deserialised when an administrator later exports
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Ninja Forms

high
Vulnerability
Ninja Forms — Escape submitted form field values before outputting them on the submission edit screen in the admin
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

BM Content Builder

high
Vulnerability
BM Content Builder — Arbitrary file deletion
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

WP Table Builder – Drag & Drop Table Builder

high
Vulnerability
WP Table Builder – Drag & Drop Table Builder — Incorrect Authorization
Severity
high High risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The WP Ultimate Review

high
Vulnerability
The WP Ultimate Review — Arbitrary shortcode execution
Severity
high High risk
Affected Versions
<=2.4.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

HUSKY – Products Filter for WooCommerce Professional

high
Vulnerability
HUSKY – Products Filter for WooCommerce Professional — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.4.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Yelp Review Slider

high
Vulnerability
WP Yelp Review Slider — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=9.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPC Product Bundles for WooCommerce

high
Vulnerability
WPC Product Bundles for WooCommerce — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=8.6.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Travel Engine – Tour Booking Plugin – Tour Operator Software

high
Vulnerability
WP Travel Engine – Tour Booking Plugin – Tour Operator Software — Local File Inclusion
Severity
high High risk
Affected Versions
<=6.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

HashBar – WordPress Notification Bar

high
Vulnerability
HashBar – WordPress Notification Bar — CVE-2026-94117
Severity
high High risk
Affected Versions
<=2.0.3
CVE Reference
Patch Status
No patch
Source
NVD

All-in-One WP Migration and Backup

medium
Vulnerability
All-in-One WP Migration and Backup — Insufficient Credential Protection
Severity
medium Medium risk
Affected Versions
<=7.110
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Photo Gallery by 10Web – Mobile-Friendly Image Gallery

medium
Vulnerability
Photo Gallery by 10Web – Mobile-Friendly Image Gallery — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.8.44
CVE Reference
Patch Status
No patch
Source
NVD

HT Mega Addons for Elementor

medium
Vulnerability
HT Mega Addons for Elementor — Restrict the HTML tag name used to render the section headline in several of its widgets and blocks
Severity
medium Medium risk
Affected Versions
<=3.2.6
CVE Reference
Patch Status
No patch
Source
NVD

Newsletter

medium
Vulnerability
Newsletter — Generate its email tracking signing key with sufficient entropy and signs its tracking links with an
Severity
medium Medium risk
Affected Versions
<=9.3.8
CVE Reference
Patch Status
No patch
Source
NVD
medium
Vulnerability
Paid Membership Subscriptions — Verify that the amount and currency reported by the payment provider match the pending payment befor
Severity
medium Medium risk
Affected Versions
<=3.0.9
CVE Reference
Patch Status
No patch
Source
NVD

Autopay

medium
Vulnerability
Autopay — Enforce the signature on one of its payment callbacks
Severity
medium Medium risk
Affected Versions
<=5.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Active Woot Products Tables for WooCommerce. 100% FREE

medium
Vulnerability
Active Woot Products Tables for WooCommerce. 100% FREE — Have authorisation and CSRF checks in some of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms

medium
Vulnerability
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms — Check the user's capabilities in its message deletion AJAX action
Severity
medium Medium risk
Affected Versions
<=5.1.1
CVE Reference
Patch Status
No patch
Source
NVD

EWWW Image Optimizer

medium
Vulnerability
EWWW Image Optimizer — Properly escape image attribute values when it rewrites page output
Severity
medium Medium risk
Affected Versions
<=8.7.7
CVE Reference
Patch Status
No patch
Source
NVD

Master Addons for Elementor

medium
Vulnerability
Master Addons for Elementor — Perform an authorization check on the AJAX action that deactivates its Popup Builder popups
Severity
medium Medium risk
Affected Versions
<=3.1.9
CVE Reference
Patch Status
No patch
Source
NVD

Motors

medium
Vulnerability
Motors — Verify that a request is authorized to view a user's non-published listings before returning them
Severity
medium Medium risk
Affected Versions
<=1.4.121
CVE Reference
Patch Status
No patch
Source
NVD

Event Booking Manager for WooCommerce

medium
Vulnerability
Event Booking Manager for WooCommerce — Restrict who can view its stored payment gateway configuration
Severity
medium Medium risk
Affected Versions
<=5.6.0
CVE Reference
Patch Status
No patch
Source
NVD

Checkout Field Manager (Checkout Manager) for WooCommerce

medium
Vulnerability
Checkout Field Manager (Checkout Manager) for WooCommerce — Properly validate the ownership of an attachment before deleting it
Severity
medium Medium risk
Affected Versions
<=7.9.7
CVE Reference
Patch Status
No patch
Source
NVD

Checkout Field Manager (Checkout Manager) for WooCommerce

medium
Vulnerability
Checkout Field Manager (Checkout Manager) for WooCommerce — Properly validate the ownership of an attachment before deleting it
Severity
medium Medium risk
Affected Versions
<=7.9.7
CVE Reference
Patch Status
No patch
Source
NVD

Booking for Appointments and Events Calendar – Amelia

medium
Vulnerability
Booking for Appointments and Events Calendar – Amelia — Unauthorized access and modification of data
Severity
medium Medium risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD

