BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: September 2 – September 9, 2026

202 WordPress vulnerabilities disclosed between September 2 – September 9, 2026. 13 critical, 39 high severity. 0 patched, 202 unpatched.

WPSentrySeptember 9, 202643 min read

During the reporting period (September 2 – September 9, 2026), 202 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

202
Total
13
Critical
39
High
137
Medium
13
Low
0
Patched
Table of Contents 207 plugins & components

WordPress Plugin Vulnerabilities (196)

Developer Tools

critical
Vulnerability
Developer Tools — CVE-2025-9314
Severity
critical Critical risk
Affected Versions
<=1.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Embed HTML5 Game

critical
Vulnerability
Embed HTML5 Game — Properly restrict who can upload files via the plugin
Severity
critical Critical risk
Affected Versions
<=1.3
CVE Reference
Patch Status
No patch
Source
NVD

WatchMan-Site7

critical
Vulnerability
WatchMan-Site7 — Restrict access to its debugging console
Severity
critical Critical risk
Affected Versions
<=4.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Divi Ajax Filter

critical
Vulnerability
Divi Ajax Filter — Local File Inclusion
Severity
critical Critical risk
Affected Versions
<=5.1.2
CVE Reference
Patch Status
No patch
Source
NVD

ACPT (Premium)

critical
Vulnerability
ACPT (Premium) — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=2.0.66
CVE Reference
Patch Status
No patch
Source
NVD

AI Website Builder

critical
Vulnerability
AI Website Builder — Perform any authorisation or nonce check on its REST API routes
Severity
critical Critical risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Mstore Api

critical
Vulnerability
Mstore Api — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=4.20.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN

critical
Vulnerability
Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN — Remote Code Execution
Severity
critical Critical risk
Affected Versions
<=3.21.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SEO Flow by LupsOnline

critical
Vulnerability
SEO Flow by LupsOnline — Correctly validate the credential supplied with its API requests
Severity
critical Critical risk
Affected Versions
<=3.0.3
CVE Reference
Patch Status
No patch
Source
NVD

Post Grid and Gutenberg Blocks – ComboBlocks

critical
Vulnerability
Post Grid and Gutenberg Blocks – ComboBlocks — Unauthenticated Hook Injection
Severity
critical Critical risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails

critical
Vulnerability
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails — PHP Object Injection
Severity
critical Critical risk
Affected Versions
<=1.31.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MemberDash

critical
Vulnerability
MemberDash — Insecure Direct Object Reference
Severity
critical Critical risk
Affected Versions
<=1.8.5
CVE Reference
Patch Status
No patch
Source
NVD

Frontend Admin by DynamiApps

critical
Vulnerability
Frontend Admin by DynamiApps — Authentication Bypass to Account Takeover
Severity
critical Critical risk
Affected Versions
<=3.29.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Broken Link Checker

high
Vulnerability
Broken Link Checker — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.4.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Auto x LINE

high
Vulnerability
Auto x LINE — Have authorization checks in some of its REST endpoints
Severity
high High risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Classified Listing

high
Vulnerability
Classified Listing — Verify that the caller owns or can edit the target listing before its AI image-editing AJAX action d
Severity
high High risk
Affected Versions
<=6.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Hummingbird Performance

high
Vulnerability
Hummingbird Performance — Restrict a network-wide setting to network administrators
Severity
high High risk
Affected Versions
<=3.21.2
CVE Reference
Patch Status
No patch
Source
NVD

LearnDash LMS

high
Vulnerability
LearnDash LMS — Unrestricted File Type Upload
Severity
high High risk
Affected Versions
<=5.1.5
CVE Reference
Patch Status
No patch
Source
NVD

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more

high
Vulnerability
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.13.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more

high
Vulnerability
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.13.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

QuickCal

high
Vulnerability
QuickCal — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.0.20
CVE Reference
Patch Status
No patch
Source
NVD

Gravity Forms

high
Vulnerability
Gravity Forms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.5
CVE Reference
Patch Status
No patch
Source
NVD

SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

high
Vulnerability
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.12.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms – The Contact Form Builder That Grows With You

high
Vulnerability
Ninja Forms – The Contact Form Builder That Grows With You — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.15.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

JetFormBuilder — Dynamic Blocks Form Builder

high
Vulnerability
JetFormBuilder — Dynamic Blocks Form Builder — Perform authorisation checks when resolving request-derived data during page rendering
Severity
high High risk
Affected Versions
<=3.6.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Welcart e-Commerce

high
Vulnerability
Welcart e-Commerce — PHP Object Injection
Severity
high High risk
Affected Versions
<=2.12.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

