BlogVulnerability Report
Vulnerability Report

WordPress Vulnerability Report: September 6 – September 13, 2026

203 WordPress vulnerabilities disclosed between September 6 – September 13, 2026. 16 critical, 53 high severity. 0 patched, 203 unpatched.

WPSentrySeptember 13, 202644 min read

During the reporting period (September 6 – September 13, 2026), 203 WordPress security vulnerabilities were disclosed across plugins, themes, and core. This report aggregates data from the NIST National Vulnerability Database, Wordfence Intelligence, and our own scanning database.

Summary

203
Total
16
Critical
53
High
128
Medium
6
Low
0
Patched
Table of Contents 208 plugins & components

WordPress Plugin Vulnerabilities (203)

Drag and Drop File Upload for Elementor Forms

critical
Vulnerability
Drag and Drop File Upload for Elementor Forms — Arbitrary File Upload
Severity
critical Critical risk
Affected Versions
<=1.6.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

miniOrange 2FA

critical
Vulnerability
miniOrange 2FA — Require a validated transaction before deleting site options whose names come from unauthenticated r
Severity
critical Critical risk
Affected Versions
<=6.3.1
CVE Reference
Patch Status
No patch
Source
NVD

zipMoney(Zip Co) Payments Plugin for WooCommerce

critical
Vulnerability
zipMoney(Zip Co) Payments Plugin for WooCommerce — Perform any authorisation checks on one of its front-end request handlers
Severity
critical Critical risk
Affected Versions
<=2.4.0
CVE Reference
Patch Status
No patch
Source
NVD

MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields.

critical
Vulnerability
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. — Arbitrary file uploads
Severity
critical Critical risk
Affected Versions
<=1.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

teddy-bear-customize-addon

critical
Vulnerability
teddy-bear-customize-addon — Verify a user's password before authenticating them
Severity
critical Critical risk
Affected Versions
<=1.0.5
CVE Reference
Patch Status
No patch
Source
NVD

teddy-bear-customize-addon

critical
Vulnerability
teddy-bear-customize-addon — Properly validate uploaded files
Severity
critical Critical risk
Affected Versions
<=1.0.5
CVE Reference
Patch Status
No patch
Source
NVD

advanced-customized-prompts

critical
Vulnerability
advanced-customized-prompts — Verify the password before issuing an authenticated session for a supplied email address in an unaut
Severity
critical Critical risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Frontegg SAML SSO

critical
Vulnerability
Frontegg SAML SSO — Verify the signature or issuer of SAML authentication responses before establishing a session
Severity
critical Critical risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD

CODE MONKEYS PROPOSALS

critical
Vulnerability
CODE MONKEYS PROPOSALS — Validate a user-supplied file path before deleting a file
Severity
critical Critical risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD

WebTotem Backups

critical
Vulnerability
WebTotem Backups — Validate a user-supplied file path
Severity
critical Critical risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD

DS Ad Rotator

critical
Vulnerability
DS Ad Rotator — Perform any capability check
Severity
critical Critical risk
Affected Versions
<=0.8
CVE Reference
Patch Status
No patch
Source
NVD

Masteriyo LMS

critical
Vulnerability
Masteriyo LMS — Prevent user-supplied values held as metadata from being deserialized when they are read back
Severity
critical Critical risk
Affected Versions
<=3.4.1
CVE Reference
Patch Status
No patch
Source
NVD

WP images upload on piclect

critical
Vulnerability
WP images upload on piclect — Validate the name or type of uploaded files before writing them to a publicly accessible directory
Severity
critical Critical risk
Affected Versions
<=1.0
CVE Reference
Patch Status
No patch
Source
NVD

WP Component

critical
Vulnerability
WP Component — Have any capability or nonce checks on one of the actions it makes available to unauthenticated user
Severity
critical Critical risk
Affected Versions
<=2.2.4
CVE Reference
Patch Status
No patch
Source
NVD

The Events Calendar

critical
Vulnerability
The Events Calendar — Remote Code Execution
Severity
critical Critical risk
Affected Versions
<=6.17.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Events Calendar

critical
Vulnerability
The Events Calendar — Remote Code Execution
Severity
critical Critical risk
Affected Versions
<=6.17.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

high
Vulnerability
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.15.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Fusion (Pro)

high
Vulnerability
WP Fusion (Pro) — Privilege Escalation
Severity
high High risk
Affected Versions
<=3.47.13
CVE Reference
Patch Status
No patch
Source
NVD

EDD Product Catalog Feed by PixelYourSite

high
Vulnerability
EDD Product Catalog Feed by PixelYourSite — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Live Composer – Free WordPress Website Builder

high
Vulnerability
Live Composer – Free WordPress Website Builder — PHP Object Injection
Severity
high High risk
Affected Versions
<=2.1.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Event Tickets and Registration

high
Vulnerability
Event Tickets and Registration — Unauthorized modification of data
Severity
high High risk
Affected Versions
<=5.27.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Contact Form to DB by BestWebSoft – Messages Database

high
Vulnerability
Contact Form to DB by BestWebSoft – Messages Database — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.7.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

high
Vulnerability
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) — Local File Inclusion
Severity
high High risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

high
Vulnerability
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) — Local File Inclusion
Severity
high High risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment

high
Vulnerability
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment — Remote Code Execution
Severity
high High risk
Affected Versions
<=3.1.10
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP EasyCart

high
Vulnerability
WP EasyCart — Privilege escalation
Severity
high High risk
Affected Versions
<=5.9.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Repeater Fields for Gravity Forms

high
Vulnerability
Repeater Fields for Gravity Forms — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=3.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

