BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: September 24 – October 1, 2026

170 WordPress vulnerabilities disclosed between September 24 – October 1, 2026. 9 critical, 46 high severity. 0 patched, 170 unpatched.

WPSentryOctober 1, 202637 min read

During the reporting period (September 24 – October 1, 2026), 170 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

170
Total
9
Critical
46
High
108
Medium
7
Low
0
Patched
Table of Contents 175 plugins & components

WordPress Plugin Vulnerabilities (167)

Visual Composer Website Builder

critical
Vulnerability
Visual Composer Website Builder — Local File Inclusion
Severity
critical Critical risk
Affected Versions
<=45.16.0
CVE Reference
Patch Status
No patch
Source
NVD

Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code

critical
Vulnerability
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=4.8.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Customer Reviews for WooCommerce

critical
Vulnerability
Customer Reviews for WooCommerce — Authorization bypass
Severity
critical Critical risk
Affected Versions
<=5.120.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bookly

critical
Vulnerability
Bookly — Insecure Direct Object Reference
Severity
critical Critical risk
Affected Versions
<=28.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Request a Quote for WooCommerce

critical
Vulnerability
Request a Quote for WooCommerce — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=2.9.2
CVE Reference
Patch Status
No patch
Source
NVD

miniOrange OTP Login, Verification and SMS Notifications

critical
Vulnerability
miniOrange OTP Login, Verification and SMS Notifications — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=5.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultra Addons for Contact Form 7

critical
Vulnerability
Ultra Addons for Contact Form 7 — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=3.5.50
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

critical
Vulnerability
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — Arbitrary shortcode execution
Severity
critical Critical risk
Affected Versions
<=5.7.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

eesy_ID2WP – Publish InDesign HTML5

high
Vulnerability
eesy_ID2WP – Publish InDesign HTML5 — Path Traversal
Severity
high High risk
Affected Versions
<=1.0.3
CVE Reference
Patch Status
No patch
Source
NVD

YOP Poll

high
Vulnerability
YOP Poll — Origin Validation Error
Severity
high High risk
Affected Versions
<=7.0.10
CVE Reference
Patch Status
No patch
Source
NVD

AMP for WP – Accelerated Mobile Pages

high
Vulnerability
AMP for WP – Accelerated Mobile Pages — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.1.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fancy Product Designer

high
Vulnerability
Fancy Product Designer — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Fancy Product Designer

high
Vulnerability
Fancy Product Designer — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.5.2
CVE Reference
Patch Status
No patch
Source
NVD

HT Contact Form – Drag & Drop Form Builder for WordPress

high
Vulnerability
HT Contact Form – Drag & Drop Form Builder for WordPress — Stored DOM-Based Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

BA Book Everything

high
Vulnerability
BA Book Everything — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.8.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters

high
Vulnerability
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters — Local File Inclusion
Severity
high High risk
Affected Versions
<=4.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

high
Vulnerability
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions — Remote Code Execution
Severity
high High risk
Affected Versions
<=260814
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Fancy Product Designer

high
Vulnerability
Fancy Product Designer — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Modula Image Gallery – Photo Grid & Video Gallery

high
Vulnerability
Modula Image Gallery – Photo Grid & Video Gallery — Unauthorized disclosure of private gallery contents
Severity
high High risk
Affected Versions
<=3.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more

high
Vulnerability
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more — Privilege Escalation
Severity
high High risk
Affected Versions
<=9.6.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Modula Image Gallery – Photo Grid & Video Gallery

high
Vulnerability
Modula Image Gallery – Photo Grid & Video Gallery — Arbitrary file deletion
Severity
high High risk
Affected Versions
<=3.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Premium Packages – Sell Digital Products Securely

high
Vulnerability
Premium Packages – Sell Digital Products Securely — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=7.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Optima Express IDX

high
Vulnerability
Optima Express IDX — Privilege Escalation
Severity
high High risk
Affected Versions
<=8.7.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Repeater Fields for Elementor Forms

high
Vulnerability
Repeater Fields for Elementor Forms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.2.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Themify Builder

high
Vulnerability
Themify Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=7.8.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

high
Vulnerability
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Restaurant Menu and Food Ordering