Booking for Appointments and Events Calendar – Amelia

medium
Vulnerability
Booking for Appointments and Events Calendar – Amelia — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=2.4.5
CVE Reference
Patch Status
No patch
Source
NVD

Motors – Car Dealership & Classified Listings Plugin

medium
Vulnerability
Motors – Car Dealership & Classified Listings Plugin — Unauthorized access of data
Severity
medium Medium risk
Affected Versions
<=1.4.120
CVE Reference
Patch Status
No patch
Source
NVD

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

medium
Vulnerability
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=5.6.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Brizy – Page Builder

medium
Vulnerability
Brizy – Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.8.14
CVE Reference
Patch Status
No patch
Source
NVD

RT Mega Menu

medium
Vulnerability
RT Mega Menu — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg

medium
Vulnerability
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.5.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

King Addons for Elementor

medium
Vulnerability
King Addons for Elementor — Perform an object-level authorization check when importing template content into a page
Severity
medium Medium risk
Affected Versions
<=51.1.81
CVE Reference
Patch Status
No patch
Source
NVD

RestroPress

medium
Vulnerability
RestroPress — Verify ownership in its payment-recovery flow before acting on a request-supplied order identifier
Severity
medium Medium risk
Affected Versions
<=3.4.6
CVE Reference
Patch Status
No patch
Source
NVD

Easy Form Builder by WhiteStudio

medium
Vulnerability
Easy Form Builder by WhiteStudio — Validate a submitted value against the stored configuration for some of its form types
Severity
medium Medium risk
Affected Versions
<=4.2.0
CVE Reference
Patch Status
No patch
Source
NVD

UpsellWP

medium
Vulnerability
UpsellWP — Check that products added to the cart through a Frequently Bought Together campaign belong to that c
Severity
medium Medium risk
Affected Versions
<=2.2.10
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

medium
Vulnerability
Easy Appointments — Use an unguessable token to authorize its mail-link appointment cancellation and confirmation action
Severity
medium Medium risk
Affected Versions
<=4.0.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Easy Appointments

medium
Vulnerability
Easy Appointments — Perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint
Severity
medium Medium risk
Affected Versions
<=4.0.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Really Simple Security

medium
Vulnerability
Really Simple Security — Validate a client-supplied address value before using it as a storage key in one of its own options
Severity
medium Medium risk
Affected Versions
<=9.8.3
CVE Reference
Patch Status
No patch
Source
NVD

All Bootstrap Blocks

medium
Vulnerability
All Bootstrap Blocks — Properly escape a block attribute before outputting it in HTML tag-name position
Severity
medium Medium risk
Affected Versions
<=1.3.31
CVE Reference
Patch Status
No patch
Source
NVD

Generate PDF using Contact Form 7

medium
Vulnerability
Generate PDF using Contact Form 7 — Restrict the destination of the image fetch its PDF renderer performs on submitted form content
Severity
medium Medium risk
Affected Versions
<=4.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Auto Upload Images

medium
Vulnerability
Auto Upload Images — Limited Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=3.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

InfiniteWP Client

medium
Vulnerability
InfiniteWP Client — SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.13.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images

medium
Vulnerability
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Magazine Blocks

medium
Vulnerability
Magazine Blocks — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.8.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid

medium
Vulnerability
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.8.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Breeze Cache

medium
Vulnerability
Breeze Cache — Include a set of tracking-related query parameters in its page-cache key while still caching pages r
Severity
medium Medium risk
Affected Versions
<=2.5.15
CVE Reference
Patch Status
No patch
Source
NVD

Custom Twitter Feeds – A Tweets Widget or X Feed Widget

medium
Vulnerability
Custom Twitter Feeds – A Tweets Widget or X Feed Widget — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Hide My WP Ghost

medium
Vulnerability
Hide My WP Ghost — Verify that a request is a genuine WooCommerce request before disabling its firewall
Severity
medium Medium risk
Affected Versions
<=7.0.11
CVE Reference
Patch Status
No patch
Source
NVD

Hide My WP Ghost

medium
Vulnerability
Hide My WP Ghost — Properly validate a loopback security-check request before disabling its login and URL hiding protec
Severity
medium Medium risk
Affected Versions
<=7.0.11
CVE Reference
Patch Status
No patch
Source
NVD

All Bootstrap Blocks

medium
Vulnerability
All Bootstrap Blocks — Validate a block attribute before using it to build a filesystem path that is included at render tim
Severity
medium Medium risk
Affected Versions
<=1.3.31
CVE Reference
Patch Status
No patch
Source
NVD

Filter Gallery

medium
Vulnerability
Filter Gallery — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.1.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI

medium
Vulnerability
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=2.34.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents

medium
Vulnerability
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.6.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Clean Login

medium
Vulnerability
Clean Login — Check whether user registration is enabled before creating an account in its registration handler
Severity
medium Medium risk
Affected Versions
<=1.19
CVE Reference
Patch Status
No patch
Source
NVD

