Wordfence 报告 497 项 WordPress 插件与主题漏洞
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Wordfence Intelligence 在 2026 年 10 月 12 日至 18 日收录 497 项 WordPress 插件和主题漏洞，涉及 327 个插件与 23 个主题，其中 428 项已修复、69 项未修复。
报告汇总了497项漏洞及受影响插件和主题、补丁状态与严重等级，并列出多项未修复的严重漏洞，便于站点核查版本和安排更新。
Last week, there were 497 vulnerabilities disclosed in 327 WordPress Plugins and 23 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
-
- WAF-RULE-966 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-967 – Data redacted while we work with the vendor on a patch.
- PHP Object Injection in Comments
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 428 |
| Unpatched | 69 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 6 |
| Medium Severity | 315 |
| High Severity | 153 |
| Critical Severity | 23 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 159 |
| Missing Authorization | 116 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 34 |
| Deserialization of Untrusted Data | 33 |
| Exposure of Sensitive Information to an Unauthorized Actor | 31 |
| Improper Privilege Management | 22 |
| Authorization Bypass Through User-Controlled Key | 20 |
| Improper Control of Generation of Code ('Code Injection') | 15 |
| Unrestricted Upload of File with Dangerous Type | 11 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 10 |
| Insufficient Verification of Data Authenticity | 8 |
| Cross-Site Request Forgery (CSRF) | 7 |
| Improper Authentication | 6 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 5 |
| Client-Side Enforcement of Server-Side Security | 4 |
| Incorrect Authorization | 3 |
| Server-Side Request Forgery (SSRF) | 3 |
| Improper Input Validation | 2 |
| URL Redirection to Untrusted Site ('Open Redirect') | 2 |
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 1 |
| Embedded Malicious Code | 1 |
| Improper Access Control | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 |
| Improper Neutralization of Special Elements used in a Command ('Command Injection') | 1 |
| Use of Insufficiently Random Values | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
|
|
40 |
|
|
19 |
|
|
16 |
|
|
15 |
|
|
13 |
|
|
11 |
|
|
10 |
|
|
10 |
|
|
9 |
|
|
8 |
|
|
8 |
|
|
8 |
|
|
7 |
|
|
7 |
|
|
7 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
6 |
|
|
5 |
|
|
5 |
|
|
5 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
4 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
3 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
2 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
|
|
1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | tenweb-speed-optimizer |
| 2Way VideoCalls and Random Chat – HTML5 Webcam Videochat | webcam-2way-videochat |
| Abandoned Cart Pro for WooCommerce | woocommerce-abandon-cart-pro |
| ACF Frontend Admin by DynamiApps | acf-frontend-form-element |
| Active Woot Products Tables for WooCommerce. 100% FREE | profit-products-tables-for-woocommerce |
| ActiveTrail for WooCommerce | activetrail-for-woocommerce |
| AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | acymailing |
| Ad Inserter – Ad Manager & AdSense Ads | ad-inserter |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | file-manager-advanced |
| Advanced Post Manager | advanced-post-manager |
| affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | affiliate-toolkit-starter |
| Affiliates | affiliates |
| AGE-GATE | wp-site-age-gate |
| AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini | ai-engine |
| Ajax Search Lite – Live Search & Filter | ajax-search-lite |
| Animated Number Counters | animated-number-counters |
| AnyComment | anycomment |
| App Builder – Create Native Android & iOS Apps On The Flight | app-builder |
| Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | latepoint |
| Asaas Gateway for WooCommerce | woo-asaas |
| aThemeArt Theme Helper | athemeart-theme-helper |
| Auction Nudge – Your eBay Listings | auction-nudge |
| Avada (Fusion) Builder | fusion-builder |
| AWP Classifieds | another-wordpress-classifieds-plugin |
| Backuply – Backup, Restore, Migrate and Clone | backuply |
| bbPress | bbpress |
| BDM Digital Payment Gateway | bdm-digital-payment-gateway |
| Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation | bit-integrations |
| Blaze Demo Importer | blaze-demo-importer |
| Blog2Social: Social Media Auto Post & Scheduler | blog2social |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Booking Package | booking-package |
| Bookit — Booking & Appointment Calendar | bookit |
| Books Gallery – Book Showcase, Library & Affiliate Plugin | wp-books-gallery |
| Booktics – Appointment Booking Calendar for Service Businesses | booktics |
| Booster Elite for WooCommerce | booster-elite-for-woocommerce |
| BP Profile Search | bp-profile-search |
| Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP | videowhisper-live-streaming-integration |
| Broken Link Checker | broken-link-checker |
| BSK PDF Manager | bsk-pdf-manager |
| BuddyPress XProfile Custom Image Field | buddypress-xprofile-image-field |
| Bulk Page Generator – LPagery | lpagery |
| Bus Ticket Booking with Seat Reservation | bus-ticket-booking-with-seat-reservation |
| CamPay Shortcode Payment Gateway | campay-shortcode-payment-gateway |
| Cardinity Payment Gateway for WooCommerce | cardinity-free-payment-gateway-for-woocommerce |
| Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails | woo-cart-abandonment-recovery |
| Checkout Field Manager (Checkout Manager) for WooCommerce | woocommerce-checkout-manager |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Click to Chat – HoliThemes | click-to-chat-for-whatsapp |
| CodeAtoZ B2B Suite for WooCommerce | codeatoz-b2b-suite-for-woocommerce |
| Coinbase Commerce Payment Gateway for WooCommerce | coinbase-commerce |
| Coinsnap Bitcoin Crowdfunding | coinsnap-bitcoin-crowdfunding |
| Colibri Page Builder | colibri-page-builder |
| Complianz GDPR/CCPA Cookie Consent Banner | complianz-gdpr |
| Contact Form 7 Signature Addon | contact-form-7-signature-addon |
| Contact Form DB for Enfold | contact-form-db-for-enfold |
| Cooked – Recipe Management | cooked |
| Countdown Timer – Widget Countdown | widget-countdown |
| CP Multi View Events Calendar | cp-multi-view-calendar |
| Cryptocurrency Donation Box – Bitcoin & Crypto Donations | cryptocurrency-donation-box |
| Custom Query Blocks | post-type-archive-mapping |
| Customer Email Verification for WooCommerce | emails-verification-for-woocommerce |
| Dark Mode – Improve Accessibility with AI Powered Dark Theme | wp-dark-mode |
| Database Addon for Contact Form 7 – CFDB7 | contact-form-cfdb7 |
| Debloat – Remove Unused CSS, Optimize JS | debloat |
| Directorist: AI-Powered Business Directory, Listings & Classified Ads | directorist |
| Document Gallery | document-gallery |
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | dokan-lite |
| Donation Thermometer | donation-thermometer |
| DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More | doublescale |
| Download Monitor | download-monitor |
| Download Monitor integration for WooCommerce | download-monitor-integration-for-woocommerce |
| Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar | webba-booking-lite |
| Easy HTTPS Redirection (SSL) | https-redirection |
| Easy Property Listings | easy-property-listings |
| eaSYNC Booking – Hotels, Restaurants & Car Rentals | easync-booking |
| Electronic Signature Add-on for Fluent Forms | signature-fluent-contract-forms-add-on |
| Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| Elementor Website Builder – more than just a page builder | elementor |
| ElementsReady Addons for Elementor | element-ready-lite |
| ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) | elex-bulk-edit-products-prices-attributes-for-woocommerce-basic |
| ELEX WordPress HelpDesk & Customer Ticketing System | elex-helpdesk-customer-support-ticket-system |
| Email Customizer for WooCommerce (Pro) | woocommerce-email-customizer |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| EU VAT Assistant for WooCommerce | woocommerce-eu-vat-assistant |
| European VAT Compliance Assistant for WooCommerce | woocommerce-eu-vat-compliance |
| Event Post | event-post |
| Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| Events Made Easy | events-made-easy |
| Events Manager – Calendar, Bookings, Tickets, Appointments and more! | events-manager |
| Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | everest-forms |
| Fancy Comments WordPress | fancy-facebook-comments |