high
Vulnerability
Restaurant Menu and Food Ordering — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.4.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Zero Spam for WordPress

high
Vulnerability
Zero Spam for WordPress — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.7.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Directory Kit

high
Vulnerability
WP Directory Kit — Sanitize and escape some of its category and location fields before outputting them in page attribut
Severity
high High risk
Affected Versions
<=1.5.8
CVE Reference
Patch Status
No patch
Source
NVD

wp-review-slider-pro

high
Vulnerability
wp-review-slider-pro — Perform a capability check on one of its AJAX handlers
Severity
high High risk
Affected Versions
<=12.7.12
CVE Reference
Patch Status
No patch
Source
NVD

wp-review-slider-pro

high
Vulnerability
wp-review-slider-pro — Perform a capability check on the AJAX handler that saves its review submission forms
Severity
high High risk
Affected Versions
<=12.7.12
CVE Reference
Patch Status
No patch
Source
NVD

File Manager

high
Vulnerability
File Manager — CVE-2026-85081
Severity
high High risk
Affected Versions
<=8.0.5
CVE Reference
Patch Status
No patch
Source
NVD

MCP Server for WordPress

high
Vulnerability
MCP Server for WordPress — Correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an
Severity
high High risk
Affected Versions
<=1.8.2
CVE Reference
Patch Status
No patch
Source
NVD

Testimonials Widget

high
Vulnerability
Testimonials Widget — Perform a capability or ownership check when handling its front-end testimonial submission form
Severity
high High risk
Affected Versions
<=4.0.4
CVE Reference
Patch Status
No patch
Source
NVD

Groups – Memberships and Access Control

high
Vulnerability
Groups – Memberships and Access Control — Privilege Escalation
Severity
high High risk
Affected Versions
<=4.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ad Inserter

high
Vulnerability
Ad Inserter — Correctly restrict access to one of its settings pages
Severity
high High risk
Affected Versions
<=2.8.19
CVE Reference
Patch Status
No patch
Source
NVD

Download Manager

high
Vulnerability
Download Manager — Sanitise and escape data submitted through its email-locked download subscription form before output
Severity
high High risk
Affected Versions
<=7.5.6
CVE Reference
Patch Status
No patch
Source
NVD

Malcure Malware Shield — Removal, Repair, Monitor

high
Vulnerability
Malcure Malware Shield — Removal, Repair, Monitor — Perform an authorisation check on one of its AJAX actions
Severity
high High risk
Affected Versions
<=19.9.7
CVE Reference
Patch Status
No patch
Source
NVD

ConvertPlus

high
Vulnerability
ConvertPlus — Deserialization of Untrusted Data
Severity
high High risk
Affected Versions
<=3.6.3
CVE Reference
Patch Status
No patch
Source
NVD

HT Contact Form – Drag & Drop Form Builder for WordPress

high
Vulnerability
HT Contact Form – Drag & Drop Form Builder for WordPress — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.2
CVE Reference
Patch Status
No patch
Source
NVD

Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin

high
Vulnerability
Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin — Stored DOM-Based Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.3.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Frontend

high
Vulnerability
User Frontend — Prevent tampering with the role assigned by its registration form
Severity
high High risk
Affected Versions
<=4.3.12
CVE Reference
Patch Status
No patch
Source
NVD

All in One Files Upload

high
Vulnerability
All in One Files Upload — Sanitise uploaded files or verify the authenticity of its public upload requests
Severity
high High risk
Affected Versions
<=2.0.17
CVE Reference
Patch Status
No patch
Source
NVD

Robin Image Optimizer

high
Vulnerability
Robin Image Optimizer — Escape values that its bundled HTML parser re-emits into element attributes when a non-default image
Severity
high High risk
Affected Versions
<=2.0.8
CVE Reference
Patch Status
No patch
Source
NVD

WP Mobile Menu

high
Vulnerability
WP Mobile Menu — Correctly verify the nonce on its settings import
Severity
high High risk
Affected Versions
<=2.9
CVE Reference
Patch Status
No patch
Source
NVD

Verge3D Publishing and E-Commerce

high
Vulnerability
Verge3D Publishing and E-Commerce — Validate the contents of files uploaded through its file storage feature and serves them back with a
Severity
high High risk
Affected Versions
<=4.13.1
CVE Reference
Patch Status
No patch
Source
NVD