ELEX WooCommerce Request a Quote

high
Vulnerability
ELEX WooCommerce Request a Quote — Properly sanitise and escape a parameter before using it in a SQL query
Severity
high High risk
Affected Versions
<=2.4.1
CVE Reference
Patch Status
No patch
Source
NVD

Loops & Logic

high
Vulnerability
Loops & Logic — Restrict its public template-data action to the data a visitor is permitted to see
Severity
high High risk
Affected Versions
<=4.3.0
CVE Reference
Patch Status
No patch
Source
NVD

Next-Cart Store to WooCommerce Migration

high
Vulnerability
Next-Cart Store to WooCommerce Migration — Authentication Bypass
Severity
high High risk
Affected Versions
<=3.9.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

high
Vulnerability
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=8.7.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Quentn WP

high
Vulnerability
Quentn WP — Adequately escape a request parameter before using it in an unprepared SQL query
Severity
high High risk
Affected Versions
<=1.2.15
CVE Reference
Patch Status
No patch
Source
NVD

PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus

high
Vulnerability
PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus — Privilege Escalation
Severity
high High risk
Affected Versions
<=2.50.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

YITH WooCommerce Waitlist Premium

high
Vulnerability
YITH WooCommerce Waitlist Premium — Privilege Escalation
Severity
high High risk
Affected Versions
<=3.35.0
CVE Reference
Patch Status
No patch
Source
NVD

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent

high
Vulnerability
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=4.4.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bulk Password Reset

high
Vulnerability
Bulk Password Reset — Privilege escalation
Severity
high High risk
Affected Versions
<=1.3.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Direct Download for WooCommerce

high
Vulnerability
Direct Download for WooCommerce — Directory Traversal
Severity
high High risk
Affected Versions
<=1.19
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Sidebar Manager Light

high
Vulnerability
Sidebar Manager Light — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=1.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultimate Gift Cards for WooCommerce

high
Vulnerability
Ultimate Gift Cards for WooCommerce — Reconcile the value of the gift card coupon it issues against the amount actually collected at check
Severity
high High risk
Affected Versions
<=3.2.10
CVE Reference
Patch Status
No patch
Source
NVD

Ultimate Gift Cards for WooCommerce

high
Vulnerability
Ultimate Gift Cards for WooCommerce — Have any authorisation check when displaying gift card details
Severity
high High risk
Affected Versions
<=3.2.10
CVE Reference
Patch Status
No patch
Source
NVD

miniOrange 2FA

high
Vulnerability
miniOrange 2FA — Scope its second-factor attempt limit to the account being attacked
Severity
high High risk
Affected Versions
<=6.3.1
CVE Reference
Patch Status
No patch
Source
NVD

Registration Form for WooCommerce

high
Vulnerability
Registration Form for WooCommerce — Validate that the form referenced during registration is a legitimate registration form
Severity
high High risk
Affected Versions
<=1.1.3
CVE Reference
Patch Status
No patch
Source
NVD

Site Reviews

high
Vulnerability
Site Reviews — Prevent request data from being deserialized
Severity
high High risk
Affected Versions
<=8.3.0
CVE Reference
Patch Status
No patch
Source
NVD

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

high
Vulnerability
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress — Directory Traversal
Severity
high High risk
Affected Versions
<=11.0.4
CVE Reference
Patch Status
No patch
Source
NVD

Sticky Chat Widget

high
Vulnerability
Sticky Chat Widget — SQL Injection
Severity
high High risk
Affected Versions
<=1.4.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Unlimited Elements For Elementor

high
Vulnerability
Unlimited Elements For Elementor — SQL Injection
Severity
high High risk
Affected Versions
<=2.0.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Photo Album Plus

high
Vulnerability
WP Photo Album Plus — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=9.2.08.003
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

UsersWP

high
Vulnerability
UsersWP — Arbitrary File Deletion
Severity
high High risk
Affected Versions
<=1.2.70
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…

high
Vulnerability
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=2.10.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Simple Ajax Chat – Add a Fast, Secure Chat Box

high
Vulnerability
Simple Ajax Chat – Add a Fast, Secure Chat Box — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MultiVendorX

high
Vulnerability
MultiVendorX — Restrict who can update its role and capability settings
Severity
high High risk
Affected Versions
<=5.0.16
CVE Reference
Patch Status
No patch
Source
NVD

Gutenverse News

high
Vulnerability
Gutenverse News — Restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for
Severity
high High risk
Affected Versions
<=3.3.3
CVE Reference
Patch Status
No patch
Source
NVD