RegistrationMagic

high
Vulnerability
RegistrationMagic — Verify which application a Facebook access token was issued to before accepting it as proof of ident
Severity
high High risk
Affected Versions
<=6.0.9.9
CVE Reference
Patch Status
No patch
Source
NVD

Spam protection, Honeypot, Anti-Spam by CleanTalk

high
Vulnerability
Spam protection, Honeypot, Anti-Spam by CleanTalk — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.86
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

W3 Total Cache

high
Vulnerability
W3 Total Cache — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

IPGP Visitors Origin

high
Vulnerability
IPGP Visitors Origin — Sanitise or escape user input before reflecting it back in the HTTP response
Severity
high High risk
Affected Versions
<=1.6
CVE Reference
Patch Status
No patch
Source
NVD

Music Store

high
Vulnerability
Music Store — Sanitise and escape user input before using it in a SQL statement
Severity
high High risk
Affected Versions
<=1.4.5
CVE Reference
Patch Status
No patch
Source
NVD

JCH Optimize

high
Vulnerability
JCH Optimize — Perform a capability check on one of its authenticated AJAX actions and lets the request choose whic
Severity
high High risk
Affected Versions
<=6.0.1
CVE Reference
Patch Status
No patch
Source
NVD

HT Menu

high
Vulnerability
HT Menu — Perform any capability or object-ownership check when saving navigation menu-item settings
Severity
high High risk
Affected Versions
<=1.2.7
CVE Reference
Patch Status
No patch
Source
NVD

Abandoned Cart Pro for WooCommerce

high
Vulnerability
Abandoned Cart Pro for WooCommerce — Privilege Escalation
Severity
high High risk
Affected Versions
<=10.7.1
CVE Reference
Patch Status
No patch
Source
NVD

Contact Form by Supsystic

high
Vulnerability
Contact Form by Supsystic — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.10.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

HivePress Authentication

high
Vulnerability
HivePress Authentication — Authentication Bypass
Severity
high High risk
Affected Versions
<=1.1.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SureCart

high
Vulnerability
SureCart — Ensure that the account affected by a customer update is the same account its permission check autho
Severity
high High risk
Affected Versions
<=4.6.3
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

high
Vulnerability
Kirki — Hold back every spelling of the HTML entities it decodes when rendering
Severity
high High risk
Affected Versions
<=6.3.0
CVE Reference
Patch Status
No patch
Source
NVD

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

high
Vulnerability
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.15.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Fusion (Pro)

high
Vulnerability
WP Fusion (Pro) — Privilege Escalation
Severity
high High risk
Affected Versions
<=3.47.13
CVE Reference
Patch Status
No patch
Source
NVD

EDD Product Catalog Feed by PixelYourSite

high
Vulnerability
EDD Product Catalog Feed by PixelYourSite — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Live Composer – Free WordPress Website Builder

high
Vulnerability
Live Composer – Free WordPress Website Builder — PHP Object Injection
Severity
high High risk
Affected Versions
<=2.1.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Event Tickets and Registration

high
Vulnerability
Event Tickets and Registration — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=5.27.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Contact Form to DB by BestWebSoft – Messages Database

high
Vulnerability
Contact Form to DB by BestWebSoft – Messages Database — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.7.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

high
Vulnerability
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) — Local File Inclusion
Severity
high High risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

high
Vulnerability
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) — Local File Inclusion
Severity
high High risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment

high
Vulnerability
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment — Remote Code Execution
Severity
high High risk
Affected Versions
<=3.1.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP EasyCart

high
Vulnerability
WP EasyCart — Privilege escalation
Severity
high High risk
Affected Versions
<=5.9.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Repeater Fields for Gravity Forms

high
Vulnerability
Repeater Fields for Gravity Forms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Next-Cart Store to WooCommerce Migration

high
Vulnerability
Next-Cart Store to WooCommerce Migration — Authentication Bypass
Severity
high High risk
Affected Versions
<=3.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

high
Vulnerability
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=8.7.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Waveform Player

medium
Vulnerability
Easy Waveform Player — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LiveJournal Shortcode

medium
Vulnerability
LiveJournal Shortcode — Validate and escape some of its shortcode attributes before outputting them back in a page/post wher
Severity
medium Medium risk
Affected Versions
<=1.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Rejected reason: This CVE ID is a duplicate of CVE-2025-13542 and was never published. Both IDs were assigned to the same unauthenticated privilege escalation vulnerability in the DesignThemes LMS

medium
Vulnerability
Rejected reason: This CVE ID is a duplicate of CVE-2025-13542 and was never published. Both IDs were assigned to the same unauthenticated privilege escalation vulnerability in the DesignThemes LMS — CVE-2025-13398
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Notification Bar for

medium
Vulnerability
Notification Bar for — CVE-2025-15481
Severity
medium Medium risk
Affected Versions
<=1.1.8
CVE Reference
Patch Status
No patch
Source
NVD