| Fast Courier – Shipping & Freight | fast-courier-shipping-freight |
| Fastcache by Host.it | fastcache-by-host-it |
| FiboSearch – Ajax Search for WooCommerce | ajax-search-for-woocommerce |
| File Upload to Order for WooCommerce | file-upload-to-order |
| Flexible Quantity – Measurement Price Calculator for WooCommerce | flexible-quantity-measurement-price-calculator-for-woocommerce |
| Flexible Subscriptions | flexible-subscriptions |
| FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration | fluent-boards |
| FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | fluent-cart |
| FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | fluent-crm |
| Flying Scripts: Delay JavaScript to Improve Site Speed & Performance | flying-scripts |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| FormFlow for GoHighLevel (GHL) – Send Form Leads to GHL CRM | formflow-for-gohighlevel |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Forms | forms-by-made-it |
| FOX – Currency Switcher Professional for WooCommerce | woocommerce-currency-switcher |
| Frontend Dashboard | frontend-dashboard |
| FunnelKit – Funnel Builder Plugin for WooCommerce Checkout | funnel-builder |
| FV Flowplayer Video Player | fv-wordpress-flowplayer |
| FV Player 8 | fv-player |
| FV Simpler SEO | fv-all-in-one-seo-pack |
| Gallery Custom Links | gallery-custom-links |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| Gantry 5 Framework | gantry5 |
| Gateway for Vantiv on WC | gateway-for-vantiv-on-wc |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Gmedia Photo Gallery | grand-media |
| GoSMTP Pro | gosmtp-pro |
| Gravity Forms | gravityforms |
| Green Popups | halfdata-green-popups |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| Gutenverse Form – Contact Form Builder, Block Form & Booking Form | gutenverse-form |
| Gwolle Guestbook | gwolle-gb |
| Hide My WP Ghost – Security & Firewall | hide-my-wp |
| Hippoo Mobile App for WooCommerce | hippoo |
| HivePress – Business Directory, Listings & Classified Ads Plugin | hivepress |
| HUSKY – Products Filter for WooCommerce Professional | woocommerce-products-filter |
| Hyyan Integration for WooCommerce and Polylang | woo-poly-integration |
| Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy | image-hub |
| Image Photo Gallery Final Tiles Grid | final-tiles-grid-gallery-lite |
| Import and export users and customers | import-users-from-csv-with-meta |
| IMPress for IDX Broker | idx-broker-platinum |
| Infinite Uploads – Offload, Optimize & Organize Your Media Library | infinite-uploads |
| InstaWP Connect – 1-click WP Staging & Migration | instawp-connect |
| iPOSpays Payment Gateway for WooCommerce | ipospays-gateways-wc |
| Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | jeg-elementor-kit |
| JetElements | jet-elements |
| JetEngine | jet-engine |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| JetMenu | jet-menu |
| JetSmartFilters | jet-smart-filters |
| JTL-Connector for WooCommerce | woo-jtl-connector |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages | convertkit |
| Klarna for WooCommerce | klarna-payments-for-woocommerce |
| Knowledge Base | knowledgebase |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes | lifterlms |
| Lightweight Cookie Notice – Cookie Banner for Cookie Consent | lightweight-cookie-notice-free |
| Link Library | link-library |
| Link Whisper Free | link-whisper |
| LTL Freight Quotes – ODFL Edition | ltl-freight-quotes-odfl-edition |
| Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance | mail-mint |
| MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | mailoptin |
| MAIO – ChatGPT SEO Tracking & AI Search Optimization | maio-the-new-ai-geo-seo-tool |
| Mang Board | mangboard |
| MapSVG – Vector maps, Image maps, Google Maps | mapsvg-lite-interactive-vector-maps |
| MB Custom Post Types & Custom Taxonomies | mb-custom-post-type |
| MDTF – Meta Data and Taxonomies Filter | wp-meta-data-filter-and-taxonomy-filter |
| Membership & User Roles for WooCommerce (Automatic Role Changer) | dfx-woo-role-changer |
| Meow Lightbox | meow-lightbox |
| miniOrange OTP Login, Verification and SMS Notifications | miniorange-otp-verification |
| Mobile builder | mobile-builder |
| Modern Events Calendar | modern-events-calendar |
| Modern Events Calendar Lite | modern-events-calendar-lite |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| My Calendar – Accessible Event Manager | my-calendar |
| Name Directory | name-directory |
| News Kit Addons For Elementor | news-kit-elementor-addons |
| NewStatPress | newstatpress |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | nexter-extension |
| Ninja Forms Signature Contract Add-On | ninja-signature-contract-forms-add-on |
| NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | notificationx |
| Ocean Extra | ocean-extra |
| Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights | opti-behavior |
| OTP Login & Register Woocommerce | mobile-login-woocommerce |
| OTP Login With Phone Number, OTP Verification | login-with-phone-number |
| Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | otter-blocks |
| OttoKit: All-in-One Automation Platform | suretriggers |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| Paid Videochat Turnkey Site – HTML5 PPV Live Webcams | ppv-live-webcams |
| Passster – Password Protect Pages and Content | content-protector |
| Patreon WordPress | patreon-connect |
| Pay for Payment for WooCommerce – Payment Gateway Fees & Discounts | woocommerce-pay-for-payment |
| PAYCOMET for WooCommerce | paytpv-for-woocommerce |
| Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management | wp-payment-form |
| Payment forms, Buy now buttons, and Invoicing System | GetPaid | invoicing |
| PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) | peachpay-for-woocommerce |
| PeproDev Branches Map (Mapify) | pepro-mapify |
| PhastPress | phastpress |
| Photo Engine (Media Organizer & Lightroom) | wplr-sync |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| PickPlugins Product Designer for WooCommerce | product-designer |
| PilotPress | pilotpress |
| PlanetStudio Payment Gateway | planetstudio-payment-gateway |
| PO/MO Editor | pomo-editor |
| Polylang | polylang |
| Popup Box – Create Countdown, Coupon, Video, Contact Form Popups | ays-popup-box |
| Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | post-and-page-builder |
| Post Export Import with Media | post-export-import-with-media |
| PowerPack Addons for Elementor: Widgets, Form Styler and Templates | powerpack-lite-for-elementor |
| PowerPack Lite for Beaver Builder | powerpack-addon-for-beaver-builder |
| Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | premium-addons-for-elementor |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Presto Player | presto-player |
| Pricing Table – Block – Show Product or Service Pricing in Table Format | b-pricing-table |
| Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons | bdthemes-prime-slider-lite |
| Printcart Store – Web to Print Product Designer for WooCommerce | printcart-integration |
| Product Delivery Date for WooCommerce – Lite | product-delivery-date-for-woocommerce-lite |
| Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant | shopping-feed-for-google |
| Products Restricted Users for WooCommerce | woo-products-restricted-users |
| Push Notification for Post and BuddyPress | push-notification-for-post-and-buddypress |
| Quick PayPal Payments: Payment Button & Form | quick-paypal-payments |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Quiz Maker by AYS | quiz-maker |
| Rank Math SEO PRO | seo-by-rank-math-pro |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| Record of Consent Extension for Complianz | record-of-consent-extension-for-complianz |
| Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit | woo-rede |
| Responsive Blocks – Page Builder for Blocks & Patterns | responsive-block-editor-addons |
| Responsive Slider | responsive-slider |
| Restricted Site Access | restricted-site-access |
| Robokassa payment gateway for Woocommerce | robokassa |
| RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | feedzy-rss-feeds |
| rtMedia for WordPress, BuddyPress and bbPress | buddypress-media |
| Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon | woo-boost-sales |
| Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | salon-booking-system |
| Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | post-expirator |