Kirki – Freeform Page Builder, Website Builder & Customizer

high
Vulnerability
Kirki – Freeform Page Builder, Website Builder & Customizer — Stored Cross-Site Scripting
Severity
high High risk
Affected Versions
<=6.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Booking for Appointments and Events Calendar

high
Vulnerability
Booking for Appointments and Events Calendar — Verify that the user editing a customer or employee record is entitled to modify the WordPress accou
Severity
high High risk
Affected Versions
<=2.4.10
CVE Reference
Patch Status
No patch
Source
NVD

Temporary Login Without Password

high
Vulnerability
Temporary Login Without Password — Verify that the user requesting a temporary login holds network super admin rights before granting t
Severity
high High risk
Affected Versions
<=1.9.9
CVE Reference
Patch Status
No patch
Source
NVD

SAMO Forms

high
Vulnerability
SAMO Forms — Properly sanitise and escape user input before using it in SQL queries in several unauthenticated ac
Severity
high High risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Yogeta WP Cloud

high
Vulnerability
Yogeta WP Cloud — Validate a user-supplied file path before passing it to a file-read function on a public endpoint th
Severity
high High risk
Affected Versions
<=1.0
CVE Reference
Patch Status
No patch
Source
NVD

Gpx2Graphics

high
Vulnerability
Gpx2Graphics — Perform a CSRF check when handling file uploads
Severity
high High risk
Affected Versions
<=0.3
CVE Reference
Patch Status
No patch
Source
NVD

Export & Import WPBakery Page Builder

high
Vulnerability
Export & Import WPBakery Page Builder — Perform any CSRF check on its template-import feature and does not sanitise the imported data before
Severity
high High risk
Affected Versions
<=1.0.2
CVE Reference
Patch Status
No patch
Source
NVD

BE REST Endpoints

high
Vulnerability
BE REST Endpoints — Perform any authorization check before
Severity
high High risk
Affected Versions
<=1.0.0
CVE Reference
Patch Status
No patch
Source
NVD

Album Cover Finder

high
Vulnerability
Album Cover Finder — Properly sanitize and escape a parameter before using it in a SQL query
Severity
high High risk
Affected Versions
<=0.7.0
CVE Reference
Patch Status
No patch
Source
NVD

wpstorecart

high
Vulnerability
wpstorecart — Prevent direct
Severity
high High risk
Affected Versions
<=5.0.7
CVE Reference
Patch Status
No patch
Source
NVD

Add User Autocomplete

high
Vulnerability
Add User Autocomplete — Perform any capability or nonce check before creating a pending site-membership invitation carrying
Severity
high High risk
Affected Versions
<=1.2
CVE Reference
Patch Status
No patch
Source
NVD

Zonify

high
Vulnerability
Zonify — Perform any capability or authentication check before returning the site's stored account login toke
Severity
high High risk
Affected Versions
<=1.0.5
CVE Reference
Patch Status
No patch
Source
NVD

YayPricing

high
Vulnerability
YayPricing — Perform an authorization check on a REST route that saves its pricing rules
Severity
high High risk
Affected Versions
<=3.5.7
CVE Reference
Patch Status
No patch
Source
NVD

rtMedia for WordPress, BuddyPress and bbPress

high
Vulnerability
rtMedia for WordPress, BuddyPress and bbPress — Time-based blind SQL Injection
Severity
high High risk
Affected Versions
<=4.7.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Tutor LMS – eLearning and online course solution

high
Vulnerability
Tutor LMS – eLearning and online course solution — PHP Object Injection
Severity
high High risk
Affected Versions
<=4.0.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

GEO my WP

high
Vulnerability
GEO my WP — Local File Inclusion
Severity
high High risk
Affected Versions
<=4.5.5.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MemberPress Corporate Accounts

high
Vulnerability
MemberPress Corporate Accounts — Privilege Escalation
Severity
high High risk
Affected Versions
<=1.5.39
CVE Reference
Patch Status
No patch
Source
NVD

JetFormBuilder

medium
Vulnerability
JetFormBuilder — Sanitize a request parameter before rendering it as message content
Severity
medium Medium risk
Affected Versions
<=3.6.5.2
CVE Reference
Patch Status
No patch
Source
NVD

JetFormBuilder

medium
Vulnerability
JetFormBuilder — Validate or strip line breaks from address values it sources from submitted form fields before addin
Severity
medium Medium risk
Affected Versions
<=3.6.5.2
CVE Reference
Patch Status
No patch
Source
NVD

Ninja Forms

medium
Vulnerability
Ninja Forms — Prevent shortcodes in request-derived values from being executed when it substitutes them into conte
Severity
medium Medium risk
Affected Versions
<=3.15.2
CVE Reference
Patch Status
No patch
Source
NVD

Redirection for Contact Form 7

medium
Vulnerability
Redirection for Contact Form 7 — Prevent shortcodes in submitted form values from being executed when it substitutes those values int
Severity
medium Medium risk
Affected Versions
<=3.2.11
CVE Reference
Patch Status
No patch
Source
NVD

Powerkit

medium
Vulnerability
Powerkit — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Flamingo

medium
Vulnerability
Flamingo — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.6.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

medium
Vulnerability
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=3.1.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Masteriyo LMS

medium
Vulnerability
Masteriyo LMS — Unauthorized data deletion
Severity
medium Medium risk
Affected Versions
<=2.2.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter

medium
Vulnerability
The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=5.9.27
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

medium
Vulnerability
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.3.9.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPML Multilingual CMS

medium
Vulnerability
WPML Multilingual CMS — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.9.5
CVE Reference
Patch Status
No patch
Source
NVD