Simply Schedule Appointments

high
Vulnerability
Simply Schedule Appointments — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.6.12.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Motors – Car Dealership & Classified Listings Plugin

high
Vulnerability
Motors – Car Dealership & Classified Listings Plugin — Time-based blind SQL Injection
Severity
high High risk
Affected Versions
<=1.4.109
CVE Reference
Patch Status
No patch
Source
NVD

Product Designer App

high
Vulnerability
Product Designer App — Directory Traversal
Severity
high High risk
Affected Versions
<=1.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Views Stats Counter

high
Vulnerability
Post Views Stats Counter — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Simply Schedule Appointments

high
Vulnerability
Simply Schedule Appointments — Sensitive Information Exposure
Severity
high High risk
Affected Versions
<=1.6.12.32
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AI Engine – The Chatbot, AI Framework & MCP for WordPress

high
Vulnerability
AI Engine – The Chatbot, AI Framework & MCP for WordPress — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Extendify

high
Vulnerability
Extendify — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.1.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Multilang – Translation and Multilingual Plugin

medium
Vulnerability
WP Multilang – Translation and Multilingual Plugin — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.4.31
CVE Reference
Patch Status
No patch
Source
NVD

Kirki – Freeform Page Builder, Website Builder & Customizer

medium
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Blind Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=6.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Spectra Legacy – Gutenberg Blocks

medium
Vulnerability
Spectra Legacy – Gutenberg Blocks — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=2.20.0
CVE Reference
Patch Status
No patch
Source
NVD

MailerLite – Signup forms (official)

medium
Vulnerability
MailerLite – Signup forms (official) — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=1.7.21
CVE Reference
Patch Status
No patch
Source
NVD

Custom Thank You Page for WooCommerce

medium
Vulnerability
Custom Thank You Page for WooCommerce — Unauthorized access and loss of data
Severity
medium Medium risk
Affected Versions
<=1.1.2
CVE Reference
Patch Status
No patch
Source
NVD

CSS & JavaScript Toolbox

medium
Vulnerability
CSS & JavaScript Toolbox — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=12.0.6
CVE Reference
Patch Status
No patch
Source
NVD

OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin

medium
Vulnerability
OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Link Library

medium
Vulnerability
Link Library — Properly escape some parameters before outputting them in the addresses of links it generates on its
Severity
medium Medium risk
Affected Versions
<=7.9.6
CVE Reference
Patch Status
No patch
Source
NVD

Link Library

medium
Vulnerability
Link Library — Sanitize a user-supplied destination folder before writing a generated image to disk
Severity
medium Medium risk
Affected Versions
<=7.9.6
CVE Reference
Patch Status
No patch
Source
NVD

Link Library

medium
Vulnerability
Link Library — Validate the destination of a user-supplied URL before falling back to an unprotected fetch when its
Severity
medium Medium risk
Affected Versions
<=7.9.6
CVE Reference
Patch Status
No patch
Source
NVD

JetFormBuilder — Dynamic Blocks Form Builder

medium
Vulnerability
JetFormBuilder — Dynamic Blocks Form Builder — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.6.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gutenverse – WordPress Blocks, Page Builder & Site Editor

medium
Vulnerability
Gutenverse – WordPress Blocks, Page Builder & Site Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Online Scheduling and Appointment Booking System – Bookly

medium
Vulnerability
Online Scheduling and Appointment Booking System – Bookly — Authorization Bypass
Severity
medium Medium risk
Affected Versions
<=28.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Blog2Social: Social Media Auto Post & Scheduler

medium
Vulnerability
Blog2Social: Social Media Auto Post & Scheduler — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=9.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

medium
Vulnerability
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.8.181
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

medium
Vulnerability
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

medium
Vulnerability
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots — Stored DOM-Based Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

medium
Vulnerability
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.8.183
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Asset CleanUp: Page Speed Booster

medium
Vulnerability
Asset CleanUp: Page Speed Booster — Server-Side Request Forgery
Severity
medium Medium risk
Affected Versions
<=1.4.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters

medium
Vulnerability
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SSL Zen