Passster

medium
Vulnerability
Passster — Handle input properly in an AJAX action
Severity
medium Medium risk
Affected Versions
<=4.2.24
CVE Reference
Patch Status
No patch
Source
NVD

Passster

medium
Vulnerability
Passster — CVE-2025-15490
Severity
medium Medium risk
Affected Versions
<=4.2.26
CVE Reference
Patch Status
No patch
Source
NVD

Wp Edit Password Protected

medium
Vulnerability
Wp Edit Password Protected — Protecting page content, but this protection can be bypassed by using the REST API
Severity
medium Medium risk
Affected Versions
<=1.3.5
CVE Reference
Patch Status
No patch
Source
NVD

Yoast SEO Premium

medium
Vulnerability
Yoast SEO Premium — Sanitize control characters from redirect origins before writing them to the site's Apache configura
Severity
medium Medium risk
Affected Versions
<=27.6.1
CVE Reference
Patch Status
No patch
Source
NVD

User Frontend

medium
Vulnerability
User Frontend — Enforce its subscription-purchase requirement when processing frontend post submissions
Severity
medium Medium risk
Affected Versions
<=4.3.11
CVE Reference
Patch Status
No patch
Source
NVD

HIPAA FORMS

medium
Vulnerability
HIPAA FORMS — Unauthenticated attackers to access protected AJAX endpoints
Severity
medium Medium risk
Affected Versions
<=3.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Ajaxify Comments

medium
Vulnerability
Ajaxify Comments — HTTP Header Injection
Severity
medium Medium risk
Affected Versions
<=3.2
CVE Reference
Patch Status
No patch
Source
NVD

RegistrationMagic

medium
Vulnerability
RegistrationMagic — Validate the total price of a paid registration server-side
Severity
medium Medium risk
Affected Versions
<=6.0.9.9
CVE Reference
Patch Status
No patch
Source
NVD

RegistrationMagic

medium
Vulnerability
RegistrationMagic — Validate a client-supplied quantity multiplier when calculating the total price of a paid registrati
Severity
medium Medium risk
Affected Versions
<=6.0.9.9
CVE Reference
Patch Status
No patch
Source
NVD

Restrict User Access

medium
Vulnerability
Restrict User Access — Normalise the REST API route before checking it against the routes its content protection covers
Severity
medium Medium risk
Affected Versions
<=2.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Brave

medium
Vulnerability
Brave — Prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode eng
Severity
medium Medium risk
Affected Versions
<=0.8.8
CVE Reference
Patch Status
No patch
Source
NVD

All in One SEO

medium
Vulnerability
All in One SEO — Sanitise and escape some content stored in posts before rendering it back in the post editor
Severity
medium Medium risk
Affected Versions
<=5.0.0.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Express Checkout

medium
Vulnerability
WP Express Checkout — Verify server-side that a payment was actually completed before marking an order as paid
Severity
medium Medium risk
Affected Versions
<=2.4.9
CVE Reference
Patch Status
No patch
Source
NVD

Xpro Addons

medium
Vulnerability
Xpro Addons — Properly escape some of its widgets' settings before outputting them within HTML attributes
Severity
medium Medium risk
Affected Versions
<=1.7.4
CVE Reference
Patch Status
No patch
Source
NVD

Simple Membership MailChimp Integration

medium
Vulnerability
Simple Membership MailChimp Integration — Have CSRF checks in its settings page
Severity
medium Medium risk
Affected Versions
<=1.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor

medium
Vulnerability
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD

MountDev AI MCP Connector

medium
Vulnerability
MountDev AI MCP Connector — CVE-2026-85306
Severity
medium Medium risk
Affected Versions
<=1.6.5
CVE Reference
Patch Status
No patch
Source
NVD

LearnPress

medium
Vulnerability
LearnPress — Authenticated attackers with the Instructor role to add answers to quiz questions owned by other ins
Severity
medium Medium risk
Affected Versions
<=4.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnPress

medium
Vulnerability
LearnPress — Authenticated attackers with the Instructor role to inject persistent malicious payloads by submitti
Severity
medium Medium risk
Affected Versions
<=4.4.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPFunnels

medium
Vulnerability
WPFunnels — Check whether user registration is enabled on the site before creating accounts from opt-in form sub
Severity
medium Medium risk
Affected Versions
<=3.13.0
CVE Reference
Patch Status
No patch
Source
NVD

Content Views

medium
Vulnerability
Content Views — Check whether the user requesting a view is allowed to read the posts it returns
Severity
medium Medium risk
Affected Versions
<=4.5.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Pods

medium
Vulnerability
Pods — Restrict which functions a display callback may resolve to
Severity
medium Medium risk
Affected Versions
<=3.3.9.2
CVE Reference
Patch Status
No patch
Source
NVD