The Beaver Builder Page Builder – Drag and Drop Website Builder

medium
Vulnerability
The Beaver Builder Page Builder – Drag and Drop Website Builder — Arbitrary shortcode execution
Severity
medium Medium risk
Affected Versions
<=2.10.3.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Online Scheduling and Appointment Booking System – Bookly

medium
Vulnerability
Online Scheduling and Appointment Booking System – Bookly — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=27.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Zephyr Project Manager

medium
Vulnerability
Zephyr Project Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.3.205
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Event Solution (Eventin)

medium
Vulnerability
WP Event Solution (Eventin) — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Graphina – Charts and Graphs For Elementor

medium
Vulnerability
Graphina – Charts and Graphs For Elementor — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.1.11
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms – The Contact Form Builder That Grows With You

medium
Vulnerability
Ninja Forms – The Contact Form Builder That Grows With You — PHP Object Injection
Severity
medium Medium risk
Affected Versions
<=3.14.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

User Access Manager

medium
Vulnerability
User Access Manager — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.3.18
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails

medium
Vulnerability
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails — SQL Injection
Severity
medium Medium risk
Affected Versions
<=1.31.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Crowdfunding

medium
Vulnerability
WP Crowdfunding — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Podlove Podcast Publisher

medium
Vulnerability
Podlove Podcast Publisher — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

My Calendar – Accessible Event Manager

medium
Vulnerability
My Calendar – Accessible Event Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

My Calendar – Accessible Event Manager

medium
Vulnerability
My Calendar – Accessible Event Manager — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.8.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Product Filter for WooCommerce by WBW

medium
Vulnerability
Product Filter for WooCommerce by WBW — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.4.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

medium
Vulnerability
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.1.17
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP Crowdfunding

medium
Vulnerability
WP Crowdfunding — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Content Mask

medium
Vulnerability
Content Mask — Properly sanitise and escape content submitted with a post before outputting it in the pages it gene
Severity
medium Medium risk
Affected Versions
<=1.8.5.6
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

medium
Vulnerability
WP Travel — Verify that the requester is authorized to act on the booking targeted by one of its front-end payme
Severity
medium Medium risk
Affected Versions
<=12.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Awesome Support

medium
Vulnerability
Awesome Support — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=6.3.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ultimate Gift Cards for WooCommerce

medium
Vulnerability
Ultimate Gift Cards for WooCommerce — Verify that the user redeeming a gift card is its intended recipient
Severity
medium Medium risk
Affected Versions
<=3.2.10
CVE Reference
Patch Status
No patch
Source
NVD

WP Recipe Maker

medium
Vulnerability
WP Recipe Maker — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=10.8.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Payment Plugins for Stripe WooCommerce

medium
Vulnerability
Payment Plugins for Stripe WooCommerce — Validate the order key before adding order data to the JavaScript configuration it outputs on the fr
Severity
medium Medium risk
Affected Versions
<=4.0.12
CVE Reference
Patch Status
No patch
Source
NVD

Payment Plugins for PayPal WooCommerce

medium
Vulnerability
Payment Plugins for PayPal WooCommerce — Validate the order key before adding order data to the JavaScript configuration it outputs on the fr
Severity
medium Medium risk
Affected Versions
<=2.0.26
CVE Reference
Patch Status
No patch
Source
NVD

Payment Plugins for PayPal WooCommerce

medium
Vulnerability
Payment Plugins for PayPal WooCommerce — Verify that a stored payment method belongs to the user attaching it
Severity
medium Medium risk
Affected Versions
<=2.0.26
CVE Reference
Patch Status
No patch
Source
NVD

SupportCandy

medium
Vulnerability
SupportCandy — Perform an authorization check on one of its support-ticket attachment download paths
Severity
medium Medium risk
Affected Versions
<=3.5.3
CVE Reference
Patch Status
No patch
Source
NVD

SupportCandy

medium
Vulnerability
SupportCandy — Validate a submitted per-ticket authorization code before disclosing the real code to the requester
Severity
medium Medium risk
Affected Versions
<=3.5.3
CVE Reference
Patch Status
No patch
Source
NVD

Groundhogg — CRM, Newsletters, and Marketing Automation

medium
Vulnerability
Groundhogg — CRM, Newsletters, and Marketing Automation — Restrict the redirect target of its email preference confirmation flow to the site's own host
Severity
medium Medium risk
Affected Versions
<=4.7.2
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

medium
Vulnerability
WPLP Cookie Consent — Have any authorisation or CSRF checks when storing visitor consent state
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

medium
Vulnerability
WPLP Cookie Consent — Have capability or nonce checks on some of its A/B testing actions
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD

Masteriyo LMS

medium
Vulnerability
Masteriyo LMS — Perform any authorization check before returning a course enrolment record over its REST API
Severity
medium Medium risk
Affected Versions
<=3.4.0
CVE Reference
Patch Status
No patch
Source
NVD