medium
Vulnerability
SSL Zen — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.7.42
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SSL Zen — SSL Certificate Installer & HTTPS Redirects

medium
Vulnerability
SSL Zen — SSL Certificate Installer & HTTPS Redirects — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=4.7.42
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

medium
Vulnerability
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

medium
Vulnerability
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

wpForo Forum

medium
Vulnerability
wpForo Forum — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

wpForo Forum

medium
Vulnerability
wpForo Forum — Verify the source of client-supplied IP address headers before using them to key its per-visitor rat
Severity
medium Medium risk
Affected Versions
<=3.1.6
CVE Reference
Patch Status
No patch
Source
NVD

Bookly

medium
Vulnerability
Bookly — Properly verify a customer's identity before updating their stored details
Severity
medium Medium risk
Affected Versions
<=28.3
CVE Reference
Patch Status
No patch
Source
NVD

MasterStudy LMS

medium
Vulnerability
MasterStudy LMS — Verify that a course a member asks to enrol in is covered by their membership plan
Severity
medium Medium risk
Affected Versions
<=3.7.50
CVE Reference
Patch Status
No patch
Source
NVD

Automatic.css

medium
Vulnerability
Automatic.css — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Team Members

medium
Vulnerability
Team Members — Perform any authorization or visibility check in an unauthenticated AJAX action that returns full te
Severity
medium Medium risk
Affected Versions
<=9.3
CVE Reference
Patch Status
No patch
Source
NVD

File Manager

medium
Vulnerability
File Manager — Prevent unauthenticated users from downloading its database backup archives
Severity
medium Medium risk
Affected Versions
<=8.0.5
CVE Reference
Patch Status
No patch
Source
NVD

wp-review-slider-pro

medium
Vulnerability
wp-review-slider-pro — Sanitize a value stored through one of its AJAX handlers
Severity
medium Medium risk
Affected Versions
<=12.7.12
CVE Reference
Patch Status
No patch
Source
NVD

Bluff Post

medium
Vulnerability
Bluff Post — Sanitise and escape parameters before using them as identifiers in a SQL query
Severity
medium Medium risk
Affected Versions
<=1.1.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Delicious

medium
Vulnerability
WP Delicious — Validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it
Severity
medium Medium risk
Affected Versions
<=1.10.8
CVE Reference
Patch Status
No patch
Source
NVD

Optimole

medium
Vulnerability
Optimole — Escape unrecognized attributes of its video-player block before rendering them onto the block's wrap
Severity
medium Medium risk
Affected Versions
<=4.2.13
CVE Reference
Patch Status
No patch
Source
NVD

Testimonials Widget

medium
Vulnerability
Testimonials Widget — Validate a user-supplied URL before fetching it server-side and storing the response as a public fil
Severity
medium Medium risk
Affected Versions
<=4.0.4
CVE Reference
Patch Status
No patch
Source
NVD

UpdraftPlus: WP Backup & Migration Plugin

medium
Vulnerability
UpdraftPlus: WP Backup & Migration Plugin — Have any capability check in a routine that outputs its stored remote storage settings into admin pa
Severity
medium Medium risk
Affected Versions
<=1.26.8
CVE Reference
Patch Status
No patch
Source
NVD

WebFacing™

medium
Vulnerability
WebFacing™ — Restrict access to one of its bundled scripts and does not validate a user-supplied path before usin
Severity
medium Medium risk
Affected Versions
<=5.4
CVE Reference
Patch Status
No patch
Source
NVD

EmbedPress

medium
Vulnerability
EmbedPress — Escape one of its block attributes before outputting it inside an HTML attribute
Severity
medium Medium risk
Affected Versions
<=4.6.7
CVE Reference
Patch Status
No patch
Source
NVD

Online Scheduling and Appointment Booking System

medium
Vulnerability
Online Scheduling and Appointment Booking System — Prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance
Severity
medium Medium risk
Affected Versions
<=28.3
CVE Reference
Patch Status
No patch
Source
NVD

WPeMatico RSS Feed Fetcher

medium
Vulnerability
WPeMatico RSS Feed Fetcher — Perform a capability check or validate the destination of a user-supplied feed URL before fetching i
Severity
medium Medium risk
Affected Versions
<=2.8.27
CVE Reference
Patch Status
No patch
Source
NVD