| Schema & Structured Data for WP & AMP | schema-and-structured-data-for-wp |
| Search Regex | search-regex |
| ShopMagic – email automation for WordPress | shopmagic-for-woocommerce |
| Sifalo Pay – Mobile Money & Card Payments for WooCommerce | sifalo-pay |
| SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications | simple-form |
| Simply Schedule Appointments | simply-schedule-appointments |
| SimplyRETS Real Estate IDX | simply-rets |
| Site Reviews | site-reviews |
| SiteOrigin CSS | so-css |
| Skydropx | skydropx |
| Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated | slim-seo |
| Smart Forms – when you need more than just a contact form | smart-forms |
| SmartCrawl SEO checker, analyzer & optimizer | smartcrawl-seo |
| SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery | sms-alert |
| Smush – Image Optimization, Compression, Lazy Load, WebP & CDN | wp-smushit |
| Snap Finance | snap-finance-checkout |
| Snazzy Social Media Feed | snazzy-cacheable-facebook-feed |
| Social Share Buttons | share-button |
| Social Share Buttons & Analytics Plugin – GetSocial.io | wp-share-buttons-analytics-by-getsocial |
| Spin Wheel | spin-wheel |
| SQL Chart Builder | sql-chart-builder |
| Squeeze – Browser-Based Image Compression & WebP Converter (No API, No Limits) | squeeze |
| Strong Testimonials | strong-testimonials |
| Subscribe to Comments | subscribe-to-comments |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System | support-genix-lite |
| SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | surecart |
| SureDash – Community, Courses & Member Dashboard | suredash |
| SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz | sureforms |
| Tainacan | tainacan |
| Tasty Recipes Lite – WordPress Recipe Card Plugin with Built-In Recipe Schema | tasty-recipes-lite |
| The Events Calendar | the-events-calendar |
| The Grid | the-grid |
| Theme My Login | theme-my-login |
| Themify Builder | themify-builder |
| Themify Popup | themify-popup |
| ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin | thirstyaffiliates |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| TMDS – Dropshipping for TEMU and Woo | tmds-dropshipping-for-temu-and-woo |
| Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental | tourfic |
| Tracking Code Manager | tracking-code-manager |
| TranslatePress – Translate Multilingual sites with AI Translation | translatepress-multilingual |
| TrueBooker – Appointment Booking and Scheduler System | truebooker-appointment-booking |
| Trust Payments Gateway for WooCommerce | trust-payments-hosted-payment-pages-integration |
| Tutor LMS – eLearning and online course solution | tutor |
| Ukr-To-Lat | ukr-to-lat |
| Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform | ultimate-multisite |
| Ultra Addons for Contact Form 7 | ultimate-addons-for-contact-form-7 |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin | user-registration-pro |
| User Rights Access Manager | user-rights-access-manager |
| Verified Reviews (Avis Vérifiés) | netreviews |
| VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok | videowhisper-site-manager |
| Visma Pay for Woocommerce | visma-pay-payment-gateway |
| Visual Form Builder | visual-form-builder |
| Vitepos – Point of Sale (POS) for WooCommerce | vitepos-lite |
| VK Blocks | vk-blocks |
| Vulnity Security | vulnity |
| Walletdoc Payment Gateway for WooCommerce | wc-walletdoc-payment-gateway |
| WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce | woosquare |
| Weaver Xtreme Theme Support | weaverx-theme-support |
| WebberZone Top 10 — Popular Posts | top-10 |
| weForms – Easy Drag & Drop Contact Form Builder For WordPress | weforms |
| Welcart e-Commerce | usc-e-shop |
| WholesaleX – All-in-One B2B Solution with Wholesale Pricing | wholesalex |
| WOLF – WordPress Posts Bulk Editor and Manager Professional | bulk-editor |
| WordLift – AI powered SEO – Schema | wordlift |
| WP 2FA – Two-factor authentication for WordPress | wp-2fa |
| WP Booking System – Booking Calendar | wp-booking-system |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | wp-data-access |
| WP Easy Pay – Payment and Donation Form Builder for Square | wp-easy-pay |
| WP Encryption: Easy SSL / HTTPS & Free SSL certificate, HTTPS redirect | wp-letsencrypt-ssl |
| WP Mail Logging | wp-mail-logging |
| WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters | wp-map-block |
| WP OAuth Server ( Login with WordPress ) | miniorange-oauth-20-server |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Sessions Time Monitoring Full Automatic | activitytime |
| WP Testimonials | testimonial-widgets |
| WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory | wp-user-manager |
| WP w3all phpBB | wp-w3all-phpbb-integration |
| WP-Members Membership Plugin | wp-members |
| WPBot – ChatBot Conversational Forms | conversational-forms |
| WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager | insert-headers-and-footers |
| WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) | wpconsent-cookies-banner-privacy-suite |
| WPeMatico RSS Feed Fetcher | wpematico |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| WPGraphQL | wp-graphql |
| WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents | wsp-mcp-ai-agents-connector |
| WX Subscribe 微信支付付费订阅 | wx-subscribe |
| xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN | xspeed |
| YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | yaysmtp |
| YITH PayPal Express Checkout for WooCommerce | yith-paypal-express-checkout-for-woocommerce |
| YITH WooCommerce Compare | yith-woocommerce-compare |
| YITH WooCommerce Popup | yith-woocommerce-popup |
| YMC Filter | ymc-smart-filter |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Avventure | avventure |
| Bonbon | bonbon |
| Coinpress | coinpress |
| Edge Decor | edge-decor |
| EmojiNation | emojination |
| eStore | estore |
| Filmax | Cinema & Movie News Magazine WordPress Theme | filmax |
| gamezone | gamezone |
| Gamic - Gaming Metaverse Game & Crypto WordPress Theme | gamic |
| Good Homes - Real Estate WordPress Theme | good-homes |
| Gunslinger | gunslinger |
| Houzez | houzez |
| Le Truffe | letruffe |
| Legal Stone | Lawyers & Attorneys WordPress Theme | legal-stone |
| Marcell - Personal Blog & Magazine WordPress Theme | marcell |
| Marin | marin |
| Meals & Wheels | meals-wheels |
| Mission | mission |
| Motorix | motorix |
| Muzicon - Music Festival & Concert WordPress Theme | muzicon |
| Nuts | nuts |
| Orpheus | orpheus |
| XStore | xstore |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-108587
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]
Researcher
Osman Hussein
More Details >
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-97657
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro]
Researcher
andrea bocchetti
More Details >
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-97668
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro]
Researcher
Taoufik El Adel
More Details >
AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104800
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
AGE-GATE [wp-site-age-gate]
Researcher
Spy0x7
More Details >
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-103768
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Osman Hussein
More Details >
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-87855
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
JTL-Connector for WooCommerce [woo-jtl-connector]
Researcher
Supakiad S. (m3ez)
More Details >
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104736
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
Wordfence PRISM
More Details >
MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-109515
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. [mailoptin]
Researcher
Kuba
More Details >
Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-109219
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Mang Board [mangboard]
Researcher
Osman Hussein
More Details >
MDTF – Meta Data and Taxonomies Filter <= 1.3.9 - Unauthenticated Remote Code Execution
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-108151
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]
Researcher
Peter Tang
More Details >
My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104798
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
My Calendar – Accessible Event Manager [my-calendar]