Sina Extension for Elementor

medium
Vulnerability
Sina Extension for Elementor — Properly escape a Table widget setting before outputting it within an HTML attribute
Severity
medium Medium risk
Affected Versions
<=3.10.4
CVE Reference
Patch Status
No patch
Source
NVD

Quentn WP

medium
Vulnerability
Quentn WP — Properly sanitise and escape a parameter before using it in an SQL query
Severity
medium Medium risk
Affected Versions
<=1.2.15
CVE Reference
Patch Status
No patch
Source
NVD

Kirki

medium
Vulnerability
Kirki — Check whether the requester is allowed to read a post before rendering and returning its page conten
Severity
medium Medium risk
Affected Versions
<=6.3.0
CVE Reference
Patch Status
No patch
Source
NVD

WPFunnels

medium
Vulnerability
WPFunnels — Missing Authorization
Severity
medium Medium risk
Affected Versions
<=3.12.13
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Sunshine Photo Cart

medium
Vulnerability
Sunshine Photo Cart — Validate that a client-supplied price identifier belongs to the item being purchased when it is adde
Severity
medium Medium risk
Affected Versions
<=3.7
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

medium
Vulnerability
WPLP Cookie Consent — Perform nonce or capability checks on one of its cookie scanner AJAX actions
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD

WPLP Cookie Consent

medium
Vulnerability
WPLP Cookie Consent — Perform nonce or capability checks on several of its settings AJAX actions
Severity
medium Medium risk
Affected Versions
<=4.4.2
CVE Reference
Patch Status
No patch
Source
NVD

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

medium
Vulnerability
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More — Validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into t
Severity
medium Medium risk
Affected Versions
<=3.0.9
CVE Reference
Patch Status
No patch
Source
NVD

Reviso Exporter for WooCommerce

medium
Vulnerability
Reviso Exporter for WooCommerce — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=1.2.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Checkout Custom Fields Builder for WooCommerce

medium
Vulnerability
Checkout Custom Fields Builder for WooCommerce — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=1.1.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

CleanTalk

medium
Vulnerability
CleanTalk — Prevent unauthenticated
Severity
medium Medium risk
Affected Versions
<=6.87
CVE Reference
Patch Status
No patch
Source
NVD

Hustle

medium
Vulnerability
Hustle — Prevent shortcodes in submitted form values from being executed when it substitutes those values int
Severity
medium Medium risk
Affected Versions
<=7.8.14.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Express Checkout

medium
Vulnerability
WP Express Checkout — Verify server-side that a payment was actually completed before marking an order as paid
Severity
medium Medium risk
Affected Versions
<=2.5.0
CVE Reference
Patch Status
No patch
Source
NVD

Contact Form 7 Captcha

medium
Vulnerability
Contact Form 7 Captcha — CVE-2026-85117
Severity
medium Medium risk
Affected Versions
<=0.1.9
CVE Reference
Patch Status
No patch
Source
NVD

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

medium
Vulnerability
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=4.1.22
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred

medium
Vulnerability
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.2.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping

medium
Vulnerability
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping — Time-based SQL Injection
Severity
medium Medium risk
Affected Versions
<=2.23.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Ninja Forms - Scheduled Exports

medium
Vulnerability
Ninja Forms - Scheduled Exports — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.3
CVE Reference
Patch Status
No patch
Source
NVD

Builderall for WordPress

medium
Vulnerability
Builderall for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Builderall for WordPress

medium
Vulnerability
Builderall for WordPress — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Builderall Cheetah For Wp

medium
Vulnerability
Builderall Cheetah For Wp — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=3.0.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP BackItUp Community Edition

medium
Vulnerability
WP BackItUp Community Edition — Directory Traversal
Severity
medium Medium risk
Affected Versions
<=2.1.0
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Advanced Contact form 7 DB

medium
Vulnerability
Advanced Contact form 7 DB — Authorization bypass
Severity
medium Medium risk
Affected Versions
<=2.1.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Easy Google Fonts

medium
Vulnerability
Easy Google Fonts — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.0.4
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

medium
Vulnerability
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.15.46
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Notiqoo

medium
Vulnerability
Notiqoo — Have capability checks on several of its AJAX actions and builds the name of the option to write fro
Severity
medium Medium risk
Affected Versions
<=1.4.14
CVE Reference
Patch Status
No patch
Source
NVD

Aruba HiSpeed Cache

medium
Vulnerability
Aruba HiSpeed Cache — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.0.14
CVE Reference
Patch Status
No patch
Source
NVD

Redux Framework

medium
Vulnerability
Redux Framework — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.5.13.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booktics – Booking Calendar for Appointments and Service Businesses

medium
Vulnerability
Booktics – Booking Calendar for Appointments and Service Businesses — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=1.0.23
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

OTP Login & Register Woocommerce

medium
Vulnerability
OTP Login & Register Woocommerce — Authentication Bypass
Severity
medium Medium risk
Affected Versions
<=2.7.2
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

HUSKY – Products Filter Professional for WooCommerce

medium
Vulnerability
HUSKY – Products Filter Professional for WooCommerce — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.4.3
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty

medium
Vulnerability
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Relevanssi – A Better Search

medium
Vulnerability
Relevanssi – A Better Search — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=4.28.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Unlimited Elements For Elementor

medium
Vulnerability
Unlimited Elements For Elementor — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.0.16
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Themify – WooCommerce Product Filter

medium
Vulnerability
Themify – WooCommerce Product Filter — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.5.5
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Bold Timeline Lite

medium
Vulnerability
Bold Timeline Lite — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=1.2.8
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