WPFunnels

medium
Vulnerability
WPFunnels — Verify that the product requested through a checkout order bump is the product that bump's discount
Severity
medium Medium risk
Affected Versions
<=3.13.0
CVE Reference
Patch Status
No patch
Source
NVD

WPFunnels

medium
Vulnerability
WPFunnels — Restrict access to the log files it writes to a predictable location under the public uploads direct
Severity
medium Medium risk
Affected Versions
<=3.13.0
CVE Reference
Patch Status
No patch
Source
NVD

WPFunnels

medium
Vulnerability
WPFunnels — Perform any authorisation or nonce check in one of its opt-in submission handlers
Severity
medium Medium risk
Affected Versions
<=3.13.0
CVE Reference
Patch Status
No patch
Source
NVD

Ninja Forms

medium
Vulnerability
Ninja Forms — Restrict its REST abilities to administrators
Severity
medium Medium risk
Affected Versions
<=3.15.2
CVE Reference
Patch Status
No patch
Source
NVD

Frontend Admin by DynamiApps

medium
Vulnerability
Frontend Admin by DynamiApps — Properly validate a user-controllable directory path before deleting files within it
Severity
medium Medium risk
Affected Versions
<=3.29.13
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

medium
Vulnerability
WPLP Cookie Consent — Properly validate a pagination parameter before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD

WPvivid — Backup, Migration & Staging

medium
Vulnerability
WPvivid — Backup, Migration & Staging — Validate a user supplied file name before using it to build a write path
Severity
medium Medium risk
Affected Versions
<=0.9.134
CVE Reference
Patch Status
No patch
Source
NVD

WPvivid — Backup, Migration & Staging

medium
Vulnerability
WPvivid — Backup, Migration & Staging — Validate a user supplied path before using it in a file deletion routine
Severity
medium Medium risk
Affected Versions
<=0.9.134
CVE Reference
Patch Status
No patch
Source
NVD

Xpro Addons — 140+ Widgets for Elementor

medium
Vulnerability
Xpro Addons — 140+ Widgets for Elementor — Perform any capability or post-status check before rendering a WooCommerce product summary from a su
Severity
medium Medium risk
Affected Versions
<=1.7.8
CVE Reference
Patch Status
No patch
Source
NVD

ePayco Payment Gateway for WooCommerce

medium
Vulnerability
ePayco Payment Gateway for WooCommerce — Properly verify the authenticity of payment confirmation requests
Severity
medium Medium risk
Affected Versions
<=8.4.7
CVE Reference
Patch Status
No patch
Source
NVD

Restaurant Menu and Food Ordering

medium
Vulnerability
Restaurant Menu and Food Ordering — Verify that a PayPal payment notification genuinely originates from PayPal
Severity
medium Medium risk
Affected Versions
<=2.4.12
CVE Reference
Patch Status
No patch
Source
NVD

E-cab Taxi Booking Manager for Woocommerce

medium
Vulnerability
E-cab Taxi Booking Manager for Woocommerce — Validate a client-supplied trip distance and base-price value on the server before pricing a booking
Severity
medium Medium risk
Affected Versions
<=2.0.5
CVE Reference
Patch Status
No patch
Source
NVD

Events Manager - Calendar, Bookings, Tickets, and more!

medium
Vulnerability
Events Manager - Calendar, Bookings, Tickets, and more! — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.3.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Social Chat – Click To Chat App Button

medium
Vulnerability
Social Chat – Click To Chat App Button — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=8.6.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Theme My Login

medium
Vulnerability
Theme My Login — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=7.1.15
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer

medium
Vulnerability
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.4.30
CVE Reference
Patch Status
No patch
Source
NVD

Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer

medium
Vulnerability
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.4.30
CVE Reference
Patch Status
No patch
Source
NVD

WP File Download

medium
Vulnerability
WP File Download — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=6.3.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Search Atlas SEO

medium
Vulnerability
Search Atlas SEO — Perform a nonce or capability check before processing a settings update in one of its early-priority
Severity
medium Medium risk
Affected Versions
<=2.6.24
CVE Reference
Patch Status
No patch
Source
NVD

Beaver Builder Plugin (Starter Version)

medium
Vulnerability
Beaver Builder Plugin (Starter Version) — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.11.0.1
CVE Reference
Patch Status
No patch
Source
NVD

JetFormBuilder — Dynamic Blocks Form Builder

medium
Vulnerability
JetFormBuilder — Dynamic Blocks Form Builder — Properly sanitise and escape a form field's value before including it in the HTML notification email
Severity
medium Medium risk
Affected Versions
<=3.6.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Smart Post

medium
Vulnerability
Smart Post — Check whether a post is password protected before returning its content and its stored password thro
Severity
medium Medium risk
Affected Versions
<=4.0.8
CVE Reference
Patch Status
No patch
Source
NVD