Researcher
daroo
More Details >
OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Account Takeover
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-110135
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
OTP Login & Register Woocommerce [mobile-login-woocommerce]
Researcher
Pedro Pinho
More Details >
Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-93388
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Printcart Store – Web to Print Product Designer for WooCommerce [printcart-integration]
Researcher
Osman Hussein
More Details >
Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-111862
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Rank Math SEO PRO [seo-by-rank-math-pro]
Researcher(s): Unknown
More Details >
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104748
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications [simple-form]
Researcher
Sebastian Albrecht (mySebbe)
More Details >
Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-110002
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Snazzy Social Media Feed [snazzy-cacheable-facebook-feed]
Researcher
Abdualrhman Muzamil
More Details >
Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104730
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Wordfence PRISM
More Details >
The Grid <= 2.8.1 - Unauthenticated Remote Code Execution
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-94169
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
The Grid [the-grid]
Researcher
Rafie Muhammad
More Details >
Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-89079
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Theme My Login [theme-my-login]
Researcher
R3D
More Details >
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-110653
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Ekene Umegakwe
More Details >
BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
9.1
CVSS Rating
9.1 (Critical)
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
BuddyPress XProfile Custom Image Field [buddypress-xprofile-image-field]
Researcher
jun2e0
More Details >
Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-92097
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Click to Chat – HoliThemes [click-to-chat-for-whatsapp]
Researcher
Kuba
More Details >
File Upload to Order <= 1.1.3 - Unauthenticated Arbitrary File Deletion
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-107594
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
File Upload to Order for WooCommerce [file-upload-to-order]
Researcher
Mike Gozdiskowski
More Details >
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display < 3.9.1 - Authenticated (Contributor+) Remote Code Execution
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-86787
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Artus KG
More Details >
DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-111311
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More [doublescale]
Researcher
wachirapong kamphapong (wachiss)
More Details >
Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-81534
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Email Customizer for WooCommerce (Pro) [woocommerce-email-customizer]
Researcher
theviper17y
More Details >
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-86461
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Osman Hussein
More Details >
HivePress – Business Directory, Listings & Classified Ads Plugin <= 1.7.32 - Authenticated (Contributor+) Remote Code Execution
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-110887
Patch Status
Patched
Published
Oct 17, 2026
Affected Software
HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]
Researcher
AndrewN
More Details >
MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-111406
Patch Status
Patched
Published
Oct 17, 2026
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Peter Tang
More Details >
PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-85659
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
PilotPress [pilotpress]
Researcher
Supakiad S. (m3ez)
More Details >
Salon Booking System 10.17 - 10.31.10 - Authenticated (Salon Staff+) Privilege Escalation
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-110031
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
RIA Labs
More Details >
WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-92115
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Wordfence PRISM
More Details >
YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-92553
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports [yaysmtp]
Researcher
Wordfence PRISM
More Details >
Affiliates <= 7.0.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-108291
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Affiliates [affiliates]
Researcher
AndrewN
More Details >
Avventure <= 1.1.12 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62010
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Avventure [avventure]
Researcher
johska
More Details >
Bonbon <= 1.11 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62011
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Bonbon [bonbon]
Researcher
johska
More Details >
BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104995
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
BP Profile Search [bp-profile-search]
Researcher
snr
More Details >
Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-17031
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager]
Researcher
@nacento
More Details >
Coinpress <= 1.0.15 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62012
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Coinpress [coinpress]
Researcher
johska
More Details >
Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104745
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Customer Email Verification for WooCommerce [emails-verification-for-woocommerce]
Researcher
Wordfence PRISM
More Details >
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-17092
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]
Researcher
Supakiad S. (m3ez)
More Details >
Edge Decor <= 2.9 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62013
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Edge Decor [edge-decor]
Researcher
johska
More Details >
EmojiNation <= 1.0.12 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62014
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
EmojiNation [emojination]
Researcher
johska
More Details >
Filmax | Cinema & Movie News Magazine WordPress Theme <= 1.1.11 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62009
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Filmax | Cinema & Movie News Magazine WordPress Theme [filmax]
Researcher
johska
More Details >
Gamezone <= 1.1.11 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62015
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
gamezone [gamezone]
Researcher
johska
More Details >
Gamic - Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62016
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Gamic - Gaming Metaverse Game & Crypto WordPress Theme [gamic]
Researcher
johska
More Details >
Good Homes - Real Estate WordPress Theme <= 1.3.13 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62017
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Good Homes - Real Estate WordPress Theme [good-homes]
Researcher
johska
More Details >
Gravity Forms < 3.1.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-97296
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Gravity Forms [gravityforms]
Researcher
0xd4rk5id3
More Details >
Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-109221
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]
Researcher
Supakiad S. (m3ez)
More Details >
Gunslinger <= 1.11 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62018
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Gunslinger [gunslinger]
Researcher
johska
More Details >
Le Truffe <= 1.1.7 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-61998
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Le Truffe [letruffe]
Researcher
johska
More Details >
Legal Stone | Lawyers & Attorneys WordPress Theme <= 1.2.11 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-61997
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Legal Stone | Lawyers & Attorneys WordPress Theme [legal-stone]
Researcher
johska
More Details >
Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104909