WP-Members Membership Plugin

medium
Vulnerability
WP-Members Membership Plugin — Reflected Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.5.6
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

teddy-bear-customize-addon

medium
Vulnerability
teddy-bear-customize-addon — Perform any authorization or ownership checks before returning WooCommerce order metadata and the UR
Severity
medium Medium risk
Affected Versions
<=1.0.5
CVE Reference
Patch Status
No patch
Source
NVD

advanced-customized-prompts

medium
Vulnerability
advanced-customized-prompts — Perform any capability
Severity
medium Medium risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD

advanced-customized-prompts

medium
Vulnerability
advanced-customized-prompts — Perform any capability
Severity
medium Medium risk
Affected Versions
<=1.0.1
CVE Reference
Patch Status
No patch
Source
NVD

YITH WooCommerce Wishlist

medium
Vulnerability
YITH WooCommerce Wishlist — Verify that a user is authorised to rename a given wishlist
Severity
medium Medium risk
Affected Versions
<=4.18.1
CVE Reference
Patch Status
No patch
Source
NVD

CoolClock

medium
Vulnerability
CoolClock — Properly escape a custom skin setting before outputting it inside an inline script
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

CoolClock

medium
Vulnerability
CoolClock — Properly escape a skin setting before outputting it within an HTML attribute
Severity
medium Medium risk
Affected Versions
<=4.3.8
CVE Reference
Patch Status
No patch
Source
NVD

AI Builder

medium
Vulnerability
AI Builder — Sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front e
Severity
medium Medium risk
Affected Versions
<=2.7.8
CVE Reference
Patch Status
No patch
Source
NVD

Featured Image with URL

medium
Vulnerability
Featured Image with URL — Sanitise and escape a stored image attribute value before outputting it
Severity
medium Medium risk
Affected Versions
<=1.0.6
CVE Reference
Patch Status
No patch
Source
NVD

SSL Zen — SSL Certificate Installer & HTTPS Redirects

medium
Vulnerability
SSL Zen — SSL Certificate Installer & HTTPS Redirects — Perform capability or nonce checks on a certificate-file download routine that runs early in the Wor
Severity
medium Medium risk
Affected Versions
<=4.7.40
CVE Reference
Patch Status
No patch
Source
NVD

Visualizer

medium
Vulnerability
Visualizer — Properly authorise access to its chart-building actions
Severity
medium Medium risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

WPCafe

medium
Vulnerability
WPCafe — Correctly restrict access to a set of order-management REST endpoints because their permission callb
Severity
medium Medium risk
Affected Versions
<=3.0.18
CVE Reference
Patch Status
No patch
Source
NVD

BackWPup

medium
Vulnerability
BackWPup — Properly restrict access to several of its REST API routes for job
Severity
medium Medium risk
Affected Versions
<=5.7.5
CVE Reference
Patch Status
No patch
Source
NVD

Media Library Assistant

medium
Vulnerability
Media Library Assistant — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.35
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Media Library Assistant

medium
Vulnerability
Media Library Assistant — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.35
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Media Library Assistant

medium
Vulnerability
Media Library Assistant — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=3.35
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Nexi XPay Build

medium
Vulnerability
Nexi XPay Build — Verify that the saved payment token being requested belongs to the current user
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Payment Gateway PayPay for WooCommerce

medium
Vulnerability
Payment Gateway PayPay for WooCommerce — Verify the authenticity of the payment notifications it receives before acting on them
Severity
medium Medium risk
Affected Versions
all
CVE Reference
Patch Status
No patch
Source
NVD

Simple CAPTCHA with Cloudflare Turnstile

medium
Vulnerability
Simple CAPTCHA with Cloudflare Turnstile — CVE-2026-85116
Severity
medium Medium risk
Affected Versions
<=1.42.3
CVE Reference
Patch Status
No patch
Source
NVD

Persian Elementor

medium
Vulnerability
Persian Elementor — Verify that the payment authority returned to its ZarinPal payment callback belongs to the transacti
Severity
medium Medium risk
Affected Versions
<=2.8.2
CVE Reference
Patch Status
No patch
Source
NVD

MetForm

medium
Vulnerability
MetForm — Properly neutralize newline characters in user-submitted values that are placed into notification em
Severity
medium Medium risk
Affected Versions
<=4.1.9
CVE Reference
Patch Status
No patch
Source
NVD

BuddyPress

medium
Vulnerability
BuddyPress — Insecure Direct Object Reference
Severity
medium Medium risk
Affected Versions
<=14.3.3
CVE Reference
Patch Status
No patch
Source
NVD

GamiPress

medium
Vulnerability
GamiPress — Authenticated (Subscriber+) SQL Injection
Severity
medium Medium risk
Affected Versions
<=7.9.7
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booking for Appointments and Events Calendar

medium
Vulnerability
Booking for Appointments and Events Calendar — Verify that a payment was actually taken before recording a booking as paid
Severity
medium Medium risk
Affected Versions
<=9.8.1
CVE Reference
Patch Status
No patch
Source
NVD