Clean Login

medium
Vulnerability
Clean Login — Verify its registration CAPTCHA when the stored session value is empty
Severity
medium Medium risk
Affected Versions
<=1.19
CVE Reference
Patch Status
No patch
Source
NVD

Booking Calendar

medium
Vulnerability
Booking Calendar — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=11.8.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Download Manager

medium
Vulnerability
Download Manager — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.3.68
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Easy Pay – Payment and Donation form Builder for Square

medium
Vulnerability
WP Easy Pay – Payment and Donation form Builder for Square — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LatePoint – Calendar Booking Plugin for Appointments and Events

medium
Vulnerability
LatePoint – Calendar Booking Plugin for Appointments and Events — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=5.6.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kubio AI Page Builder

medium
Vulnerability
Kubio AI Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.8.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FileBird – WordPress Media Library Folders & File Manager

medium
Vulnerability
FileBird – WordPress Media Library Folders & File Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.5.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers

medium
Vulnerability
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=2.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

VK All in One Expansion Unit

medium
Vulnerability
VK All in One Expansion Unit — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=9.118.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Inventory Manager

medium
Vulnerability
WP Inventory Manager — SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

NEX-Forms – Ultimate Forms

medium
Vulnerability
NEX-Forms – Ultimate Forms — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=9.3.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Photo Gallery by 10Web – Mobile-Friendly Image Gallery

medium
Vulnerability
Photo Gallery by 10Web – Mobile-Friendly Image Gallery — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.8.44
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletter – Send awesome emails from WordPress

medium
Vulnerability
Newsletter – Send awesome emails from WordPress — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=9.3.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Qi Addons For Elementor

medium
Vulnerability
Qi Addons For Elementor — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

medium
Vulnerability
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Strong Testimonials

medium
Vulnerability
Strong Testimonials — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CSS & JavaScript Toolbox

medium
Vulnerability
CSS & JavaScript Toolbox — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=12.0.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder

medium
Vulnerability
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.24.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Recipe Maker

medium
Vulnerability
WP Recipe Maker — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=10.8.1
CVE Reference
Patch Status
No patch
Source
NVD

WPComplete

medium
Vulnerability
WPComplete — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.9.9.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP2Social Auto Publish

medium
Vulnerability
WP2Social Auto Publish — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.4.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SEO Booster

medium
Vulnerability
SEO Booster — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=7.4.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Divi Essential

medium
Vulnerability
Divi Essential — Sensitive information exposure
Severity
medium Medium risk
Affected Versions
<=5.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Tutor LMS – eLearning and online course solution

medium
Vulnerability
Tutor LMS – eLearning and online course solution — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tutor LMS – eLearning and online course solution

medium
Vulnerability
Tutor LMS – eLearning and online course solution — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

medium
Vulnerability
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots — Information Exposure by Spoofing
Severity
medium Medium risk
Affected Versions
<=2.15.33
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tutor LMS – eLearning and online course solution

medium
Vulnerability
Tutor LMS – eLearning and online course solution — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=4.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

medium
Vulnerability
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.15.33
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Pochipp

medium
Vulnerability
Pochipp — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.20.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Nimble Page Builder

medium
Vulnerability
Nimble Page Builder — Perform an authorization check when returning page-builder content through an authenticated AJAX act
Severity
medium Medium risk
Affected Versions
<=3.3.8
CVE Reference
Patch Status
No patch
Source
NVD

JetFormBuilder — Dynamic Blocks Form Builder

medium
Vulnerability
JetFormBuilder — Dynamic Blocks Form Builder — Sufficiently restrict which PHP functions can be used as a custom field-validation callback
Severity
medium Medium risk
Affected Versions
<=3.6.5.3
CVE Reference
Patch Status
No patch
Source
NVD

Ultra Addons for Contact Form 7

medium
Vulnerability
Ultra Addons for Contact Form 7 — Validate the type or extension of files uploaded through one of its form fields
Severity
medium Medium risk
Affected Versions
<=3.5.51
CVE Reference
Patch Status
No patch
Source
NVD

Online Scheduling and Appointment Booking System

medium
Vulnerability
Online Scheduling and Appointment Booking System — Verify that the requester owns the AI booking-assistant conversation named in its unauthenticated co
Severity
medium Medium risk
Affected Versions
<=28.2
CVE Reference
Patch Status
No patch
Source
NVD

WPGraphQL Smart Cache

medium
Vulnerability
WPGraphQL Smart Cache — Require authorisation or validate a caller-supplied query identifier before storing a persisted quer
Severity
medium Medium risk
Affected Versions
<=2.3.2
CVE Reference
Patch Status
No patch
Source
NVD

Hydra Booking — Appointment Scheduling & Booking Calendar

medium
Vulnerability
Hydra Booking — Appointment Scheduling & Booking Calendar — Verify that the host record being modified belongs to the user making the request
Severity
medium Medium risk
Affected Versions
<=1.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Hydra Booking — Appointment Scheduling & Booking Calendar

medium
Vulnerability
Hydra Booking — Appointment Scheduling & Booking Calendar — Perform object-level authorisation checks on several of its host-management operations
Severity
medium Medium risk
Affected Versions
<=1.2.4
CVE Reference
Patch Status
No patch
Source
NVD

Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit

medium
Vulnerability
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit — Verify the authenticity of its PIX payment webhook before updating an order's status
Severity
medium Medium risk
Affected Versions
<=5.4.7
CVE Reference
Patch Status
No patch
Source
NVD

Mailchimp for WooCommerce

medium
Vulnerability
Mailchimp for WooCommerce — Verify that the requesting user holds the required capability in the permission callback for several
Severity
medium Medium risk
Affected Versions
<=6.1.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Customer Reviews

medium
Vulnerability
WP Customer Reviews — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.7.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PDF Builder for WooCommerce. Create invoices,packing slips and more

medium
Vulnerability
PDF Builder for WooCommerce. Create invoices,packing slips and more — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.0.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

OTP Login & Register Woocommerce

medium
Vulnerability
OTP Login & Register Woocommerce — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.7.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Create

medium
Vulnerability
Create — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Create

medium
Vulnerability
Create — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)

medium
Vulnerability
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.15.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Real3D Flipbook Lite

medium
Vulnerability
Real3D Flipbook Lite — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SSL Zen — SSL Certificate Installer & HTTPS Redirects

medium
Vulnerability
SSL Zen — SSL Certificate Installer & HTTPS Redirects — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.7.42
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization

medium
Vulnerability
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.6.23
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Metasync

medium
Vulnerability
Metasync — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=2.6.23
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

BlockSpare

medium
Vulnerability
BlockSpare — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.2.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Wow Elements Addons for Elementor

medium
Vulnerability
Wow Elements Addons for Elementor — Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=1.11.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ibtana – Ecommerce Product Addons

medium
Vulnerability
Ibtana – Ecommerce Product Addons — Unauthorized post meta modification
Severity
medium Medium risk
Affected Versions
<=0.4.7.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Composer – The Easiest Page Builder

medium
Vulnerability
WP Composer – The Easiest Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bread

medium
Vulnerability
Bread — Information exposure
Severity
medium Medium risk
Affected Versions
<=2.9.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Redux Framework

medium
Vulnerability
Redux Framework — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.5.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Optimizer

medium
Vulnerability
WP Optimizer — SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GoPay for WooCommerce

medium
Vulnerability
GoPay for WooCommerce — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.0.36
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Ghost (Hide My WP Ghost) – Security & Firewall

medium
Vulnerability
WP Ghost (Hide My WP Ghost) – Security & Firewall — Open Redirect
Severity
medium Medium risk
Affected Versions
<=7.0.02
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MC4WP: Mailchimp for WordPress

medium
Vulnerability
MC4WP: Mailchimp for WordPress — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.14.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Appointments

medium
Vulnerability
Easy Appointments — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=3.12.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Flex Import

medium
Vulnerability
Flex Import — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=3.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Payment Gateway of Stripe for WooCommerce

medium
Vulnerability
Payment Gateway of Stripe for WooCommerce — Improper Verification of Cryptographic Signature
Severity
medium Medium risk
Affected Versions
<=5.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Custom Field Template

medium
Vulnerability
Custom Field Template — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.7.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

TikTok

medium
Vulnerability
TikTok — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.4.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

YS LeadGen

medium
Vulnerability
YS LeadGen — Authorization bypass and Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Redux Framework

medium
Vulnerability
Redux Framework — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.5.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LiteSpeed Cache

medium
Vulnerability
LiteSpeed Cache — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gum Addon for Elementor

medium
Vulnerability
Gum Addon for Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.3.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WordLift – AI powered SEO – Schema

medium
Vulnerability
WordLift – AI powered SEO – Schema — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=3.54.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Datalogics Ecommerce Delivery – Datalogics

medium
Vulnerability
Datalogics Ecommerce Delivery – Datalogics — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.6.65
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Empik for Woocommerce

medium
Vulnerability
Empik for Woocommerce — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Partial Shipment for Woocommerce

medium
Vulnerability
Partial Shipment for Woocommerce — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=3.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Master Slider

medium
Vulnerability
Master Slider — Sanitise and escape some of its shortcode attributes before outputting them in an inline script cont
Severity
medium Medium risk
Affected Versions
<=3.11.2
CVE Reference
Patch Status
No patch
Source
NVD

Import and export users and customers

medium
Vulnerability
Import and export users and customers — Validate a user-supplied URL before requesting it server-side during a CSV import
Severity
medium Medium risk
Affected Versions
<=2.4.5
CVE Reference
Patch Status
No patch
Source
NVD

Photo Gallery, Sliders, Proofing and

medium
Vulnerability
Photo Gallery, Sliders, Proofing and — Verify that the user acting on an image owns the gallery it belongs to
Severity
medium Medium risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Sanitize uploaded SVG files while making them uploadable site-wide
Severity
medium Medium risk
Affected Versions
<=6.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

medium
Vulnerability
Forminator Forms — Apply the role validation it enforces elsewhere when a registration form is nested inside an importe
Severity
medium Medium risk
Affected Versions
<=1.57.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Tripzzy

medium
Vulnerability
Tripzzy — Perform any capability or ownership checks on its administrative booking-management actions
Severity
medium Medium risk
Affected Versions
<=1.5.1
CVE Reference
Patch Status
No patch
Source
NVD