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Mang Board [mangboard]
Researcher
Wordfence PRISM
More Details >
MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Deletion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-111398
Patch Status
Patched
Published
Oct 17, 2026
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
hhhai
More Details >
Marcell - Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62001
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Marcell - Personal Blog & Magazine WordPress Theme [marcell]
Researcher
johska
More Details >
Meals & Wheels <= 1.1.13 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62002
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Meals & Wheels [meals-wheels]
Researcher
johska
More Details >
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-103895
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]
Researcher
Azgnt
More Details >
Mission <= 1.22 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62003
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Mission [mission]
Researcher
johska
More Details >
Motorix <= 1.11 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62004
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Motorix [motorix]
Researcher
johska
More Details >
Muzicon - Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62005
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Muzicon - Music Festival & Concert WordPress Theme [muzicon]
Researcher
johska
More Details >
Nuts <= 1.12 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62006
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Nuts [nuts]
Researcher
johska
More Details >
Orpheus <= 1.8 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62008
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Orpheus [orpheus]
Researcher
johska
More Details >
ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-103367
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
ShopMagic – email automation for WordPress [shopmagic-for-woocommerce]
Researcher
crow
More Details >
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform < 2.17.2 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-107508
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform [ultimate-multisite]
Researcher
hanzzly
More Details >
User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-109447
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
Supakiad S. (m3ez)
More Details >
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-92798
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
Passakorn Yookindee
More Details >
Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-75903
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Vulnity Security [vulnity]
Researcher
Décio Brandão
More Details >
WPBot – ChatBot Conversational Forms <= 1.5.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-110886
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
WPBot – ChatBot Conversational Forms [conversational-forms]
Researcher
hinhlx
More Details >
Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
8.0
CVSS Rating
8.0 (High)
CVE-ID
CVE-2026-93953
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Backuply – Backup, Restore, Migrate and Clone [backuply]
Researcher
daroo
More Details >
Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
8.0
CVSS Rating
8.0 (High)
CVE-ID
CVE-2026-104932
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Search Regex [search-regex]
Researcher
R3D
More Details >
10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-103896
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]
Researcher
Swayam Bhageria
More Details >
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-102251
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro]
Researcher
andrea bocchetti
More Details >
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-103366
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
churchill11
More Details >
Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-104749
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation [bit-integrations]
Researcher
crow
More Details >
Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-108497
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
AndrewN
More Details >
Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-103423
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Booking Package [booking-package]
Researcher
afei
More Details >
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-109894
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Booktics – Appointment Booking Calendar for Service Businesses [booktics]
Researcher
Jacek Sowiński (dzaku)
More Details >
Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-104246
Patch Status
Unpatched
Published
Oct 14, 2026
Affected Software
Contact Form 7 Signature Addon [contact-form-7-signature-addon]
Researcher
Kiran Krishnakumar
More Details >
Fast Courier – Shipping & Freight 5.0.0 - 5.2.3 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89288
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Fast Courier – Shipping & Freight [fast-courier-shipping-freight]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-103525
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler [fluent-cart]
Researcher
Wordfence PRISM
More Details >
Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-95808
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]
Researcher
Jonah Burgess (CryptoCat)
More Details >
FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-107746
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout [funnel-builder]
Researcher
Kuba
More Details >
Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-96661
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Gmedia Photo Gallery [grand-media]
Researcher
zickzick2
More Details >
Green Popups < 7.6.3 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-94388
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Green Popups [halfdata-green-popups]
Researcher
Rafie Muhammad
More Details >
InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-109400
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]
Researcher
thevietronin
More Details >
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-78193
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
JTL-Connector for WooCommerce [woo-jtl-connector]
Researcher
Supakiad S. (m3ez)
More Details >
Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-107762
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
More Details >
Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-110590
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Klarna for WooCommerce [klarna-payments-for-woocommerce]
Researcher
Kuba
More Details >
LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-110284
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes [lifterlms]
Researcher
Adrien Brunner
More Details >
Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-15090
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Link Library [link-library]
Researcher
Osvaldo Noe Gonzalez Del Rio (Os)
More Details >
Link Whisper Free <= 0.9.7 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-109686
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Link Whisper Free [link-whisper]
Researcher
Tarcísio Luchesi
More Details >
Link Whisper Free <= 0.9.7 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-109688
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Link Whisper Free [link-whisper]
Researcher
Jacek Sowiński (dzaku)
More Details >
Mang Board <= 2.4.4 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-109698
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Mang Board [mangboard]
Researcher
AndrewN
More Details >
Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-104767
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Membership & User Roles for WooCommerce (Automatic Role Changer) [dfx-woo-role-changer]
Researcher
Azgnt
More Details >
Mobile Builder <= 1.4.2 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-103696
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Mobile builder [mobile-builder]
Researcher
Raphael P. Cigana
More Details >
Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-107659
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Kuba
More Details >
Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-111114
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit [nexter-extension]
