BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: September 30 – October 7, 2026

246 WordPress vulnerabilities disclosed between September 30 – October 7, 2026. 12 critical, 85 high severity. 0 patched, 246 unpatched.

WPSentryOctober 7, 202656 min read

During the reporting period (September 30 – October 7, 2026), 246 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

246
Total
12
Critical
85
High
140
Medium
9
Low
0
Patched
Table of Contents 251 plugins & components

WordPress Plugin Vulnerabilities (243)

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

critical
Vulnerability
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — Arbitrary shortcode execution
Severity
critical Critical risk
Affected Versions
<=5.7.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

BackupSheep WordPress Backup Plugin

critical
Vulnerability
BackupSheep WordPress Backup Plugin — Properly validate its integration key
Severity
critical Critical risk
Affected Versions
<=1.8
CVE Reference
Patch Status
No patch
Source
NVD

Super Forms – Drag & Drop Form Builder

critical
Vulnerability
Super Forms – Drag & Drop Form Builder — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=6.3.316
CVE Reference
Patch Status
No patch
Source
NVD

Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform

critical
Vulnerability
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=2.15.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

DevKit Pro

critical
Vulnerability
DevKit Pro — Authentication Bypass Leading to Administrator Account Takeover
Severity
critical Critical risk
Affected Versions
<=2.3.0
CVE Reference
Patch Status
No patch
Source
NVD

Divi Membership

critical
Vulnerability
Divi Membership — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=2.3.0
CVE Reference
Patch Status
No patch
Source
NVD

Super Forms – Drag & Drop Form Builder

critical
Vulnerability
Super Forms – Drag & Drop Form Builder — Directory Traversal
Severity
critical Critical risk
Affected Versions
<=6.3.316
CVE Reference
Patch Status
No patch
Source
NVD

JSON API Auth

critical
Vulnerability
JSON API Auth — Authentication Bypass
Severity
critical Critical risk
Affected Versions
<=3.1.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPMobile.App – Android and iOS App Builder

critical
Vulnerability
WPMobile.App – Android and iOS App Builder — Authorization bypass
Severity
critical Critical risk
Affected Versions
<=11.82
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Divi Membership

critical
Vulnerability
Divi Membership — Privilege Escalation
Severity
critical Critical risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD

VikAppointments Services Booking Calendar

critical
Vulnerability
VikAppointments Services Booking Calendar — Arbitrary file deletion
Severity
critical Critical risk
Affected Versions
<=1.2.21
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Beaver Builder Page Builder – Drag and Drop Website Builder

critical
Vulnerability
The Beaver Builder Page Builder – Drag and Drop Website Builder — Arbitrary shortcode execution
Severity
critical Critical risk
Affected Versions
<=2.11.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Motors – Car Dealership & Classified Listings Plugin

high
Vulnerability
Motors – Car Dealership & Classified Listings Plugin — Time-based blind SQL Injection
Severity
high High risk
Affected Versions
<=1.4.109
CVE Reference
Patch Status
No patch
Source
NVD

Product Designer App

high
Vulnerability
Product Designer App — Directory Traversal
Severity
high High risk
Affected Versions
<=1.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Post Views Stats Counter

high
Vulnerability
Post Views Stats Counter — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Simply Schedule Appointments

high
Vulnerability
Simply Schedule Appointments — Sensitive Information Exposure
Severity
high High risk
Affected Versions
<=1.6.12.32
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

AI Engine – The Chatbot, AI Framework & MCP for WordPress

high
Vulnerability
AI Engine – The Chatbot, AI Framework & MCP for WordPress — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Featured Image from URL (FIFU)

high
Vulnerability
Featured Image from URL (FIFU) — CVE-2026-101147
Severity
high High risk
Affected Versions
<=6.0.8
CVE Reference
Patch Status
No patch
Source
NVD

Cache Enabler

high
Vulnerability
Cache Enabler — Validate a URL before using it to build a filesystem path in its cache purge routine
Severity
high High risk
Affected Versions
<=1.8.17
CVE Reference
Patch Status
No patch
Source
NVD

Paytm Payment Gateway

high
Vulnerability
Paytm Payment Gateway — Sanitize and escape data it stores from payment callbacks before outputting it in an admin page
Severity
high High risk
Affected Versions
<=2.8.9
CVE Reference
Patch Status
No patch
Source
NVD

Paytm Payment Gateway

high
Vulnerability
Paytm Payment Gateway — Properly escape data taken from payment callbacks before using it in a SQL statement
Severity
high High risk
Affected Versions
<=2.8.9
CVE Reference
Patch Status
No patch
Source
NVD

Extendify

high
Vulnerability
Extendify — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.1.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Pro Like Button

high
Vulnerability
Pro Like Button — Properly sanitize and escape a parameter before using it in a SQL query
Severity
high High risk
Affected Versions
<=2.0
CVE Reference
Patch Status
No patch
Source
NVD

Five Star Restaurant Reviews

high
Vulnerability
Five Star Restaurant Reviews — Properly escape a user-supplied value before outputting it into an HTML tag
Severity
high High risk
Affected Versions
<=2.3.14
CVE Reference
Patch Status
No patch
Source
NVD

Payments for Hubtel

high
Vulnerability
Payments for Hubtel — Prevent public access to a debug log in which it records payment requests
Severity
high High risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