Accept Stripe Payments

medium
Vulnerability
Accept Stripe Payments — Validate a user-supplied URL before using it in a redirect
Severity
medium Medium risk
Affected Versions
<=2.1.4
CVE Reference
Patch Status
No patch
Source
NVD

Accept Stripe Payments

medium
Vulnerability
Accept Stripe Payments — Verify that the product fulfilled when a checkout is completed matches the product the authoritative
Severity
medium Medium risk
Affected Versions
<=2.1.4
CVE Reference
Patch Status
No patch
Source
NVD

Masteriyo LMS

medium
Vulnerability
Masteriyo LMS — Sanitise and escape some course settings before outputting them in a page available to all visitors
Severity
medium Medium risk
Affected Versions
<=3.4.0
CVE Reference
Patch Status
No patch
Source
NVD

Greenshift

medium
Vulnerability
Greenshift — Validate a user-supplied URL before fetching it server-side
Severity
medium Medium risk
Affected Versions
<=13.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Greenshift

medium
Vulnerability
Greenshift — Properly escape a block animation attribute before outputting it within an HTML attribute
Severity
medium Medium risk
Affected Versions
<=13.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Properly validate a link URL before outputting it in an HTML attribute
Severity
medium Medium risk
Affected Versions
<=5.9.8
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Sanitise and escape several shortcode attributes before outputting them in HTML attributes
Severity
medium Medium risk
Affected Versions
<=5.9.8
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Escape a user-supplied identifier before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=6.3.0
CVE Reference
Patch Status
No patch
Source
NVD

King Addons for Elementor

medium
Vulnerability
King Addons for Elementor — Escape a widget display-style setting before outputting it in an HTML attribute
Severity
medium Medium risk
Affected Versions
<=51.1.77
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Properly validate a template path value before using it to include a local file
Severity
medium Medium risk
Affected Versions
<=4.1.21
CVE Reference
Patch Status
No patch
Source
NVD

VikWidgetsLoader

medium
Vulnerability
VikWidgetsLoader — Sanitise or escape a block attribute before outputting it inside an inline script
Severity
medium Medium risk
Affected Versions
<=1.12.0
CVE Reference
Patch Status
No patch
Source
NVD

Eventin

medium
Vulnerability
Eventin — Properly check authorization on several of its event-management REST routes
Severity
medium Medium risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD

CatFolders Document Gallery & PDF Library

medium
Vulnerability
CatFolders Document Gallery & PDF Library — Properly validate a block attribute before using it as an HTML tag name in its gallery output
Severity
medium Medium risk
Affected Versions
<=2.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Joli Table Of Contents

medium
Vulnerability
Joli Table Of Contents — Sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribu
Severity
medium Medium risk
Affected Versions
<=3.0.3
CVE Reference
Patch Status
No patch
Source
NVD

EmbedPress

medium
Vulnerability
EmbedPress — Have proper authorization on a public review-loading action
Severity
medium Medium risk
Affected Versions
<=4.6.4
CVE Reference
Patch Status
No patch
Source
NVD

Video Player for YouTube

medium
Vulnerability
Video Player for YouTube — Properly sanitise and escape user-supplied input before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD

Custom Contact Forms

medium
Vulnerability
Custom Contact Forms — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=7.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Unlimited Elements For Elementor

medium
Vulnerability
Unlimited Elements For Elementor — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.0.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gallery : FooGallery

medium
Vulnerability
Gallery : FooGallery — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Pods – Custom Content Types and Fields

medium
Vulnerability
Pods – Custom Content Types and Fields — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnDash LMS

medium
Vulnerability
LearnDash LMS — Authorization bypass
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Ninja Forms - Save Progress

medium
Vulnerability
Ninja Forms - Save Progress — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=3.0.30
CVE Reference
Patch Status
No patch
Source
NVD

SureCart

medium
Vulnerability
SureCart — Consult the site's user registration setting before creating WordPress accounts
Severity
medium Medium risk
Affected Versions
<=4.7.0
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Sanitise and escape a shortcode attribute before outputting it in an HTML attribute
Severity
medium Medium risk
Affected Versions
<=5.9.9
CVE Reference
Patch Status
No patch
Source
NVD

B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More

medium
Vulnerability
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More — Verify that a role selected during registration is one actually offered on the registration form
Severity
medium Medium risk
Affected Versions
<=5.2.40
CVE Reference
Patch Status
No patch
Source
NVD