Researcher
elaprendiz1927
More Details >
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-111408
Patch Status
Patched
Published
Oct 17, 2026
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Ihsan Saddan
More Details >
Strong Testimonials <= 3.3.12 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-107436
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
Ayukiab
More Details >
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Authenticated (Custom Role+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-106599
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
Ananda Dhakal
More Details >
Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-92766
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]
Researcher
Muboriz
More Details >
Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-103307
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Walletdoc Payment Gateway for WooCommerce [wc-walletdoc-payment-gateway]
Researcher
Naoki Kawahigashi
More Details >
WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-108123
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Wordfence PRISM
More Details >
WX Subscribe <= 1.2.1 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-91833
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
WX Subscribe 微信支付付费订阅 [wx-subscribe]
Researcher
Erwan LR
More Details >
Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
7.4
CVSS Rating
7.4 (High)
CVE-ID
CVE-2026-100163
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
OKISO
More Details >
ACF Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-109892
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
ACF Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Zein
More Details >
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.5 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-109694
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution [fluent-crm]
Researcher
AndrewN
More Details >
OTP Login With Phone Number, OTP Verification <= 1.8.77 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-110373
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
OTP Login With Phone Number, OTP Verification [login-with-phone-number]
Researcher
Peter Tang
More Details >
OttoKit: All-in-One Automation Platform <= 1.1.40 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-110372
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
OttoKit: All-in-One Automation Platform [suretriggers]
Researcher
Peter Tang
More Details >
PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-3712
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
PhastPress [phastpress]
Researcher
Itthidej Aramsri (Boeing777)
More Details >
Rede Itaú for WooCommerce <= 5.5.2 - Unauthenticated Arbitrary Order Status Manipulation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-92428
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit [woo-rede]
Researcher
JunHee CHO
More Details >
Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Arbitrary Order Status Modification
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-92429
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit [woo-rede]
Researcher
Naoki Kawahigashi
More Details >
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-103081
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon [woo-boost-sales]
Researcher
cazy
More Details >
User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-109145
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
User Rights Access Manager [user-rights-access-manager]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager < 2.4.0 - Unauthenticated Snippet Safe Mode Bypass
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-101301
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager [insert-headers-and-footers]
Researcher
Kenny of Greenhat Security
More Details >
AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-102562
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]
Researcher
Ivaylo
More Details >
AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-103422
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
AnyComment [anycomment]
Researcher
Kevin Whelan
More Details >
Auction Nudge – Your eBay Listings <= 8.4.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-61988
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Auction Nudge – Your eBay Listings [auction-nudge]
Researcher
AndrewN
More Details >
Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-102007
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation [bit-integrations]
Researcher
Wordfence PRISM
More Details >
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109895
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Booktics – Appointment Booking Calendar for Service Businesses [booktics]
Researcher
Jacek Sowiński (dzaku)
More Details >
BSK PDF Manager <= 3.8.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-108498
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
BSK PDF Manager [bsk-pdf-manager]
Researcher
Masaya Morita
More Details >
Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107758
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Colibri Page Builder [colibri-page-builder]
Researcher
Tudor Lasuschevici (Eutiphron)
More Details >
Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-97339
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Complianz GDPR/CCPA Cookie Consent Banner [complianz-gdpr]
Researcher
theviper17y
More Details >
Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-83592
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Contact Form DB for Enfold [contact-form-db-for-enfold]
Researcher
andrea bocchetti
More Details >
CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-110701
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
CP Multi View Events Calendar [cp-multi-view-calendar]
Researcher
Supakiad S. (m3ez)
More Details >
Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-93885
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Cryptocurrency Donation Box – Bitcoin & Crypto Donations [cryptocurrency-donation-box]
Researcher
Spy0x7
More Details >
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-77114
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Document Gallery [document-gallery]
Researcher
刀 妖
More Details >
Easy Property Listings <= 3.5.25 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-61989
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Easy Property Listings [easy-property-listings]
Researcher
Mor Golan
More Details >
EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-103899
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant]
Researcher
Afifudin Maarif
More Details >
European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-100316
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
European VAT Compliance Assistant for WooCommerce [woocommerce-eu-vat-compliance]
Researcher
Sebastian Albrecht (mySebbe)
More Details >
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-108491
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms]
Researcher
AndrewN
More Details >
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109990
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance [flying-scripts]
Researcher
Santh
More Details >
Forms < 3.0.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-86799
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Forms [forms-by-made-it]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-97398
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
theviper17y
More Details >
GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96768
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
GoSMTP Pro [gosmtp-pro]
Researcher
Rafie Muhammad
More Details >
Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-18548
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]
Researcher
thevietronin
More Details >
Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-89051
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Hide My WP Ghost – Security & Firewall [hide-my-wp]
Researcher
Pham Duc Anh
More Details >
HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109193
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]
Researcher
braintx
More Details >
JetEngine <= 3.8.16 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107870
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
JetEngine [jet-engine]
Researcher
nh4tvd
More Details >
Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104734
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
Wordfence PRISM
More Details >
LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109208
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
daroo
More Details >
LTL Freight Quotes – ODFL Edition < 4.2.19 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107160
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
LTL Freight Quotes – ODFL Edition [ltl-freight-quotes-odfl-edition]
Researcher
Ryan Fabella
More Details >
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109998
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Mang Board [mangboard]
Researcher
poiri3r
More Details >
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107751
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Mang Board [mangboard]
Researcher
leon figueira
More Details >
Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-88043
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Mang Board [mangboard]
Researcher
John Ryan Albon
More Details >
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-101924
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
NewStatPress [newstatpress]
Researcher
zickzick2
More Details >
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-100153
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
NewStatPress [newstatpress]
Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
More Details >
NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109513
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx]
Researcher
jiahao
More Details >
Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-95809
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights [opti-behavior]
Researcher
CHOIGYEONGMIN
More Details >
Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-95686
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights [opti-behavior]
Researcher
Décio Brandão
More Details >
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.12 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107428
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]
Researcher
Erik Debye
More Details >
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management <= 4.6.27 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-108484
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management [wp-payment-form]
Researcher
AndrewN
More Details >
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-111110
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Payment forms, Buy now buttons, and Invoicing System | GetPaid [invoicing]
Researcher
UKO
More Details >
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104764
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Post Export Import with Media [post-export-import-with-media]
Researcher
Wordfence PRISM
More Details >
PowerPack Lite for Beaver Builder <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-110897
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
PowerPack Lite for Beaver Builder [powerpack-addon-for-beaver-builder]
Researcher
Peter Tang
More Details >
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-18586
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
thevietronin
More Details >
Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107631
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Record of Consent Extension for Complianz [record-of-consent-extension-for-complianz]
Researcher
OKISO
More Details >
RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109207
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds]
Researcher
Adrien Brunner
More Details >
Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109232
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Maciej Komorowski
More Details >
Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96570
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]
Researcher
r3foxx
More Details >
Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-110382
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Khanh Nguyen
More Details >
Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104000
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Kuba
More Details >
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-111122
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
SiteOrigin CSS [so-css]
Researcher
poiri3r
More Details >
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107764
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
SiteOrigin CSS [so-css]
Researcher
Jakub Herman
More Details >
Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-95816
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Smart Forms – when you need more than just a contact form [smart-forms]
Researcher
thevietronin
More Details >
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-105874
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
neurotx
More Details >
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-109224
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
R3D
More Details >
TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107768
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]
Researcher
daroo
More Details >
Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-103999
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]
Researcher
Kuba
More Details >
User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-100186
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
whale120
More Details >
User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96660
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
Kuba
More Details >
User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-87111
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin [user-registration-pro]
Researcher
andrea bocchetti
More Details >
Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-94377
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Verified Reviews (Avis Vérifiés) [netreviews]
Researcher
nthng
More Details >
WP Booking System – Booking Calendar < 2.1.0.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107126
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Eric Buntain
More Details >
WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107648
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WP Sessions Time Monitoring Full Automatic [activitytime]
Researcher
caussao
More Details >
WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-97640
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) [wpconsent-cookies-banner-privacy-suite]
Researcher
daroo
More Details >
Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
6.8
CVSS Rating
6.8 (Medium)
CVE-ID
CVE-2026-107770
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Photo Engine (Media Organizer & Lightroom) [wplr-sync]
Researcher
Wordfence PRISM
More Details >
WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
6.8
CVSS Rating
6.8 (Medium)
CVE-ID
CVE-2026-109369
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Wordfence PRISM
More Details >
Frontend Admin by DynamiApps <= 3.29.0 - Authenticated (Administrator+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-81344
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
ACF Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Karthik Ramakrishnan
More Details >
Polylang <= 3.8.9 - Authenticated (Editor+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-97278
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Polylang [polylang]
Researcher
Ananda Dhakal
More Details >
Booster Elite for WooCommerce < 8.4.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Disclosure
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2023-25996
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Booster Elite for WooCommerce [booster-elite-for-woocommerce]
Researcher
Dave Jong
More Details >
Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-96562
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Broken Link Checker [broken-link-checker]
Researcher
Jakub Herman
More Details >
BSK PDF Manager <= 3.8.1 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-91074
Patch Status
Unpatched
Published
Oct 14, 2026
Affected Software
BSK PDF Manager [bsk-pdf-manager]
Researcher
Mohamed Bassia
More Details >
CP Multi View Events Calendar <= 1.4.41 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-109901
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
CP Multi View Events Calendar [cp-multi-view-calendar]
Researcher
Peter Tang