ByteCoreStack – MCP Connector for AI Tools

high
Vulnerability
ByteCoreStack – MCP Connector for AI Tools — Privilege Escalation
Severity
high High risk
Affected Versions
<=1.2.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

high
Vulnerability
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — Insecure Direct Object Reference
Severity
high High risk
Affected Versions
<=4.4.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Autoptimize

high
Vulnerability
Autoptimize — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.1.15.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Super Forms – Drag & Drop Form Builder

high
Vulnerability
Super Forms – Drag & Drop Form Builder — Arbitrary File/Directory Deletion
Severity
high High risk
Affected Versions
<=6.3.316
CVE Reference
Patch Status
No patch
Source
NVD

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

high
Vulnerability
Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.57.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

PDF Invoices & Packing Slips for WooCommerce

high
Vulnerability
PDF Invoices & Packing Slips for WooCommerce — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.16.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPC Shop as a Customer for WooCommerce

high
Vulnerability
WPC Shop as a Customer for WooCommerce — Privilege escalation
Severity
high High risk
Affected Versions
<=2.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Appointment Hour Booking – Booking Calendar

high
Vulnerability
Appointment Hour Booking – Booking Calendar — Stored DOM-Based Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.5.97
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

high
Vulnerability
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.15.47
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Business Essentials for Contact Form 7

high
Vulnerability
Business Essentials for Contact Form 7 — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

high
Vulnerability
Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.57.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Prime Mover

high
Vulnerability
Prime Mover — Authenticated administrators to write arbitrary files outside the intended extraction directory duri
Severity
high High risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Visitors Traffic Real Time Statistics Pro

high
Vulnerability
Visitors Traffic Real Time Statistics Pro — Unauthenticated stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=11.22
CVE Reference
Patch Status
No patch
Source
NVD

CTX Feed Pro

high
Vulnerability
CTX Feed Pro — Code Injection
Severity
high High risk
Affected Versions
<=7.6.12
CVE Reference
Patch Status
No patch
Source
NVD

Super Forms – Drag & Drop Form Builder

high
Vulnerability
Super Forms – Drag & Drop Form Builder — Privilege Escalation
Severity
high High risk
Affected Versions
<=6.3.316
CVE Reference
Patch Status
No patch
Source
NVD

Ninja Forms – The Contact Form Builder That Grows With You

high
Vulnerability
Ninja Forms – The Contact Form Builder That Grows With You — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.15.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.

high
Vulnerability
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. — Require authentication or a valid nonce on an action that issues a slow server-side loopback request
Severity
high High risk
Affected Versions
<=6.3.11
CVE Reference
Patch Status
No patch
Source
NVD

SiteOrigin Widgets Bundle

high
Vulnerability
SiteOrigin Widgets Bundle — Local File Inclusion
Severity
high High risk
Affected Versions
<=1.73.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms - File Uploads

high
Vulnerability
Ninja Forms - File Uploads — Arbitrary file operations
Severity
high High risk
Affected Versions
<=3.3.34
CVE Reference
Patch Status
No patch
Source
NVD

BA Book Everything

high
Vulnerability
BA Book Everything — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.8.28
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kubio AI Page Builder

high
Vulnerability
Kubio AI Page Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.9.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Download Monitor

high
Vulnerability
Download Monitor — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.2.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CMB2

high
Vulnerability
CMB2 — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.13.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Relevanssi Premium

high
Vulnerability
Relevanssi Premium — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.31.4
CVE Reference
Patch Status
No patch
Source
NVD

Smash Balloon Social Post Feed – Simple Social Feeds for WordPress

high
Vulnerability
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.13.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

No External Links

high
Vulnerability
No External Links — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

DoFollow Case by Case

high
Vulnerability
DoFollow Case by Case — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletter – Send awesome emails from WordPress

high
Vulnerability
Newsletter – Send awesome emails from WordPress — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=9.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MW WP Form

high
Vulnerability
MW WP Form — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GSpeech TTS – WordPress Text To Speech Plugin

high
Vulnerability
GSpeech TTS – WordPress Text To Speech Plugin — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.22.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mang Board

high
Vulnerability
Mang Board — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.4.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CMB2

high
Vulnerability
CMB2 — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.13.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

JetFormBuilder — Dynamic Blocks Form Builder

high
Vulnerability
JetFormBuilder — Dynamic Blocks Form Builder — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.6.5.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Relevanssi – A Better Search

high
Vulnerability
Relevanssi – A Better Search — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.28.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Customer Reviews for WooCommerce

high
Vulnerability
Customer Reviews for WooCommerce — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.122.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

W3 Total Cache

high
Vulnerability
W3 Total Cache — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

JetAppointment

high
Vulnerability
JetAppointment — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.5.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

high
Vulnerability
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — Authorization bypass
Severity
high High risk
Affected Versions
<=2.13.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

high
Vulnerability
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.13.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

high
Vulnerability
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — Sensitive Information Exposure
Severity
high High risk
Affected Versions
<=4.17.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Real Cookie Banner: GDPR & ePrivacy Cookie Consent

high
Vulnerability
Real Cookie Banner: GDPR & ePrivacy Cookie Consent — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=5.3.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Groundhogg — CRM, Newsletters, and Marketing Automation

high
Vulnerability
Groundhogg — CRM, Newsletters, and Marketing Automation — Privilege Escalation
Severity
high High risk
Affected Versions
<=4.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Ultimate Review

high
Vulnerability
WP Ultimate Review — Properly sanitise and escape reviews submitted through its public review form
Severity
high High risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD

WP Ultimate Review

high
Vulnerability
WP Ultimate Review — Validate that a submitted review rating is numeric before storing it and later using it in numeric o
Severity
high High risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD

WP Ultimate Review

high
Vulnerability
WP Ultimate Review — Prevent unauthenticated users from storing crafted review content that makes the reviewed page fail
Severity
high High risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD

Photo Reviews for WooCommerce

high
Vulnerability
Photo Reviews for WooCommerce — Arbitrary Content Deletion
Severity
high High risk
Affected Versions
<=1.2.30
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Magic Tooltips For Contact Form 7

high
Vulnerability
Magic Tooltips For Contact Form 7 — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.0.34
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP 2FA

high
Vulnerability
WP 2FA — Invalidate a time-based one-time passcode once it has been used
Severity
high High risk
Affected Versions
<=4.1.0
CVE Reference
Patch Status
No patch
Source
NVD

GeoDirectory

high
Vulnerability
GeoDirectory — SQL Injection
Severity
high High risk
Affected Versions
<=2.8.186
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Welcart e-Commerce

high
Vulnerability
Welcart e-Commerce — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.12.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Kubio AI Page Builder

high
Vulnerability
Kubio AI Page Builder — Limit its widening of the allowed HTML elements to the editor context
Severity
high High risk
Affected Versions
<=2.9.3
CVE Reference
Patch Status
No patch
Source
NVD

SaveTo Wishlist Lite

high
Vulnerability
SaveTo Wishlist Lite — Sanitise and escape parameters before using them in the ORDER BY clause of a SQL query
Severity
high High risk
Affected Versions
<=1.1.5
CVE Reference
Patch Status
No patch
Source
NVD

TillKit

high
Vulnerability
TillKit — Require the hard-coded
Severity
high High risk
Affected Versions
<=1.0.5
CVE Reference
Patch Status
No patch
Source
NVD

GD Rating System

high
Vulnerability
GD Rating System — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.7.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SEOPress – AI SEO Plugin & On-site SEO

high
Vulnerability
SEOPress – AI SEO Plugin & On-site SEO — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=10.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Transliterator – Multilingual and Multi-script Text Conversion

high
Vulnerability
Transliterator – Multilingual and Multi-script Text Conversion — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.5.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Strong Testimonials

high
Vulnerability
Strong Testimonials — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.3.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Simple Membership

high
Vulnerability
Simple Membership — Unauthorized modification of data and sensitive information disclosure
Severity
high High risk
Affected Versions
<=4.8.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Visitor Traffic Real Time Statistics

high
Vulnerability
Visitor Traffic Real Time Statistics — Stored DOM-Based Cross-Site Scripting
Severity
high High risk
Affected Versions
<=8.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management

high
Vulnerability
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management — Generic SQL Injection
Severity
high High risk
Affected Versions
<=8.97.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System

high
Vulnerability
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System — Local File Inclusion
Severity
high High risk
Affected Versions
<=3.0.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mail logging – WP Mail Catcher

high
Vulnerability
Mail logging – WP Mail Catcher — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.1.12
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Nelio Content – Editorial Calendar & Social Media Auto-Posting

high
Vulnerability
Nelio Content – Editorial Calendar & Social Media Auto-Posting — Authorization bypass
Severity
high High risk
Affected Versions
<=4.5.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Visitor Statistics (Real Time Traffic)

high
Vulnerability
WP Visitor Statistics (Real Time Traffic) — Generic SQL Injection
Severity
high High risk
Affected Versions
<=8.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPC Product Options for WooCommerce

high
Vulnerability
WPC Product Options for WooCommerce — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CoCart

high
Vulnerability
CoCart — Scope its REST API authentication filter to its own endpoints
Severity
high High risk
Affected Versions
<=4.9.7
CVE Reference
Patch Status
No patch
Source
NVD

Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

high
Vulnerability
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ACPT (Premium)

high
Vulnerability
ACPT (Premium) — Remote Code Execution
Severity
high High risk
Affected Versions
<=2.0.66
CVE Reference
Patch Status
No patch
Source
NVD

Kirki – Freeform Page Builder, Website Builder & Customizer

high
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.3.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Nexi XPay Build

high
Vulnerability
Nexi XPay Build — Verify the payment result supplied to several of its unauthenticated routes
Severity
high High risk
Affected Versions
<=7.6.2
CVE Reference
Patch Status
No patch
Source
NVD

Nexi XPay Build

high
Vulnerability
Nexi XPay Build — Correctly validate the security token on its payment notification route
Severity
high High risk
Affected Versions
<=7.6.2
CVE Reference
Patch Status
No patch
Source
NVD

HT Mega Addons for Elementor – Elementor Widgets & Template Builder

medium
Vulnerability
HT Mega Addons for Elementor – Elementor Widgets & Template Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Smart Slider 3

medium
Vulnerability
Smart Slider 3 — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.1.38
CVE Reference
Patch Status
No patch
Source
NVD

WP Directory Kit

medium
Vulnerability
WP Directory Kit — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.5.4
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Bold Page Builder

medium
Vulnerability
Bold Page Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.7.2
CVE Reference
Patch Status
No patch
Source
NVD