WPeMatico RSS Feed Fetcher

medium
Vulnerability
WPeMatico RSS Feed Fetcher — Verify that a user running a feed campaign is permitted to publish content or to attribute posts to
Severity
medium Medium risk
Affected Versions
<=2.8.27
CVE Reference
Patch Status
No patch
Source
NVD

WPeMatico RSS Feed Fetcher

medium
Vulnerability
WPeMatico RSS Feed Fetcher — Perform a capability check before fetching a user-supplied URL and rendering the response
Severity
medium Medium risk
Affected Versions
<=2.8.27
CVE Reference
Patch Status
No patch
Source
NVD

WPeMatico RSS Feed Fetcher

medium
Vulnerability
WPeMatico RSS Feed Fetcher — Sanitize imported feed content before storing it as post content
Severity
medium Medium risk
Affected Versions
<=2.8.27
CVE Reference
Patch Status
No patch
Source
NVD

Mailchimp for WooCommerce

medium
Vulnerability
Mailchimp for WooCommerce — Require authentication or verify ownership before loading a saved cart from a request-supplied ident
Severity
medium Medium risk
Affected Versions
<=6.3
CVE Reference
Patch Status
No patch
Source
NVD

Verge3D Publishing and E-Commerce

medium
Vulnerability
Verge3D Publishing and E-Commerce — Restrict access to a file-download handler
Severity
medium Medium risk
Affected Versions
<=4.13.0
CVE Reference
Patch Status
No patch
Source
NVD

WP YouTube Lyte

medium
Vulnerability
WP YouTube Lyte — Escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rend
Severity
medium Medium risk
Affected Versions
<=1.7.31
CVE Reference
Patch Status
No patch
Source
NVD

Optima Express IDX

medium
Vulnerability
Optima Express IDX — Perform any authorisation check on one of its AJAX actions that is available to logged-out users
Severity
medium Medium risk
Affected Versions
<=8.7.6
CVE Reference
Patch Status
No patch
Source
NVD

Optima Express IDX

medium
Vulnerability
Optima Express IDX — Properly neutralise a script value submitted through one of its REST endpoints before storing it and
Severity
medium Medium risk
Affected Versions
<=8.7.6
CVE Reference
Patch Status
No patch
Source
NVD

NextScripts: Social Networks Auto-Poster

medium
Vulnerability
NextScripts: Social Networks Auto-Poster — Perform capability or ownership checks on several of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=4.4.8
CVE Reference
Patch Status
No patch
Source
NVD

PowerPress Podcasting plugin by Blubrry

medium
Vulnerability
PowerPress Podcasting plugin by Blubrry — Sanitize and escape a block attribute before outputting it in a page
Severity
medium Medium risk
Affected Versions
<=11.17.2
CVE Reference
Patch Status
No patch
Source
NVD

WPForms Lite

medium
Vulnerability
WPForms Lite — Remove shortcode delimiters from submitted field values before writing them back into the rendered f
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Bookly

medium
Vulnerability
Bookly — Validate client-supplied booking quantity values on the server before computing the appointment tota
Severity
medium Medium risk
Affected Versions
<=28.3
CVE Reference
Patch Status
No patch
Source
NVD

Blacklist Manager for WooCommerce

medium
Vulnerability
Blacklist Manager for WooCommerce — Enforce its user blocking on every authentication path
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

WP Verify API

medium
Vulnerability
WP Verify API — Have any authorisation check in one of its REST routes
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Post Voting System

medium
Vulnerability
Post Voting System — Properly sanitize and escape a parameter before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=1.0
CVE Reference
Patch Status
No patch
Source
NVD

Paymattic

medium
Vulnerability
Paymattic — Verify that a confirmed Stripe payment belongs to the order it is applied to
Severity
medium Medium risk
Affected Versions
<=4.6.26
CVE Reference
Patch Status
No patch
Source
NVD

Verge3D

medium
Vulnerability
Verge3D — Verify with the payment provider that a payment was actually made
Severity
medium Medium risk
Affected Versions
<=4.13.0
CVE Reference
Patch Status
No patch
Source
NVD