Sign-up Sheets

medium
Vulnerability
Sign-up Sheets — Properly validate the CSRF nonce that protects its sign-up deletion action
Severity
medium Medium risk
Affected Versions
<=2.4.0
CVE Reference
Patch Status
No patch
Source
NVD

Meow Gallery

medium
Vulnerability
Meow Gallery — Properly sanitize a user-supplied value before concatenating it into a shortcode string that it pass
Severity
medium Medium risk
Affected Versions
<=5.5.5
CVE Reference
Patch Status
No patch
Source
NVD

RestroPress

medium
Vulnerability
RestroPress — Validate a client-supplied item add-on price on the server side when items are added to or updated i
Severity
medium Medium risk
Affected Versions
<=3.4.6
CVE Reference
Patch Status
No patch
Source
NVD

GiveWP

medium
Vulnerability
GiveWP — Remove shortcode delimiters from donor-supplied values before rendering them on public pages
Severity
medium Medium risk
Affected Versions
<=4.16.9
CVE Reference
Patch Status
No patch
Source
NVD

Payment Gateway for PayPal on WooCommerce

medium
Vulnerability
Payment Gateway for PayPal on WooCommerce — Verify that an incoming payment notification was confirmed in the store's configured payment environ
Severity
medium Medium risk
Affected Versions
<=9.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Contextual Related Posts

medium
Vulnerability
Contextual Related Posts — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.4.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Text Styler

medium
Vulnerability
Text Styler — Sanitise and escape user-supplied styling values before outputting them within a front-end style blo
Severity
medium Medium risk
Affected Versions
<=1.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Booking Calendar

medium
Vulnerability
Booking Calendar — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=11.8.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Image Buzz

medium
Vulnerability
Image Buzz — Unauthorized API key modification
Severity
medium Medium risk
Affected Versions
<=1.0.3
CVE Reference
Patch Status
No patch
Source
NVD

PixelPlay

medium
Vulnerability
PixelPlay — Unauthorized API key deletion
Severity
medium Medium risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Handily

medium
Vulnerability
Handily — Unauthorized payment settings modification
Severity
medium Medium risk
Affected Versions
<=1.0.3
CVE Reference
Patch Status
No patch
Source
NVD

BM Content Builder

medium
Vulnerability
BM Content Builder — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=3.17.1
CVE Reference
Patch Status
No patch
Source
NVD

Custom Field Template

medium
Vulnerability
Custom Field Template — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=2.7.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Live Composer – Free WordPress Website Builder

medium
Vulnerability
Live Composer – Free WordPress Website Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP User Manager

medium
Vulnerability
WP User Manager — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=2.9.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tutor LMS – eLearning and online course solution

medium
Vulnerability
Tutor LMS – eLearning and online course solution — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=4.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Hostel

medium
Vulnerability
Hostel — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.1.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

RW Elephant Rental Inventory

medium
Vulnerability
RW Elephant Rental Inventory — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=2.3.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ThumbPress

medium
Vulnerability
ThumbPress — Unauthorized access
Severity
medium Medium risk
Affected Versions
<=6.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

wpForo Forum

medium
Vulnerability
wpForo Forum — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.1.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP-CRM System – Manage Clients and Projects

medium
Vulnerability
WP-CRM System – Manage Clients and Projects — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=3.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels

medium
Vulnerability
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=6.6.43
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

jet-form-builder-stripe-gateway

medium
Vulnerability
jet-form-builder-stripe-gateway — Sanitise and escape a payment token before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=1.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Real3D Flipbook

medium
Vulnerability
Real3D Flipbook — Sanitize or escape several flipbook editor fields before rendering them back in the admin editor
Severity
medium Medium risk
Affected Versions
<=5.4
CVE Reference
Patch Status
No patch
Source
NVD

divi-dash

medium
Vulnerability
divi-dash — Validate the source of the client IP address it uses for rate limiting and banning
Severity
medium Medium risk
Affected Versions
<=1.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Newsletters

medium
Vulnerability
Newsletters — Perform an ownership check on some of its subscriber management actions
Severity
medium Medium risk
Affected Versions
<=4.18.1
CVE Reference
Patch Status
No patch
Source
NVD

zportals

medium
Vulnerability
zportals — Perform any capability or nonce check on several of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=6.4.2
CVE Reference
Patch Status
No patch
Source
NVD

zportals

medium
Vulnerability
zportals — Perform any capability or nonce check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=6.4.2
CVE Reference
Patch Status
No patch
Source
NVD

YAHMAN Add-ons

medium
Vulnerability
YAHMAN Add-ons — Validate the type of the remote files it caches in a publicly accessible directory
Severity
medium Medium risk
Affected Versions
<=0.9.31
CVE Reference
Patch Status
No patch
Source
NVD

Better Payment

medium
Vulnerability
Better Payment — Validate the submitted payment amount server-side against the merchant's configured fixed price befo
Severity
medium Medium risk
Affected Versions
<=2.3.4
CVE Reference
Patch Status
No patch
Source
NVD