Viable URL Media Uploader

medium
Vulnerability
Viable URL Media Uploader — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ReactPress – Create React App for WordPress

medium
Vulnerability
ReactPress – Create React App for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Real Estate Manager – Property Listing and Agent Management

medium
Vulnerability
Real Estate Manager – Property Listing and Agent Management — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Newsletter – Send awesome emails from WordPress

medium
Vulnerability
Newsletter – Send awesome emails from WordPress — Insufficiently Protected Credentials
Severity
medium Medium risk
Affected Versions
<=9.3.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Simply Schedule Appointments

medium
Vulnerability
Simply Schedule Appointments — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=1.6.12.31
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Woo Labels – Product Labels & Badges for WooCommerce

medium
Vulnerability
Advanced Woo Labels – Product Labels & Badges for WooCommerce — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=2.51
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Popular Posts

medium
Vulnerability
WP Popular Posts — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=7.4.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Download Manager

medium
Vulnerability
Download Manager — Sufficiently sanitise and escape a package setting before outputting it back in a page
Severity
medium Medium risk
Affected Versions
<=3.3.71
CVE Reference
Patch Status
No patch
Source
NVD

If-So Dynamic Content

medium
Vulnerability
If-So Dynamic Content — Escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is ser
Severity
medium Medium risk
Affected Versions
<=1.10.2
CVE Reference
Patch Status
No patch
Source
NVD

Redux Framework

medium
Vulnerability
Redux Framework — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.5.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Fusion Lite

medium
Vulnerability
WP Fusion Lite — Perform a capability check on two of its admin AJAX handlers
Severity
medium Medium risk
Affected Versions
<=3.48.0
CVE Reference
Patch Status
No patch
Source
NVD

WP Fusion Lite

medium
Vulnerability
WP Fusion Lite — Require authentication on a settings handler that runs during admin initialization
Severity
medium Medium risk
Affected Versions
<=3.48.0
CVE Reference
Patch Status
No patch
Source
NVD

Payments for Hubtel

medium
Vulnerability
Payments for Hubtel — Verify that the requester is authorized to view an order before redirecting a public payment-callbac
Severity
medium Medium risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Payments for Hubtel

medium
Vulnerability
Payments for Hubtel — Verify that payment notifications received by its payment callback come from the payment provider
Severity
medium Medium risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Ad Inserter – Ad Manager & AdSense Ads

medium
Vulnerability
Ad Inserter – Ad Manager & AdSense Ads — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.8.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Social Media Share Buttons & Social Sharing Icons

medium
Vulnerability
Social Media Share Buttons & Social Sharing Icons — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More

medium
Vulnerability
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More — Reflected DOM-Based Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.5.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More

medium
Vulnerability
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More — Reflected DOM-Based Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.5.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

bbp style pack

medium
Vulnerability
bbp style pack — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.4.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Duplicate Post

medium
Vulnerability
Duplicate Post — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.5.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ad Inserter – Ad Manager & AdSense Ads

medium
Vulnerability
Ad Inserter – Ad Manager & AdSense Ads — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.8.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Redux Framework

medium
Vulnerability
Redux Framework — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.5.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Awesome Support – WordPress HelpDesk & Support Plugin

medium
Vulnerability
Awesome Support – WordPress HelpDesk & Support Plugin — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns

medium
Vulnerability
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.4.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Prime Mover

medium
Vulnerability
Prime Mover — Authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR packa
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Prime Mover

medium
Vulnerability
Prime Mover — Attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tabs Responsive

medium
Vulnerability
Tabs Responsive — Sanitize the content of WooCommerce product tabs before storing and rendering it
Severity
medium Medium risk
Affected Versions
<=2.5
CVE Reference
Patch Status
No patch
Source
NVD

Autoptimize

medium
Vulnerability
Autoptimize — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.15.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Paytm Payment Gateway

medium
Vulnerability
Paytm Payment Gateway — Verify that payment callbacks genuinely originate from the payment provider when its secret key has
Severity
medium Medium risk
Affected Versions
<=2.8.9
CVE Reference
Patch Status
No patch
Source
NVD

Popup Maker

medium
Vulnerability
Popup Maker — Perform a capability check on one of its account-connection actions
Severity
medium Medium risk
Affected Versions
<=1.4.5
CVE Reference
Patch Status
No patch
Source
NVD

Unlimited Elements for Elementor

medium
Vulnerability
Unlimited Elements for Elementor — Escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter p
Severity
medium Medium risk
Affected Versions
<=2.0.21
CVE Reference
Patch Status
No patch
Source
NVD

Request a Quote

medium
Vulnerability
Request a Quote — Perform an authorization check on one of its unauthenticated AJAX handlers
Severity
medium Medium risk
Affected Versions
<=2.5.6
CVE Reference
Patch Status
No patch
Source
NVD

Motors

medium
Vulnerability
Motors — Sanitise and escape a listing badge setting before outputting it inside an HTML attribute
Severity
medium Medium risk
Affected Versions
<=1.4.124
CVE Reference
Patch Status
No patch
Source
NVD

BuildKit

medium
Vulnerability
BuildKit — Properly sanitise and escape data submitted by contributor-level users before storing it and later u
Severity
medium Medium risk
Affected Versions
<=1.0.29
CVE Reference
Patch Status
No patch
Source
NVD