JetFormBuilder

medium
Vulnerability
JetFormBuilder — Sanitize a request parameter before rendering it as message content
Severity
medium Medium risk
Affected Versions
<=3.6.5.2
CVE Reference
Patch Status
No patch
Source
NVD

JetFormBuilder

medium
Vulnerability
JetFormBuilder — Validate or strip line breaks from address values it sources from submitted form fields before addin
Severity
medium Medium risk
Affected Versions
<=3.6.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Ninja Forms

medium
Vulnerability
Ninja Forms — Prevent shortcodes in request-derived values from being executed when it substitutes them into conte
Severity
medium Medium risk
Affected Versions
<=3.15.2
CVE Reference
Patch Status
No patch
Source
NVD

Redirection for Contact Form 7

medium
Vulnerability
Redirection for Contact Form 7 — Prevent shortcodes in submitted form values from being executed when it substitutes those values int
Severity
medium Medium risk
Affected Versions
<=3.2.11
CVE Reference
Patch Status
No patch
Source
NVD

Powerkit

medium
Vulnerability
Powerkit — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Flamingo

medium
Vulnerability
Flamingo — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.6.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

medium
Vulnerability
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Masteriyo LMS

medium
Vulnerability
Masteriyo LMS — Unauthorized data deletion
Severity
medium Medium risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter

medium
Vulnerability
The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.9.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

medium
Vulnerability
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.3.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPML Multilingual CMS

medium
Vulnerability
WPML Multilingual CMS — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.9.5
CVE Reference
Patch Status
No patch
Source
NVD

The Beaver Builder Page Builder – Drag and Drop Website Builder

medium
Vulnerability
The Beaver Builder Page Builder – Drag and Drop Website Builder — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=2.10.3.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Online Scheduling and Appointment Booking System – Bookly

medium
Vulnerability
Online Scheduling and Appointment Booking System – Bookly — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=27.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Zephyr Project Manager

medium
Vulnerability
Zephyr Project Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.205
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Event Solution (Eventin)

medium
Vulnerability
WP Event Solution (Eventin) — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Graphina – Charts and Graphs For Elementor

medium
Vulnerability
Graphina – Charts and Graphs For Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms – The Contact Form Builder That Grows With You

medium
Vulnerability
Ninja Forms – The Contact Form Builder That Grows With You — PHP Object Injection
Severity
medium Medium risk
Affected Versions
<=3.14.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Access Manager

medium
Vulnerability
User Access Manager — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails

medium
Vulnerability
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails — SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.31.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Crowdfunding

medium
Vulnerability
WP Crowdfunding — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Podlove Podcast Publisher

medium
Vulnerability
Podlove Podcast Publisher — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

My Calendar – Accessible Event Manager

medium
Vulnerability
My Calendar – Accessible Event Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

My Calendar – Accessible Event Manager

medium
Vulnerability
My Calendar – Accessible Event Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Product Filter for WooCommerce by WBW

medium
Vulnerability
Product Filter for WooCommerce by WBW — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.4.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

medium
Vulnerability
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.1.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Crowdfunding

medium
Vulnerability
WP Crowdfunding — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Content Mask

medium
Vulnerability
Content Mask — Properly sanitise and escape content submitted with a post before outputting it in the pages it gene
Severity
medium Medium risk
Affected Versions
<=1.8.5.6
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

medium
Vulnerability
WP Travel — Properly verify that the requester is authorized to modify the targeted booking on one branch of its
Severity
medium Medium risk
Affected Versions
<=12.0.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

medium
Vulnerability
WP Travel — Properly verify that the requester owns the booking targeted by its bank-deposit slip submission
Severity
medium Medium risk
Affected Versions
<=12.0.2
CVE Reference
Patch Status
No patch
Source
NVD

ELEX WooCommerce Request a Quote

medium
Vulnerability
ELEX WooCommerce Request a Quote — Properly sanitise and escape a parameter before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=2.4.1
CVE Reference
Patch Status
No patch
Source
NVD

Loops & Logic

medium
Vulnerability
Loops & Logic — Restrict its public template-data action to the data a visitor is permitted to see
Severity
medium Medium risk
Affected Versions
<=4.3.0
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

medium
Vulnerability
WP Travel — Verify that the requester is authorized to act on the booking targeted by one of its front-end payme
Severity
medium Medium risk
Affected Versions
<=12.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Awesome Support

medium
Vulnerability
Awesome Support — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=6.3.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultimate Gift Cards for WooCommerce

medium
Vulnerability
Ultimate Gift Cards for WooCommerce — Verify that the user redeeming a gift card is its intended recipient
Severity
medium Medium risk
Affected Versions
<=3.2.10
CVE Reference
Patch Status
No patch
Source
NVD