SPS-Suite

medium
Vulnerability
SPS-Suite — Sanitise the search query before using it in a SQL query when its static-page search feature is enab
Severity
medium Medium risk
Affected Versions
<=1.4.0
CVE Reference
Patch Status
No patch
Source
NVD

FluentCart A New Era of eCommerce

medium
Vulnerability
FluentCart A New Era of eCommerce — Verify that the person placing a guest checkout controls the email address supplied
Severity
medium Medium risk
Affected Versions
<=1.6.5
CVE Reference
Patch Status
No patch
Source
NVD

User Frontend

medium
Vulnerability
User Frontend — Check whether the site allows user registration before creating an account
Severity
medium Medium risk
Affected Versions
<=4.3.12
CVE Reference
Patch Status
No patch
Source
NVD

Solace Extra

medium
Vulnerability
Solace Extra — Perform any authorization or post-status checks on its front-end preview routes
Severity
medium Medium risk
Affected Versions
<=1.7.2
CVE Reference
Patch Status
No patch
Source
NVD

New User Approve

medium
Vulnerability
New User Approve — Properly verify authentication on a set of integration REST API routes when the integration is uncon
Severity
medium Medium risk
Affected Versions
<=3.2.10
CVE Reference
Patch Status
No patch
Source
NVD

EmbedPress

medium
Vulnerability
EmbedPress — Sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute
Severity
medium Medium risk
Affected Versions
<=4.6.7
CVE Reference
Patch Status
No patch
Source
NVD

Audio Player Block

medium
Vulnerability
Audio Player Block — Validate the scheme of a user-supplied URL before using it as a link target
Severity
medium Medium risk
Affected Versions
<=1.6.3
CVE Reference
Patch Status
No patch
Source
NVD

All in One Files Upload

medium
Vulnerability
All in One Files Upload — Have any capability check
Severity
medium Medium risk
Affected Versions
<=2.0.17
CVE Reference
Patch Status
No patch
Source
NVD

Connections Business Directory

medium
Vulnerability
Connections Business Directory — Apply its visibility and moderation-status restrictions on certain REST API read endpoints
Severity
medium Medium risk
Affected Versions
<=10.4.67
CVE Reference
Patch Status
No patch
Source
NVD

Hostinger Reach

medium
Vulnerability
Hostinger Reach — Sanitize and escape a widget setting before outputting it in the editor preview
Severity
medium Medium risk
Affected Versions
<=1.8.3
CVE Reference
Patch Status
No patch
Source
NVD

Robin Image Optimizer

medium
Vulnerability
Robin Image Optimizer — Check the user's capabilities before dispatching one of its bundled admin framework's request handle
Severity
medium Medium risk
Affected Versions
<=2.0.8
CVE Reference
Patch Status
No patch
Source
NVD

Image Optimizer

medium
Vulnerability
Image Optimizer — Enforce its intended capability check on several of its read REST routes
Severity
medium Medium risk
Affected Versions
<=1.7.7
CVE Reference
Patch Status
No patch
Source
NVD

EWWW Image Optimizer

medium
Vulnerability
EWWW Image Optimizer — Prevent authenticated users with author-level permissions from storing a serialized value in a post
Severity
medium Medium risk
Affected Versions
<=8.8.0
CVE Reference
Patch Status
No patch
Source
NVD

EWWW Image Optimizer

medium
Vulnerability
EWWW Image Optimizer — Confine a WebP-derivative file migration routine to the current site's own uploads directory
Severity
medium Medium risk
Affected Versions
<=8.8.0
CVE Reference
Patch Status
No patch
Source
NVD

Content Egg

medium
Vulnerability
Content Egg — Verify that a user running its bulk content-import feature is authorized for the import preset they
Severity
medium Medium risk
Affected Versions
<=11.9.0
CVE Reference
Patch Status
No patch
Source
NVD

InPost PL

medium
Vulnerability
InPost PL — Verify the authenticity of incoming shipment webhook requests
Severity
medium Medium risk
Affected Versions
<=1.9.8
CVE Reference
Patch Status
No patch
Source
NVD