Directorist: AI-Powered Business Directory, Listings & Classified Ads

medium
Vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads — Scope one of its REST collection endpoints to the requesting user
Severity
medium Medium risk
Affected Versions
<=8.9.5
CVE Reference
Patch Status
No patch
Source
NVD

Payment Plugins for PayPal WooCommerce

medium
Vulnerability
Payment Plugins for PayPal WooCommerce — Verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid
Severity
medium Medium risk
Affected Versions
<=2.0.27
CVE Reference
Patch Status
No patch
Source
NVD

MasterStudy LMS

medium
Vulnerability
MasterStudy LMS — Properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to
Severity
medium Medium risk
Affected Versions
<=3.7.50
CVE Reference
Patch Status
No patch
Source
NVD

MasterStudy LMS

medium
Vulnerability
MasterStudy LMS — Perform a per-object ownership check when returning a quiz attempt result
Severity
medium Medium risk
Affected Versions
<=3.7.50
CVE Reference
Patch Status
No patch
Source
NVD

WP OAuth Server ( Login with WordPress )

medium
Vulnerability
WP OAuth Server ( Login with WordPress ) — Bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged
Severity
medium Medium risk
Affected Versions
<=6.4.0
CVE Reference
Patch Status
No patch
Source
NVD

Email Subscribers & Newsletters

medium
Vulnerability
Email Subscribers & Newsletters — Verify the per-subscriber management token before changing a subscriber's subscription status
Severity
medium Medium risk
Affected Versions
<=5.9.35
CVE Reference
Patch Status
No patch
Source
NVD

Directorist: AI-Powered Business Directory, Listings & Classified Ads

medium
Vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads — Restrict access to a REST endpoint that returns user records
Severity
medium Medium risk
Affected Versions
<=8.9.5
CVE Reference
Patch Status
No patch
Source
NVD

Directorist: AI-Powered Business Directory, Listings & Classified Ads

medium
Vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads — Check user capabilities when creating orders through its REST API
Severity
medium Medium risk
Affected Versions
<=8.9.5
CVE Reference
Patch Status
No patch
Source
NVD

Directorist: AI-Powered Business Directory, Listings & Classified Ads

medium
Vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads — Validate a user-supplied URL before fetching it server-side
Severity
medium Medium risk
Affected Versions
<=8.9.5
CVE Reference
Patch Status
No patch
Source
NVD

Directorist: AI-Powered Business Directory, Listings & Classified Ads

medium
Vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads — Properly verify a listing's ownership before deleting it
Severity
medium Medium risk
Affected Versions
<=8.9.5
CVE Reference
Patch Status
No patch
Source
NVD

Directorist: AI-Powered Business Directory, Listings & Classified Ads

medium
Vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads — Verify that the target user of a REST route matches the authenticated caller before reading and modi
Severity
medium Medium risk
Affected Versions
<=8.9.5
CVE Reference
Patch Status
No patch
Source
NVD

Easy Hide Login

medium
Vulnerability
Easy Hide Login — Fully enforce its hidden-login protection
Severity
medium Medium risk
Affected Versions
<=1.7
CVE Reference
Patch Status
No patch
Source
NVD

Events Calendar

medium
Vulnerability
Events Calendar — Check the post status of linked records before embedding their stored details into a public REST API
Severity
medium Medium risk
Affected Versions
<=6.17.5
CVE Reference
Patch Status
No patch
Source
NVD

Events Calendar

medium
Vulnerability
Events Calendar — Check the capability required to publish content before creating or updating it through its REST API
Severity
medium Medium risk
Affected Versions
<=6.17.5
CVE Reference
Patch Status
No patch
Source
NVD

Events Calendar

medium
Vulnerability
Events Calendar — Perform a per-object capability check on one family of its REST write routes
Severity
medium Medium risk
Affected Versions
<=6.17.5
CVE Reference
Patch Status
No patch
Source
NVD

HappyAddons for Elementor

medium
Vulnerability
HappyAddons for Elementor — Escape an icon value on one of its button widgets before outputting it inside an HTML attribute
Severity
medium Medium risk
Affected Versions
<=3.50.0
CVE Reference
Patch Status
No patch
Source
NVD

WP Recipe Maker

medium
Vulnerability
WP Recipe Maker — Perform any capability check in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=10.8.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Recipe Maker

medium
Vulnerability
WP Recipe Maker — Have any authorisation check in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=10.8.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Recipe Maker

medium
Vulnerability
WP Recipe Maker — Have any authorisation check in one of its REST routes
Severity
medium Medium risk
Affected Versions
<=10.8.2
CVE Reference
Patch Status
No patch
Source
NVD

Post Grid Gutenberg Blocks

medium
Vulnerability
Post Grid Gutenberg Blocks — Perform an authorization or post-visibility check on a REST API route that returns the custom field
Severity
medium Medium risk
Affected Versions
<=5.0.41
CVE Reference
Patch Status
No patch
Source
NVD