Giveaways and Contests by RafflePress

medium
Vulnerability
Giveaways and Contests by RafflePress — Remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages
Severity
medium Medium risk
Affected Versions
<=1.12.27
CVE Reference
Patch Status
No patch
Source
NVD

Giveaways and Contests by RafflePress

medium
Vulnerability
Giveaways and Contests by RafflePress — Properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it
Severity
medium Medium risk
Affected Versions
<=1.12.27
CVE Reference
Patch Status
No patch
Source
NVD

CMP – Coming Soon & Maintenance

medium
Vulnerability
CMP – Coming Soon & Maintenance — Correctly restrict access to the site while maintenance/coming-soon mode is enabled
Severity
medium Medium risk
Affected Versions
<=4.1.20
CVE Reference
Patch Status
No patch
Source
NVD

WP Mail Logging

medium
Vulnerability
WP Mail Logging — Properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens
Severity
medium Medium risk
Affected Versions
<=1.17.0
CVE Reference
Patch Status
No patch
Source
NVD

WP User Frontend

medium
Vulnerability
WP User Frontend — Enforce its subscription-purchase requirement in one of its post-creation handlers
Severity
medium Medium risk
Affected Versions
<=4.3.12
CVE Reference
Patch Status
No patch
Source
NVD

Events Calendar

medium
Vulnerability
Events Calendar — Validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its ren
Severity
medium Medium risk
Affected Versions
<=6.17.5.1
CVE Reference
Patch Status
No patch
Source
NVD

Popup Maker WP

medium
Vulnerability
Popup Maker WP — Perform authorization checks on several of its actions and exposes its management page to any logged
Severity
medium Medium risk
Affected Versions
<=1.4.5
CVE Reference
Patch Status
No patch
Source
NVD

WP Edit Password Protected

medium
Vulnerability
WP Edit Password Protected — Enforce its site-wide access restriction on the WordPress REST API
Severity
medium Medium risk
Affected Versions
<=2.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Easy PayPal & Stripe Buy Now Button

medium
Vulnerability
Easy PayPal & Stripe Buy Now Button — Derive the payment amount on the server
Severity
medium Medium risk
Affected Versions
<=2.0.6
CVE Reference
Patch Status
No patch
Source
NVD

WebToffee Gift Cards for WooCommerce

medium
Vulnerability
WebToffee Gift Cards for WooCommerce — Validate a user-supplied gift card amount server-side before using it as the cart-item price and sto
Severity
medium Medium risk
Affected Versions
<=1.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Unlimited Elements for Elementor

medium
Vulnerability
Unlimited Elements for Elementor — Check that a request to render widget output comes from a user allowed to make it
Severity
medium Medium risk
Affected Versions
<=2.0.21
CVE Reference
Patch Status
No patch
Source
NVD

MStore API

medium
Vulnerability
MStore API — Restrict which fields of an order a customer may update
Severity
medium Medium risk
Affected Versions
<=4.22.1
CVE Reference
Patch Status
No patch
Source
NVD

Dc Woocommerce Multi Vendor

medium
Vulnerability
Dc Woocommerce Multi Vendor — SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.0.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Greenshift – animation and page builder blocks

medium
Vulnerability
Greenshift – animation and page builder blocks — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=13.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

medium
Vulnerability
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=5.7.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Listdom: AI-powered Business Directory with Classifieds Ads Listings

medium
Vulnerability
Listdom: AI-powered Business Directory with Classifieds Ads Listings — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=6.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Download Manager

medium
Vulnerability
Download Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.70
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Event Tickets and Registration

medium
Vulnerability
Event Tickets and Registration — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.29.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

medium
Vulnerability
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) — DOM-Based Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.0.1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Statistics – Simple, privacy-friendly Google Analytics alternative

medium
Vulnerability
WP Statistics – Simple, privacy-friendly Google Analytics alternative — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=14.16.14
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

All in One SEO

medium
Vulnerability
All in One SEO — Correctly determine which shortcodes are present in content derived from user input before deciding
Severity
medium Medium risk
Affected Versions
<=5.0.2.1
CVE Reference
Patch Status
No patch
Source
NVD

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

medium
Vulnerability
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.2.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ivory Search – WordPress Search Plugin

medium
Vulnerability
Ivory Search – WordPress Search Plugin — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.5.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent

medium
Vulnerability
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent

medium
Vulnerability
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=3.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Beaver Builder Page Builder – Drag and Drop Website Builder

medium
Vulnerability
Beaver Builder Page Builder – Drag and Drop Website Builder — Blind SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.11.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

medium
Vulnerability
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — Reflected DOM-Based Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.4.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

medium
Vulnerability
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.17.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents

medium
Vulnerability
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.6.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

EWWW Image Optimizer

medium
Vulnerability
EWWW Image Optimizer — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=8.7.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultra Addons Lite for Elementor

medium
Vulnerability
Ultra Addons Lite for Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.3.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Rich Showcase for Google Reviews

medium
Vulnerability
Rich Showcase for Google Reviews — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons

medium
Vulnerability
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=4.7.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

medium
Vulnerability
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Ultimate Review

medium
Vulnerability
WP Ultimate Review — Escape some of its review overview settings before outputting them in posts
Severity
medium Medium risk
Affected Versions
<=2.4.4
CVE Reference
Patch Status
No patch
Source
NVD