YayReviews

medium
Vulnerability
YayReviews — Restrict access to an API route that returns individual customer review records
Severity
medium Medium risk
Affected Versions
<=1.4.1
CVE Reference
Patch Status
No patch
Source
NVD

Course Booking System

medium
Vulnerability
Course Booking System — Restrict access to its booking export
Severity
medium Medium risk
Affected Versions
<=7.0.9
CVE Reference
Patch Status
No patch
Source
NVD

Broken Link Notifier

medium
Vulnerability
Broken Link Notifier — Re-validate the destination of redirects when checking links
Severity
medium Medium risk
Affected Versions
<=2.0.0.1
CVE Reference
Patch Status
No patch
Source
NVD

HT Mega Addons for Elementor – Elementor Widgets & Template Builder

medium
Vulnerability
HT Mega Addons for Elementor – Elementor Widgets & Template Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Smart Slider 3

medium
Vulnerability
Smart Slider 3 — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.1.38
CVE Reference
Patch Status
No patch
Source
NVD

WP Directory Kit

medium
Vulnerability
WP Directory Kit — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Viable URL Media Uploader

medium
Vulnerability
Viable URL Media Uploader — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ReactPress – Create React App for WordPress

medium
Vulnerability
ReactPress – Create React App for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Real Estate Manager – Property Listing and Agent Management

medium
Vulnerability
Real Estate Manager – Property Listing and Agent Management — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletter – Send awesome emails from WordPress

medium
Vulnerability
Newsletter – Send awesome emails from WordPress — Insufficiently Protected Credentials
Severity
medium Medium risk
Affected Versions
<=9.3.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Simply Schedule Appointments

medium
Vulnerability
Simply Schedule Appointments — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=1.6.12.31
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Woo Labels – Product Labels & Badges for WooCommerce

medium
Vulnerability
Advanced Woo Labels – Product Labels & Badges for WooCommerce — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=2.51
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Popular Posts

medium
Vulnerability
WP Popular Posts — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=7.4.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Featured Image from URL (FIFU)

medium
Vulnerability
Featured Image from URL (FIFU) — CVE-2026-101147
Severity
medium Medium risk
Affected Versions
<=6.0.8
CVE Reference
Patch Status
No patch
Source
NVD

BackupSheep WordPress Backup Plugin

medium
Vulnerability
BackupSheep WordPress Backup Plugin — Properly validate its integration key
Severity
medium Medium risk
Affected Versions
<=1.8
CVE Reference
Patch Status
No patch
Source
NVD

Cache Enabler

medium
Vulnerability
Cache Enabler — Validate a URL before using it to build a filesystem path in its cache purge routine
Severity
medium Medium risk
Affected Versions
<=1.8.17
CVE Reference
Patch Status
No patch
Source
NVD

Paytm Payment Gateway

medium
Vulnerability
Paytm Payment Gateway — Sanitize and escape data it stores from payment callbacks before outputting it in an admin page
Severity
medium Medium risk
Affected Versions
<=2.8.9
CVE Reference
Patch Status
No patch
Source
NVD

Paytm Payment Gateway

medium
Vulnerability
Paytm Payment Gateway — Properly escape data taken from payment callbacks before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=2.8.9
CVE Reference
Patch Status
No patch
Source
NVD

Download Manager

medium
Vulnerability
Download Manager — Sufficiently sanitise and escape a package setting before outputting it back in a page
Severity
medium Medium risk
Affected Versions
<=3.3.71
CVE Reference
Patch Status
No patch
Source
NVD

If-So Dynamic Content

medium
Vulnerability
If-So Dynamic Content — Escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is ser
Severity
medium Medium risk
Affected Versions
<=1.10.2
CVE Reference
Patch Status
No patch
Source
NVD

If-So Dynamic Content

medium
Vulnerability
If-So Dynamic Content — Sanitize a conversion name before storing it
Severity
medium Medium risk
Affected Versions
<=1.10.2
CVE Reference
Patch Status
No patch
Source
NVD

Redux Framework

medium
Vulnerability
Redux Framework — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.5.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Pro Like Button

medium
Vulnerability
Pro Like Button — Properly sanitize and escape a parameter before using it in a SQL query
Severity
medium Medium risk
Affected Versions
<=2.0
CVE Reference
Patch Status
No patch
Source
NVD