Social Commerce for WooCommerce

medium
Vulnerability
Social Commerce for WooCommerce — Have authorisation checks on some of its REST API endpoints
Severity
medium Medium risk
Affected Versions
<=2.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Real3D Flipbook

medium
Vulnerability
Real3D Flipbook — Perform capability checks on several of its authenticated flipbook management actions
Severity
medium Medium risk
Affected Versions
<=5.4
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

medium
Vulnerability
Forminator Forms — Perform a nonce
Severity
medium Medium risk
Affected Versions
<=1.57.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms

medium
Vulnerability
Forminator Forms — Bind its saved-draft notification to the visitor who created the draft
Severity
medium Medium risk
Affected Versions
<=1.57.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Paymob for WooCommerce

medium
Vulnerability
Paymob for WooCommerce — Verify the request signature on the card-token branch of its payment webhook
Severity
medium Medium risk
Affected Versions
<=4.1.14
CVE Reference
Patch Status
No patch
Source
NVD

Paymob for WooCommerce

medium
Vulnerability
Paymob for WooCommerce — Perform a capability check on several admin AJAX actions that manage its payment-gateway configurati
Severity
medium Medium risk
Affected Versions
<=4.1.14
CVE Reference
Patch Status
No patch
Source
NVD

Product Badge, Label, Countdown Timer for WooCommerce

medium
Vulnerability
Product Badge, Label, Countdown Timer for WooCommerce — Check whether a product is published before returning its details to unauthenticated users
Severity
medium Medium risk
Affected Versions
<=7.5.2
CVE Reference
Patch Status
No patch
Source
NVD

JSM Show Post Metadata

medium
Vulnerability
JSM Show Post Metadata — Properly escape a post meta key before outputting it into an inline event-handler attribute in an ad
Severity
medium Medium risk
Affected Versions
<=4.9.1
CVE Reference
Patch Status
No patch
Source
NVD

FluentBoards

medium
Vulnerability
FluentBoards — Properly restrict the member data returned by its public
Severity
medium Medium risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD
medium
Vulnerability
Paid Membership Subscriptions — Bind one of its unauthenticated payment actions to the requesting user
Severity
medium Medium risk
Affected Versions
<=3.1.0
CVE Reference
Patch Status
No patch
Source
NVD

WPC Smart Compare for WooCommerce

medium
Vulnerability
WPC Smart Compare for WooCommerce — Apply WordPress's post-password protection when returning product content through its comparison han
Severity
medium Medium risk
Affected Versions
<=6.6.1
CVE Reference
Patch Status
No patch
Source
NVD

Booking Manager

medium
Vulnerability
Booking Manager — Sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL q
Severity
medium Medium risk
Affected Versions
<=2.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Booking Manager

medium
Vulnerability
Booking Manager — Verify that a request to modify a user's Booking Manager WordPress plugin before 2
Severity
medium Medium risk
Affected Versions
<=2.1.21
CVE Reference
Patch Status
No patch
Source
NVD

Subscribe Forms

medium
Vulnerability
Subscribe Forms — Sanitise and escape one of its form settings before outputting it in a page
Severity
medium Medium risk
Affected Versions
<=1.6.3
CVE Reference
Patch Status
No patch
Source
NVD

Event Booking Manager for WooCommerce

medium
Vulnerability
Event Booking Manager for WooCommerce — Restrict its event listing query to events the requesting user is permitted to read
Severity
medium Medium risk
Affected Versions
<=5.7.3
CVE Reference
Patch Status
No patch
Source
NVD

WC Fields Factory

medium
Vulnerability
WC Fields Factory — Properly restrict access to
Severity
medium Medium risk
Affected Versions
<=4.1.11
CVE Reference
Patch Status
No patch
Source
NVD

WC Fields Factory

medium
Vulnerability
WC Fields Factory — Properly restrict access to its field-management AJAX action
Severity
medium Medium risk
Affected Versions
<=4.1.11
CVE Reference
Patch Status
No patch
Source
NVD

Points and Rewards for WooCommerce

medium
Vulnerability
Points and Rewards for WooCommerce — Validate the claimed reward amount or restrict who can call its Win Wheel claim handler
Severity
medium Medium risk
Affected Versions
<=2.10.4
CVE Reference
Patch Status
No patch
Source
NVD

Premium Packages

medium
Vulnerability
Premium Packages — Verify PayPal's webhook signature before processing payment and subscription notifications
Severity
medium Medium risk
Affected Versions
<=7.2.1
CVE Reference
Patch Status
No patch
Source
NVD

NP Quote Request for WooCommerce

medium
Vulnerability
NP Quote Request for WooCommerce — Verify order ownership before rendering an order's details
Severity
medium Medium risk
Affected Versions
<=2.4.16
CVE Reference
Patch Status
No patch
Source
NVD

Getwid – Gutenberg Blocks

medium
Vulnerability
Getwid – Gutenberg Blocks — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Contact form 7 DB

medium
Vulnerability
Advanced Contact form 7 DB — Missing authorization
Severity
medium Medium risk
Affected Versions
<=2.0.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnPress

low
Vulnerability
LearnPress — Restrict the correctness flags it returns when a quiz answer is checked
Severity
low Low risk
Affected Versions
<=4.4.7
CVE Reference
Patch Status
No patch
Source
NVD