SEOPress – AI SEO Plugin & On-site SEO

medium
Vulnerability
SEOPress – AI SEO Plugin & On-site SEO — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=10.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MPG

medium
Vulnerability
MPG — Validate that the dataset source supplied when importing a project is a remote URL before treating i
Severity
medium Medium risk
Affected Versions
<=4.2.3
CVE Reference
Patch Status
No patch
Source
NVD

WPC Smart Quick View for WooCommerce

medium
Vulnerability
WPC Smart Quick View for WooCommerce — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.4.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More

medium
Vulnerability
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More — Reflected DOM-Based Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=5.5.1.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Helpdesk Support Ticket System for WooCommerce

medium
Vulnerability
Helpdesk Support Ticket System for WooCommerce — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=2.1.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Unlimited Elements for Elementor

medium
Vulnerability
Unlimited Elements for Elementor — Sanitise file paths inside uploaded archives before extracting them
Severity
medium Medium risk
Affected Versions
<=2.0.21
CVE Reference
Patch Status
No patch
Source
NVD

Unlimited Elements for Elementor

medium
Vulnerability
Unlimited Elements for Elementor — Correctly handle a search value before rewriting an already prepared SQL statement
Severity
medium Medium risk
Affected Versions
<=2.0.21
CVE Reference
Patch Status
No patch
Source
NVD

MetForm

medium
Vulnerability
MetForm — Properly restrict access to form submission data
Severity
medium Medium risk
Affected Versions
<=4.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Kubio AI Page Builder

medium
Vulnerability
Kubio AI Page Builder — Validate the URI scheme of a user-supplied value before outputting it as a link target
Severity
medium Medium risk
Affected Versions
<=2.9.3
CVE Reference
Patch Status
No patch
Source
NVD

Alt Text AI – Automatically generate image alt text for SEO and accessibility

medium
Vulnerability
Alt Text AI – Automatically generate image alt text for SEO and accessibility — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.10.41
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mailchimp for WooCommerce

medium
Vulnerability
Mailchimp for WooCommerce — Require authentication
Severity
medium Medium risk
Affected Versions
<=6.3
CVE Reference
Patch Status
No patch
Source
NVD

Unlimited Elements for Elementor

medium
Vulnerability
Unlimited Elements for Elementor — Sanitise and escape a parameter before using it in a SQL statement
Severity
medium Medium risk
Affected Versions
<=2.0.21
CVE Reference
Patch Status
No patch
Source
NVD

Loco Translate

medium
Vulnerability
Loco Translate — Restrict which file paths its translation file routes will read
Severity
medium Medium risk
Affected Versions
<=2.8.9
CVE Reference
Patch Status
No patch
Source
NVD

Loco Translate

medium
Vulnerability
Loco Translate — Sanitise and escape some bundle configuration values before outputting them back in an admin page
Severity
medium Medium risk
Affected Versions
<=2.8.9
CVE Reference
Patch Status
No patch
Source
NVD

Wp Social Login and Register Social Counter

medium
Vulnerability
Wp Social Login and Register Social Counter — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The WP Ultimate Review

medium
Vulnerability
The WP Ultimate Review — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=2.4.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPMobile.App – Android and iOS App Builder

medium
Vulnerability
WPMobile.App – Android and iOS App Builder — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=11.84
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The WP Ultimate Review

medium
Vulnerability
The WP Ultimate Review — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=2.4.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPC Estimated Delivery Date for WooCommerce

medium
Vulnerability
WPC Estimated Delivery Date for WooCommerce — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.0.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System

medium
Vulnerability
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=3.0.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Responsive Plus – Elementor Templates & Starter Sites

medium
Vulnerability
Responsive Plus – Elementor Templates & Starter Sites — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Photo Gallery by 10Web – Mobile-Friendly Image Gallery

medium
Vulnerability
Photo Gallery by 10Web – Mobile-Friendly Image Gallery — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.8.46
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPFront Notification Bar

medium
Vulnerability
WPFront Notification Bar — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)

medium
Vulnerability
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) — Improper Authentication leading to Account Persistence
Severity
medium Medium risk
Affected Versions
<=3.7.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Twenty20 Image Before-After

medium
Vulnerability
Twenty20 Image Before-After — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.0.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Razorpay for WooCommerce

medium
Vulnerability
Razorpay for WooCommerce — Perform ownership or authorization checks on a REST API route used during checkout
Severity
medium Medium risk
Affected Versions
<=4.8.8
CVE Reference
Patch Status
No patch
Source
NVD

Horizontal scrolling announcements

medium
Vulnerability
Horizontal scrolling announcements — Sanitise and escape one of its announcement settings before outputting it into an attribute context
Severity
medium Medium risk
Affected Versions
<=2.6
CVE Reference
Patch Status
No patch
Source
NVD

Five Star Business Profile and Schema

medium
Vulnerability
Five Star Business Profile and Schema — Properly restrict the callbacks used to resolve schema field default values
Severity
medium Medium risk
Affected Versions
<=2.4.0
CVE Reference
Patch Status
No patch
Source
NVD

User Private Files

medium
Vulnerability
User Private Files — Properly protect its stored private files on multisite installations
Severity
medium Medium risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD

File Uploads Addon for WooCommerce

medium
Vulnerability
File Uploads Addon for WooCommerce — CVE-2026-13607
Severity
medium Medium risk
Affected Versions
<=1.7.6
CVE Reference
Patch Status
No patch
Source
NVD

File Uploads Addon for WooCommerce

medium
Vulnerability
File Uploads Addon for WooCommerce — Verify that the person requesting a customer-uploaded file is the customer who uploaded it
Severity
medium Medium risk
Affected Versions
<=1.7.6
CVE Reference
Patch Status
No patch
Source
NVD

UPI QR Code Payment Gateway

medium
Vulnerability
UPI QR Code Payment Gateway — Verify that a payment-confirmation request actually belongs to the order and customer it claims to c
Severity
medium Medium risk
Affected Versions
<=1.4.3
CVE Reference
Patch Status
No patch
Source
NVD

AI Chatbot for WordPress – Hyve Lite

medium
Vulnerability
AI Chatbot for WordPress – Hyve Lite — Exploiting Incorrectly Configured Access Control Security Levels
Severity
medium Medium risk
Affected Versions
<=2.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Slider Pro

medium
Vulnerability
Slider Pro — Perform any capability or authorisation check on one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Fast Courier

medium
Vulnerability
Fast Courier — Restrict an unauthenticated REST route that writes order fulfillment data
Severity
medium Medium risk
Affected Versions
<=5.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Deema Payment Gateway

medium
Vulnerability
Deema Payment Gateway — Verify the authenticity of incoming payment provider notifications
Severity
medium Medium risk
Affected Versions
<=1.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Deema Payment Gateway

medium
Vulnerability
Deema Payment Gateway — Verify the payment with the payment provider when handling the return from the hosted checkout
Severity
medium Medium risk
Affected Versions
<=1.1.2
CVE Reference
Patch Status
No patch
Source
NVD

File Media Renamer

medium
Vulnerability
File Media Renamer — Verify that the requesting user is authorised to modify a given media attachment
Severity
medium Medium risk
Affected Versions
<=1.3
CVE Reference
Patch Status
No patch
Source
NVD

elegro Crypto Payment

medium
Vulnerability
elegro Crypto Payment — Require a shared secret to be configured before trusting incoming payment notification requests
Severity
medium Medium risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD

WordPress

medium
Vulnerability
WordPress — CVE-2026-66666
Severity
medium Medium risk
Affected Versions
<=7.1.2
CVE Reference
Patch Status
No patch
Source
NVD

Integration for Epos Now and WooCommerce

medium
Vulnerability
Integration for Epos Now and WooCommerce — Perform an authorization check on one of its REST endpoints
Severity
medium Medium risk
Affected Versions
<=4.11.2
CVE Reference
Patch Status
No patch
Source
NVD

Geliver Akıllı Kargo Pazaryeri

medium
Vulnerability
Geliver Akıllı Kargo Pazaryeri — Prevent unauthenticated access to a log file it stores within its own web-accessible directory
Severity
medium Medium risk
Affected Versions
<=3.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Frontend Dashboard

medium
Vulnerability
Frontend Dashboard — Perform a capability check in one of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=3.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Academy LMS

medium
Vulnerability
Academy LMS — Verify course enrollment or object ownership when returning a lesson's content through one of its RE
Severity
medium Medium risk
Affected Versions
<=4.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Academy LMS

medium
Vulnerability
Academy LMS — Verify that a quiz question belongs to the course the requesting user is authorized to access before
Severity
medium Medium risk
Affected Versions
<=4.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Yaad Sarig Payment Gateway For WC

medium
Vulnerability
Yaad Sarig Payment Gateway For WC — Verify authorization or that the requesting user owns the target order in several of its order payme
Severity
medium Medium risk
Affected Versions
<=2.2.13
CVE Reference
Patch Status
No patch
Source
NVD

Envira Gallery

medium
Vulnerability
Envira Gallery — Sanitise and escape a gallery item identifier before outputting it in an image tag attribute
Severity
medium Medium risk
Affected Versions
<=1.16.1
CVE Reference
Patch Status
No patch
Source
NVD

Envira Gallery

medium
Vulnerability
Envira Gallery — Sanitise or escape user-supplied gallery display configuration values before storing them and output
Severity
medium Medium risk
Affected Versions
<=1.16.1
CVE Reference
Patch Status
No patch
Source
NVD

Animated Number Counters

medium
Vulnerability
Animated Number Counters — Sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query t
Severity
medium Medium risk
Affected Versions
<=3.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Coder

medium
Vulnerability
WP Coder — Restrict access to its PHP code-execution feature to administrators
Severity
medium Medium risk
Affected Versions
<=4.5.2
CVE Reference
Patch Status
No patch
Source
NVD

CP Media Player

medium
Vulnerability
CP Media Player — Perform a capability check on its settings-page handler
Severity
medium Medium risk
Affected Versions
<=1.3.4
CVE Reference
Patch Status
No patch
Source
NVD

MPG

medium
Vulnerability
MPG — Properly validate the structure of imported project data before using it in a database query
Severity
medium Medium risk
Affected Versions
<=4.2.3
CVE Reference
Patch Status
No patch
Source
NVD

Magee Shortcodes

medium
Vulnerability
Magee Shortcodes — Sanitise and escape user input in some of its AJAX actions
Severity
medium Medium risk
Affected Versions
<=2.1.1
CVE Reference
Patch Status
No patch
Source
NVD