WP Fusion Lite

medium
Vulnerability
WP Fusion Lite — Perform a capability check on two of its admin AJAX handlers
Severity
medium Medium risk
Affected Versions
<=3.48.0
CVE Reference
Patch Status
No patch
Source
NVD

WP Fusion Lite

medium
Vulnerability
WP Fusion Lite — Require authentication on a settings handler that runs during admin initialization
Severity
medium Medium risk
Affected Versions
<=3.48.0
CVE Reference
Patch Status
No patch
Source
NVD

Five Star Restaurant Reviews

medium
Vulnerability
Five Star Restaurant Reviews — Properly escape a user-supplied value before outputting it into an HTML tag
Severity
medium Medium risk
Affected Versions
<=2.3.14
CVE Reference
Patch Status
No patch
Source
NVD

Payments for Hubtel

medium
Vulnerability
Payments for Hubtel — Verify that the requester is authorized to view an order before redirecting a public payment-callbac
Severity
medium Medium risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Payments for Hubtel

medium
Vulnerability
Payments for Hubtel — Verify that payment notifications received by its payment callback come from the payment provider
Severity
medium Medium risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Payments for Hubtel

medium
Vulnerability
Payments for Hubtel — Prevent public access to a debug log in which it records payment requests
Severity
medium Medium risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

MCP Server for WordPress

low
Vulnerability
MCP Server for WordPress — Perform an ownership or sufficient capability check on its workflow create
Severity
low Low risk
Affected Versions
<=1.8.2
CVE Reference
Patch Status
No patch
Source
NVD

MCP Server for WordPress

low
Vulnerability
MCP Server for WordPress — Perform an object-level authorization check on one of its workflow REST routes
Severity
low Low risk
Affected Versions
<=1.8.2
CVE Reference
Patch Status
No patch
Source
NVD

Online Scheduling and Appointment Booking System

low
Vulnerability
Online Scheduling and Appointment Booking System — Verify that appointment and payment records requested through its staff-role AJAX actions belong to
Severity
low Low risk
Affected Versions
<=28.3
CVE Reference
Patch Status
No patch
Source
NVD

Schema & Structured Data for WP & AMP

low
Vulnerability
Schema & Structured Data for WP & AMP — Perform a capability check when saving several of its fields
Severity
low Low risk
Affected Versions
<=1.67
CVE Reference
Patch Status
No patch
Source
NVD

Safe Redirect Manager

low
Vulnerability
Safe Redirect Manager — Properly validate the redirect destination when a wildcard redirect rule to an absolute URL is confi
Severity
low Low risk
Affected Versions
<=2.3.0
CVE Reference
Patch Status
No patch
Source
NVD

Media Library Organizer

low
Vulnerability
Media Library Organizer — Verify that the requesting user holds the target taxonomy's management capability before creating a
Severity
low Low risk
Affected Versions
<=2.1.4
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (3)

Zella Theme

critical
Vulnerability
Zella Theme — Perform any capability or nonce check on one of its font upload actions
Severity
critical Critical risk
Affected Versions
<=2.6.3
CVE Reference
Patch Status
No patch
Source
NVD

Vayu X

high
Vulnerability
Vayu X — Perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every l
Severity
high High risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Shop manager Content Injection in Astra

low
Vulnerability
Shop manager Content Injection in Astra — CVE-2026-27085
Severity
low Low risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: September 23 – September 30, 2026

160 WordPress vulnerabilities disclosed between September 23 – September 30, 2026. 8 critical, 39 high severity. 0 patched, 160 unpatched.

WPSentry·Sep 30, 2026
Vulnerability Report

WordPress Vulnerability Report: September 22 – September 29, 2026

202 WordPress vulnerabilities disclosed between September 22 – September 29, 2026. 10 critical, 49 high severity. 0 patched, 202 unpatched.

WPSentry·Sep 29, 2026
Vulnerability Report

WordPress Vulnerability Report: September 21 – September 28, 2026

213 WordPress vulnerabilities disclosed between September 21 – September 28, 2026. 12 critical, 51 high severity. 0 patched, 213 unpatched.

WPSentry·Sep 28, 2026
Back to Blog