Comments Import & Export

low
Vulnerability
Comments Import & Export — Restrict its comment export to users able to moderate comments
Severity
low Low risk
Affected Versions
<=2.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Event Booking Manager for WooCommerce

low
Vulnerability
Event Booking Manager for WooCommerce — Perform an ownership or authorization check before rendering booking confirmation details
Severity
low Low risk
Affected Versions
<=5.3.8
CVE Reference
Patch Status
No patch
Source
NVD

Robokassa payment gateway for Woocommerce

low
Vulnerability
Robokassa payment gateway for Woocommerce — Verify the authenticity of incoming payment notifications when its non-default deferred-payment feat
Severity
low Low risk
Affected Versions
<=1.8.9
CVE Reference
Patch Status
No patch
Source
NVD

MasterStudy LMS

low
Vulnerability
MasterStudy LMS — Perform per-object ownership or capability checks when updating orders through its REST API
Severity
low Low risk
Affected Versions
<=3.7.50
CVE Reference
Patch Status
No patch
Source
NVD

King Addons for Elementor

low
Vulnerability
King Addons for Elementor — Perform any capability
Severity
low Low risk
Affected Versions
<=51.1.81
CVE Reference
Patch Status
No patch
Source
NVD

King Addons for Elementor

low
Vulnerability
King Addons for Elementor — Perform per-object authorization checks on a group of image-optimization actions
Severity
low Low risk
Affected Versions
<=51.1.81
CVE Reference
Patch Status
No patch
Source
NVD

MasterStudy LMS

low
Vulnerability
MasterStudy LMS — Verify that the requesting user owns the course before returning its enrolled-student data
Severity
low Low risk
Affected Versions
<=3.7.50
CVE Reference
Patch Status
No patch
Source
NVD

Bookit — Booking & Appointment Calendar

low
Vulnerability
Bookit — Booking & Appointment Calendar — Perform a capability check in one of its appointment-deletion functions
Severity
low Low risk
Affected Versions
<=2.6.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Bookit — Booking & Appointment Calendar

low
Vulnerability
Bookit — Booking & Appointment Calendar — Perform an authorization check on one of its appointment-retrieval actions
Severity
low Low risk
Affected Versions
<=2.6.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Business Name Generator

low
Vulnerability
Business Name Generator — Sanitise and escape some of its settings
Severity
low Low risk
Affected Versions
<=1.3
CVE Reference
Patch Status
No patch
Source
NVD

Secure Custom Fields

low
Vulnerability
Secure Custom Fields — Properly verify that a front-end form submission corresponds to the form that was rendered to the vi
Severity
low Low risk
Affected Versions
<=6.9.4
CVE Reference
Patch Status
No patch
Source
NVD

Hydra Booking — Appointment Scheduling & Booking Calendar

low
Vulnerability
Hydra Booking — Appointment Scheduling & Booking Calendar — Verify that a booking belongs to the requesting user before modifying or deleting it on two of its b
Severity
low Low risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD

Photo Gallery, Sliders, Proofing and

low
Vulnerability
Photo Gallery, Sliders, Proofing and — Verify that the user saving a gallery owns it
Severity
low Low risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Photo Gallery, Sliders, Proofing and

low
Vulnerability
Photo Gallery, Sliders, Proofing and — Verify that the requesting user is entitled to a given image record before returning it
Severity
low Low risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Photo Gallery, Sliders, Proofing and

low
Vulnerability
Photo Gallery, Sliders, Proofing and — Check that a user holds its options capability before saving image sizing settings
Severity
low Low risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Meow Gallery

low
Vulnerability
Meow Gallery — Perform a proper capability check or restrict results to the requesting user's own posts before retu
Severity
low Low risk
Affected Versions
<=5.5.5
CVE Reference
Patch Status
No patch
Source
NVD

TikTok

low
Vulnerability
TikTok — Check that a request is authorised before acting on a sign-in code supplied in the URL
Severity
low Low risk
Affected Versions
<=1.4.2
CVE Reference
Patch Status
No patch
Source
NVD

To Do List Member

low
Vulnerability
To Do List Member — Have authorisation or nonce checks in an import routine
Severity
low Low risk
Affected Versions
<=1.6
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (2)

The Divi

medium
Vulnerability
The Divi — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.11.1
CVE Reference
Patch Status
No patch
Source
NVD

VW Writer Blog

medium
Vulnerability
VW Writer Blog — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=1.3.8
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: September 17 – September 24, 2026

292 WordPress vulnerabilities disclosed between September 17 – September 24, 2026. 11 critical, 64 high severity. 0 patched, 292 unpatched.

WPSentry·Sep 24, 2026
Vulnerability Report

WordPress Vulnerability Report: September 15 – September 22, 2026

284 WordPress vulnerabilities disclosed between September 15 – September 22, 2026. 15 critical, 73 high severity. 0 patched, 284 unpatched.

WPSentry·Sep 22, 2026
Vulnerability Report

WordPress Vulnerability Report: September 14 – September 21, 2026

281 WordPress vulnerabilities disclosed between September 14 – September 21, 2026. 12 critical, 70 high severity. 0 patched, 281 unpatched.

WPSentry·Sep 21, 2026
Back to Blog