Magee Shortcodes

medium
Vulnerability
Magee Shortcodes — Restrict the recipient of some of its unauthenticated contact-form actions
Severity
medium Medium risk
Affected Versions
<=2.1.1
CVE Reference
Patch Status
No patch
Source
NVD

WPCafe

medium
Vulnerability
WPCafe — Restrict access to some of its REST API endpoints
Severity
medium Medium risk
Affected Versions
<=3.0.21
CVE Reference
Patch Status
No patch
Source
NVD

MetForm

medium
Vulnerability
MetForm — Sanitize or escape submitted form-field values before inserting them into the HTML body of its email
Severity
medium Medium risk
Affected Versions
<=4.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Koinonia Link

medium
Vulnerability
Koinonia Link — Check that a user is allowed to change roles before saving a role selection submitted with a profile
Severity
medium Medium risk
Affected Versions
<=1.1.5
CVE Reference
Patch Status
No patch
Source
NVD

If-So Dynamic Content

medium
Vulnerability
If-So Dynamic Content — Validate the URL scheme of a request-supplied value before reflecting it into a link on an admin pag
Severity
medium Medium risk
Affected Versions
<=1.10.2
CVE Reference
Patch Status
No patch
Source
NVD

Optimole

medium
Vulnerability
Optimole — Perform a capability check before exposing its stored image-optimization account data in a dashboard
Severity
medium Medium risk
Affected Versions
<=4.2.15
CVE Reference
Patch Status
No patch
Source
NVD

String locator

medium
Vulnerability
String locator — Restrict the classes allowed when deserializing the content of a database row saved through its data
Severity
medium Medium risk
Affected Versions
<=2.6.8
CVE Reference
Patch Status
No patch
Source
NVD

User Private Files

medium
Vulnerability
User Private Files — Validate that a supplied user belongs to the document being operated on before returning that user's
Severity
medium Medium risk
Affected Versions
<=2.1.9
CVE Reference
Patch Status
No patch
Source
NVD

PowerPress Podcasting plugin by Blubrry

medium
Vulnerability
PowerPress Podcasting plugin by Blubrry — Validate the destination of redirects when fetching a user-supplied media URL
Severity
medium Medium risk
Affected Versions
<=11.17.11
CVE Reference
Patch Status
No patch
Source
NVD

If-So Dynamic Content

low
Vulnerability
If-So Dynamic Content — Sanitize a conversion name before storing it
Severity
low Low risk
Affected Versions
<=1.10.2
CVE Reference
Patch Status
No patch
Source
NVD

Motors

low
Vulnerability
Motors — Properly verify that a user is authorised to modify a listing before processing one of its listing m
Severity
low Low risk
Affected Versions
<=1.4.124
CVE Reference
Patch Status
No patch
Source
NVD

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

low
Vulnerability
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE — Sensitive Information Exposure
Severity
low Low risk
Affected Versions
<=3.2.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Ultimate CSV Importer

low
Vulnerability
WP Ultimate CSV Importer — Properly validate the file types contained in an uploaded archive nor sanitise their content before
Severity
low Low risk
Affected Versions
<=9.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Ultimate CSV Importer

low
Vulnerability
WP Ultimate CSV Importer — Use a site-specific secret when deriving the storage location of the import logs it writes under the
Severity
low Low risk
Affected Versions
<=9.2
CVE Reference
Patch Status
No patch
Source
NVD

MetForm

low
Vulnerability
MetForm — Properly restrict access to a debug file it writes to the web root on every form submission when its
Severity
low Low risk
Affected Versions
<=4.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Pie Register

low
Vulnerability
Pie Register — Restrict access to an invitation-code report
Severity
low Low risk
Affected Versions
<=3.8.4.14
CVE Reference
Patch Status
No patch
Source
NVD

Simple Shopping Cart

low
Vulnerability
Simple Shopping Cart — Escape some of its settings field values before outputting them on an admin settings page
Severity
low Low risk
Affected Versions
<=5.2.6
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (3)

Subscriber Privilege Escalation in JobZilla - Job Board

high
Vulnerability
Subscriber Privilege Escalation in JobZilla - Job Board — CVE-2026-39775
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Avada | Website Builder For WordPress & WooCommerce

medium
Vulnerability
Avada | Website Builder For WordPress & WooCommerce — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=7.16.1
CVE Reference
Patch Status
No patch
Source
NVD

Shop manager Content Injection in Astra

low
Vulnerability
Shop manager Content Injection in Astra — CVE-2026-27085
Severity
low Low risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: September 29 – October 6, 2026

249 WordPress vulnerabilities disclosed between September 29 – October 6, 2026. 13 critical, 89 high severity. 0 patched, 249 unpatched.

WPSentry·Oct 6, 2026
Vulnerability Report

WordPress Vulnerability Report: September 28 – October 5, 2026

242 WordPress vulnerabilities disclosed between September 28 – October 5, 2026. 13 critical, 88 high severity. 0 patched, 242 unpatched.

WPSentry·Oct 5, 2026
Vulnerability Report

WordPress Vulnerability Report: September 27 – October 4, 2026

247 WordPress vulnerabilities disclosed between September 27 – October 4, 2026. 13 critical, 88 high severity. 0 patched, 247 unpatched.

WPSentry·Oct 4, 2026
Back to Blog