Temporary Login Without Password

medium
Vulnerability
Temporary Login Without Password — Prevent a temporary user from creating an Application Password
Severity
medium Medium risk
Affected Versions
<=1.9.9
CVE Reference
Patch Status
No patch
Source
NVD

SureRank SEO

medium
Vulnerability
SureRank SEO — Exclude users' registered account email addresses from the structured data it outputs on public page
Severity
medium Medium risk
Affected Versions
<=1.10.1
CVE Reference
Patch Status
No patch
Source
NVD

Masteriyo LMS

medium
Vulnerability
Masteriyo LMS — Sanitise and escape one of its course fields before outputting it back in the course editor
Severity
medium Medium risk
Affected Versions
<=3.4.1
CVE Reference
Patch Status
No patch
Source
NVD

Custom Menu Wizard Widget

medium
Vulnerability
Custom Menu Wizard Widget — Sanitize and escape several shortcode attributes before rendering them into HTML
Severity
medium Medium risk
Affected Versions
<=3.3.1
CVE Reference
Patch Status
No patch
Source
NVD

BEAR

medium
Vulnerability
BEAR — Verify a CSRF nonce or check user capabilities before updating taxonomy terms
Severity
medium Medium risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD

BEAR

medium
Vulnerability
BEAR — Verify a CSRF nonce before saving its meta field configuration
Severity
medium Medium risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Highlight Box

medium
Vulnerability
WP Highlight Box — Escape some shortcode attributes before outputting them in a page where the shortcode is embedded
Severity
medium Medium risk
Affected Versions
<=1.0
CVE Reference
Patch Status
No patch
Source
NVD

Sprout Invoices

medium
Vulnerability
Sprout Invoices — Perform a capability or ownership check before
Severity
medium Medium risk
Affected Versions
<=20.8.16
CVE Reference
Patch Status
No patch
Source
NVD

Rox Appointment Booking

medium
Vulnerability
Rox Appointment Booking — Perform any capability or authorization check when saving its holiday schedule
Severity
medium Medium risk
Affected Versions
<=1.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Rox Appointment Booking

medium
Vulnerability
Rox Appointment Booking — Verify the order total or the selected payment method against its own server-side pricing when creat
Severity
medium Medium risk
Affected Versions
<=1.2.0
CVE Reference
Patch Status
No patch
Source
NVD

Rox Appointment Booking

medium
Vulnerability
Rox Appointment Booking — Perform any authorization check on the endpoint that returns a booking's confirmation details
Severity
medium Medium risk
Affected Versions
<=1.2.3
CVE Reference
Patch Status
No patch
Source
NVD

WPBot

medium
Vulnerability
WPBot — Perform any capability or nonce check on the AJAX action that lists stored chat sessions
Severity
medium Medium risk
Affected Versions
<=8.6.0
CVE Reference
Patch Status
No patch
Source
NVD

WPBot

medium
Vulnerability
WPBot — Perform any authorization or nonce check on several AJAX actions that relay prompts to its configure
Severity
medium Medium risk
Affected Versions
<=8.5.7
CVE Reference
Patch Status
No patch
Source
NVD

Product XML Feed Manager for WooCommerce

medium
Vulnerability
Product XML Feed Manager for WooCommerce — Restrict which object method its product shortcode may call
Severity
medium Medium risk
Affected Versions
<=3.1.1
CVE Reference
Patch Status
No patch
Source
NVD

DT LMS – elearning, WordPress LMS

medium
Vulnerability
DT LMS – elearning, WordPress LMS — Unauthorized modification of data
Severity
medium Medium risk
Affected Versions
<=1.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Royal Addons for Elementor – Addons and Templates Kit for Elementor

medium
Vulnerability
Royal Addons for Elementor – Addons and Templates Kit for Elementor — Sensitive Information Exposure
Severity
medium Medium risk
Affected Versions
<=1.7.1066
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Smart Marketing SMS and Newsletters Forms

medium
Vulnerability
Smart Marketing SMS and Newsletters Forms — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=5.1.24
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO

medium
Vulnerability
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO — Generic SQL Injection
Severity
medium Medium risk
Affected Versions
<=4.2.1
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Booking for Appointments and Events Calendar

medium
Vulnerability
Booking for Appointments and Events Calendar — Stored Cross-Site Scripting
Severity
medium Medium risk
Affected Versions
<=2.4.9
CVE Reference
Patch Status
No patch
Source
NVD
Plugin Page

Contact Form to Chat Apps | Click to Chat to Order

medium
Vulnerability
Contact Form to Chat Apps | Click to Chat to Order — Perform any capability
Severity
medium Medium risk
Affected Versions
<=2.15.8
CVE Reference
Patch Status
No patch
Source
NVD

User Registration & Membership

medium
Vulnerability
User Registration & Membership — Properly restrict who may author a membership plan or validate the plan a user attaches to their own
Severity
medium Medium risk
Affected Versions
<=5.2.8
CVE Reference
Patch Status
No patch
Source
NVD