WP Recipe Maker

medium
Vulnerability
WP Recipe Maker — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=10.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Payment Plugins for Stripe WooCommerce

medium
Vulnerability
Payment Plugins for Stripe WooCommerce — Validate the order key before adding order data to the JavaScript configuration it outputs on the fr
Severity
medium Medium risk
Affected Versions
<=4.0.12
CVE Reference
Patch Status
No patch
Source
NVD

Payment Plugins for PayPal WooCommerce

medium
Vulnerability
Payment Plugins for PayPal WooCommerce — Validate the order key before adding order data to the JavaScript configuration it outputs on the fr
Severity
medium Medium risk
Affected Versions
<=2.0.26
CVE Reference
Patch Status
No patch
Source
NVD

Payment Plugins for PayPal WooCommerce

medium
Vulnerability
Payment Plugins for PayPal WooCommerce — Verify that a stored payment method belongs to the user attaching it
Severity
medium Medium risk
Affected Versions
<=2.0.26
CVE Reference
Patch Status
No patch
Source
NVD

SupportCandy

medium
Vulnerability
SupportCandy — Perform an authorization check on one of its support-ticket attachment download paths
Severity
medium Medium risk
Affected Versions
<=3.5.3
CVE Reference
Patch Status
No patch
Source
NVD

SupportCandy

medium
Vulnerability
SupportCandy — Validate a submitted per-ticket authorization code before disclosing the real code to the requester
Severity
medium Medium risk
Affected Versions
<=3.5.3
CVE Reference
Patch Status
No patch
Source
NVD

Groundhogg — CRM, Newsletters, and Marketing Automation

medium
Vulnerability
Groundhogg — CRM, Newsletters, and Marketing Automation — Restrict the redirect target of its email preference confirmation flow to the site's own host
Severity
medium Medium risk
Affected Versions
<=4.7.2
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

medium
Vulnerability
WPLP Cookie Consent — Have any authorisation or CSRF checks when storing visitor consent state
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

medium
Vulnerability
WPLP Cookie Consent — Have capability or nonce checks on some of its A/B testing actions
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD

Masteriyo LMS

medium
Vulnerability
Masteriyo LMS — Perform any authorization check before returning a course enrolment record over its REST API
Severity
medium Medium risk
Affected Versions
<=3.4.0
CVE Reference
Patch Status
No patch
Source
NVD

Sina Extension for Elementor

medium
Vulnerability
Sina Extension for Elementor — Properly escape a Table widget setting before outputting it within an HTML attribute
Severity
medium Medium risk
Affected Versions
<=3.10.4
CVE Reference
Patch Status
No patch
Source
NVD

Quentn WP

medium
Vulnerability
Quentn WP — Adequately escape a request parameter before using it in an unprepared SQL query
Severity
medium Medium risk
Affected Versions
<=1.2.15
CVE Reference
Patch Status
No patch
Source
NVD

Quentn WP

medium
Vulnerability
Quentn WP — Properly sanitise and escape a parameter before using it in an SQL query
Severity
medium Medium risk
Affected Versions
<=1.2.15
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Check whether the requester is allowed to read a post before rendering and returning its page conten
Severity
medium Medium risk
Affected Versions
<=6.3.0
CVE Reference
Patch Status
No patch
Source
NVD

WPFunnels

medium
Vulnerability
WPFunnels — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=3.12.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Sunshine Photo Cart

medium
Vulnerability
Sunshine Photo Cart — Validate that a client-supplied price identifier belongs to the item being purchased when it is adde
Severity
medium Medium risk
Affected Versions
<=3.7
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

medium
Vulnerability
WPLP Cookie Consent — Perform nonce or capability checks on one of its cookie scanner AJAX actions
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

medium
Vulnerability
WPLP Cookie Consent — Perform nonce or capability checks on several of its settings AJAX actions
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

medium
Vulnerability
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More — Validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into t
Severity
medium Medium risk
Affected Versions
<=3.0.9
CVE Reference
Patch Status
No patch
Source
NVD

Reviso Exporter for WooCommerce

medium
Vulnerability
Reviso Exporter for WooCommerce — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=1.2.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Checkout Custom Fields Builder for WooCommerce

medium
Vulnerability
Checkout Custom Fields Builder for WooCommerce — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.1.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CleanTalk

medium
Vulnerability
CleanTalk — Prevent unauthenticated
Severity
medium Medium risk
Affected Versions
<=6.87
CVE Reference
Patch Status
No patch
Source
NVD

Hustle

medium
Vulnerability
Hustle — Prevent shortcodes in submitted form values from being executed when it substitutes those values int
Severity
medium Medium risk
Affected Versions
<=7.8.14.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Express Checkout

medium
Vulnerability
WP Express Checkout — Verify server-side that a payment was actually completed before marking an order as paid
Severity
medium Medium risk
Affected Versions
<=2.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Contact Form 7 Captcha

medium
Vulnerability
Contact Form 7 Captcha — CVE-2026-85117
Severity
medium Medium risk
Affected Versions
<=0.1.9
CVE Reference
Patch Status
No patch
Source
NVD