User Registration & Membership

medium
Vulnerability
User Registration & Membership — Validate the destination of a post-login redirect before redirecting
Severity
medium Medium risk
Affected Versions
<=5.2.8
CVE Reference
Patch Status
No patch
Source
NVD

User Registration & Membership

medium
Vulnerability
User Registration & Membership — Check the capability of the user making a membership purchase
Severity
medium Medium risk
Affected Versions
<=5.2.8
CVE Reference
Patch Status
No patch
Source
NVD

User Registration & Membership

medium
Vulnerability
User Registration & Membership — Verify that the visitor requesting its membership confirmation page owns the account named in the re
Severity
medium Medium risk
Affected Versions
<=5.2.8
CVE Reference
Patch Status
No patch
Source
NVD

Simple Membership

medium
Vulnerability
Simple Membership — Validate that the membership level supplied in a PayPal payment notification matches the level confi
Severity
medium Medium risk
Affected Versions
<=4.7.8
CVE Reference
Patch Status
No patch
Source
NVD

rtMedia for WordPress, BuddyPress and bbPress

medium
Vulnerability
rtMedia for WordPress, BuddyPress and bbPress — Check ownership before changing the privacy level of an activity and its attached media
Severity
medium Medium risk
Affected Versions
<=4.7.12
CVE Reference
Patch Status
No patch
Source
NVD

Bookit — Booking & Appointment Calendar

medium
Vulnerability
Bookit — Booking & Appointment Calendar — Properly restrict the data returned by an availability-check request
Severity
medium Medium risk
Affected Versions
<=2.6.0.1
CVE Reference
Patch Status
No patch
Source
NVD

Really Simple Security

medium
Vulnerability
Really Simple Security — Prevent an unauthenticated request from resetting an account's completed email two-factor enrolment
Severity
medium Medium risk
Affected Versions
<=9.8.1
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

low
Vulnerability
WP Travel — Properly verify that the requester is authorized to modify the targeted booking on one branch of its
Severity
low Low risk
Affected Versions
<=12.0.2
CVE Reference
Patch Status
No patch
Source
NVD

WP Travel

low
Vulnerability
WP Travel — Properly verify that the requester owns the booking targeted by its bank-deposit slip submission
Severity
low Low risk
Affected Versions
<=12.0.2
CVE Reference
Patch Status
No patch
Source
NVD

Translate WordPress with GTranslate

low
Vulnerability
Translate WordPress with GTranslate — Validate one of its settings before the bundled front-end scripts build markup from it
Severity
low Low risk
Affected Versions
<=3.0.10
CVE Reference
Patch Status
No patch
Source
NVD

Visualizer

low
Vulnerability
Visualizer — Properly authorise chart-deletion requests
Severity
low Low risk
Affected Versions
<=4.0.6
CVE Reference
Patch Status
No patch
Source
NVD

Masteriyo LMS

low
Vulnerability
Masteriyo LMS — Verify ownership of
Severity
low Low risk
Affected Versions
<=3.4.1
CVE Reference
Patch Status
No patch
Source
NVD

BEAR

low
Vulnerability
BEAR — Perform ownership checks on several handlers that return product data by a user-supplied identifier
Severity
low Low risk
Affected Versions
<=1.2.2
CVE Reference
Patch Status
No patch
Source
NVD

WordPress Theme Vulnerabilities (0)

No vulnerabilities reported in this category this week.

WordPress Core Vulnerabilities (0)

No vulnerabilities reported in this category this week.

Recommendations

1
Update immediately
Install the latest versions of all plugins, themes, and WordPress core.
2
Enable auto-updates
Turn on automatic updates for minor WordPress releases and plugins where possible.
3
Remove unused plugins
Deactivate and delete any plugins or themes you no longer use.
4
Run a security scan
Use our free WordPress security scanner to check your site for known vulnerabilities.
5
Monitor regularly
Set up uptime monitoring and periodic security scans to catch issues early.

Methodology

This report is compiled automatically from multiple trusted sources:

NIST National Vulnerability Database (NVD)
CVE records with CVSS severity scores
Wordfence Intelligence
WordPress-specific vulnerability data with patch information
Our Scanning Database
Vulnerabilities detected through active WordPress security scans

Vulnerabilities are deduplicated by CVE ID. Severity ratings follow the CVSS v3.x scoring system. This report is generated automatically and may not capture every vulnerability disclosed during the period.

Tags

vulnerabilitieswordpress-securityweekly-reportcve

Related Posts

Vulnerability Report

WordPress Vulnerability Report: September 5 – September 12, 2026

203 WordPress vulnerabilities disclosed between September 5 – September 12, 2026. 11 critical, 43 high severity. 0 patched, 203 unpatched.

WPSentry·Sep 12, 2026
Vulnerability Report

WordPress Vulnerability Report: September 4 – September 11, 2026

215 WordPress vulnerabilities disclosed between September 4 – September 11, 2026. 12 critical, 56 high severity. 0 patched, 215 unpatched.

WPSentry·Sep 11, 2026
Vulnerability Report

WordPress Vulnerability Report: September 3 – September 10, 2026

200 WordPress vulnerabilities disclosed between September 3 – September 10, 2026. 11 critical, 46 high severity. 0 patched, 200 unpatched.

WPSentry·Sep 10, 2026
Back to Blog