Weaver Show Posts

low
Vulnerability
Weaver Show Posts — CVE-2023-3360
Severity
low Low risk
Affected Versions
<=1.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Icegram Express

low
Vulnerability
Icegram Express — Properly escape a list description setting before outputting it within an HTML attribute
Severity
low Low risk
Affected Versions
<=5.8.6
CVE Reference
Patch Status
No patch
Source
NVD

Timetics

low
Vulnerability
Timetics — Enforce per-object ownership when updating appointments through its REST API
Severity
low Low risk
Affected Versions
<=1.0.61
CVE Reference
Patch Status
No patch
Source
NVD

GutenKit

low
Vulnerability
GutenKit — Validate or escape style settings saved against a post before using them to build the CSS it outputs
Severity
low Low risk
Affected Versions
<=2.5.1
CVE Reference
Patch Status
No patch
Source
NVD

Directorist: AI-Powered Business Directory, Listings & Classified Ads

low
Vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads — Verify that the requesting user owns the post being modified before writing uploaded file references
Severity
low Low risk
Affected Versions
<=8.9
CVE Reference
Patch Status
No patch
Source
NVD

JCH Optimize

low
Vulnerability
JCH Optimize — Properly restrict a directory path provided to one of its administrative image-browsing features to
Severity
low Low risk
Affected Versions
<=5.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Joli Table Of Contents

low
Vulnerability
Joli Table Of Contents — Sanitise and escape some of its settings before outputting them in an admin page
Severity
low Low risk
Affected Versions
<=2.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Smart Post

low
Vulnerability
Smart Post — Check the type
Severity
low Low risk
Affected Versions
<=4.0.8
CVE Reference
Patch Status
No patch
Source
NVD

My Private Site

low
Vulnerability
My Private Site — Apply its site-privacy access control to certain unauthenticated front-end read surfaces
Severity
low Low risk
Affected Versions
<=4.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

low
Vulnerability
Kirki — Check that a user is allowed to act on a collaboration comment before changing its state
Severity
low Low risk
Affected Versions
<=6.3.0
CVE Reference
Patch Status
No patch
Source
NVD

Events Calendar

low
Vulnerability
Events Calendar — Restrict non-public content to the users entitled to read it on its public REST archives
Severity
low Low risk
Affected Versions
<=6.17.3.1
CVE Reference
Patch Status
No patch
Source
NVD

EmbedPress

low
Vulnerability
EmbedPress — Correctly restrict access to one of its Google Reviews REST routes to administrators
Severity
low Low risk
Affected Versions
<=4.6.4
CVE Reference
Patch Status
No patch
Source
NVD

EmbedPress

low
Vulnerability
EmbedPress — Perform a sufficient authorization check on one of its Google Reviews REST API routes
Severity
low Low risk
Affected Versions
<=4.6.4
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (6)

Nokri – Job Board WordPress Theme

high
Vulnerability
Nokri – Job Board WordPress Theme — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=1.6.4
CVE Reference
Patch Status
No patch
Source
NVD

Divi

medium
Vulnerability
Divi — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.27.6
CVE Reference
Patch Status
No patch
Source
NVD

WPKoi Templates for Elementor

medium
Vulnerability
WPKoi Templates for Elementor — CVE-2026-85302
Severity
medium Medium risk
Affected Versions
<=3.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Divi

medium
Vulnerability
Divi — DOM-Based Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.27.6
CVE Reference
Patch Status
No patch
Source
NVD

Divi

medium
Vulnerability
Divi — Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=4.27.6
CVE Reference
Patch Status
No patch
Source
NVD

Real Estate Papi

medium
Vulnerability
Real Estate Papi — Perform capability or CSRF checks on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.0.5
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: September 1 – September 8, 2026

200 WordPress vulnerabilities disclosed between September 1 – September 8, 2026. 16 critical, 43 high severity. 0 patched, 200 unpatched.

WPSentry·Sep 8, 2026
Vulnerability Report

WordPress Vulnerability Report: August 31 – September 7, 2026

213 WordPress vulnerabilities disclosed between August 31 – September 7, 2026. 17 critical, 47 high severity. 0 patched, 213 unpatched.

WPSentry·Sep 7, 2026
Vulnerability Report

WordPress Vulnerability Report: August 30 – September 6, 2026

210 WordPress vulnerabilities disclosed between August 30 – September 6, 2026. 16 critical, 39 high severity. 0 patched, 210 unpatched.

WPSentry·Sep 6, 2026
Back to Blog