More Details >
Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-103911
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
Jakub Herman
More Details >
Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-101335
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researchers
Theklis
Jakub Herman
More Details >
HivePress – Business Directory, Listings & Classified Ads Plugin <= 1.7.32 - Authenticated (Subscriber+) Arbitrary CSS Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-110885
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]
Researcher
changsheng
More Details >
Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-101926
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Hyyan Integration for WooCommerce and Polylang [woo-poly-integration]
Researcher
HYEBIN NOH (sh)
More Details >
Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-103907
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit]
Researcher
Kuba
More Details >
LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-107744
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
Kuba
More Details >
Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-111106
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance [mail-mint]
Researcher
Wordfence PRISM
More Details >
MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-111399
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
hhhai
More Details >
Modern Events Calendar (Lite & Pro) <= 7.36.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-96534
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Modern Events Calendar Lite [modern-events-calendar-lite]
Modern Events Calendar [modern-events-calendar]
Researcher
Sanjar Tulkinov
More Details >
Modern Events Calendar Lite < 7.37.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-105067
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Modern Events Calendar Lite [modern-events-calendar-lite]
Researcher
Aarush Gaur
More Details >
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-86803
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Ocean Extra [ocean-extra]
Researcher
hashiramasenju333
More Details >
Salon Booking System <= 10.31.8 - Insufficient Authorization to Booking API Access
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-110013
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
vuxvinh
More Details >
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System <= 1.4.54 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-110895
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System [support-genix-lite]
Researcher
DERISK
More Details >
Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-93767
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Tainacan [tainacan]
Researcher
Wordfence PRISM
More Details >
Ukr-To-Lat <= 1.3.5 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-104122
Patch Status
Unpatched
Published
Oct 14, 2026
Affected Software
Ukr-To-Lat [ukr-to-lat]
Researcher
Seongwon Lee
More Details >
Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-109414
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]
Researcher
John Ryan Albon
More Details >
WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-109368
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Wordfence PRISM
More Details >
WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-109382
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents [wsp-mcp-ai-agents-connector]
Researcher
Wordfence PRISM
More Details >
Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107864
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
nh4tvd
More Details >
Blaze Demo Importer <= 1.0.16 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-106933
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Blaze Demo Importer [blaze-demo-importer]
Researcher
Luis Schlegel
More Details >
Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103425
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Booking Package [booking-package]
Researcher
Wordfence PRISM
More Details >
Books Gallery – Book Showcase, Library & Affiliate Plugin <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-108487
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Books Gallery – Book Showcase, Library & Affiliate Plugin [wp-books-gallery]
Researcher
Ananda Dhakal
More Details >
Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-77829
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Cooked – Recipe Management [cooked]
Researcher
Wordfence PRISM
More Details >
Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-16495
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Countdown Timer – Widget Countdown [widget-countdown]
Researcher
Yuto Hyakumoto
More Details >
Custom Query Blocks <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-108168
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Custom Query Blocks [post-type-archive-mapping]
Researcher
V1T
More Details >
Data Access <= 5.5.87 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-106470
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps [wp-data-access]
Researcher
Raphael P. Cigana
More Details >
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-100185
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]
Researcher
Sorra
More Details >
Document Gallery 4.0 - 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-74921
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Document Gallery [document-gallery]
Researcher
Philipp Doblhofer
More Details >
Donation Thermometer < 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-92409
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Donation Thermometer [donation-thermometer]
Researcher
Philipp Doblhofer
More Details >
Download Monitor <= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110375
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Download Monitor [download-monitor]
Researcher
Jacek Sowiński (dzaku)
More Details >
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-108478
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
nh4tvd
More Details >
FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-100106
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
FiboSearch – Ajax Search for WooCommerce [ajax-search-for-woocommerce]
Researcher
daroo
More Details >
FV Flowplayer Video Player 7.5.44.7212 - 7.5.55.7211 - Authenticated (Contributor+) Server-Side Request Forgery
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-85345
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Karthik Ramakrishnan
More Details >
FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-95807
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
FV Player 8 [fv-player]
Researcher
theviper17y
More Details >
FV Simpler SEO <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-54868
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
FV Simpler SEO [fv-all-in-one-seo-pack]
Researcher
Ananda Dhakal
More Details >
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107650
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Adrien Brunner
More Details >
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107754
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Sawyer
More Details >
GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110703
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
UKO
More Details >
GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111069
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
OKISO
More Details >
Gutenverse Form – Contact Form Builder, Block Form & Booking Form < 3.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-106469
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Gutenverse Form – Contact Form Builder, Block Form & Booking Form [gutenverse-form]
Researcher
John Ryan Albon
More Details >
HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109388
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]
Researcher
Sebastian Albrecht (mySebbe)
More Details >
Image Photo Gallery Final Tiles Grid < 3.6.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104644
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Abdullah Kareem
More Details >
Image Photo Gallery Final Tiles Grid < 3.6.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107178
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Ala Bouali
More Details >
Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-17001
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Luca Laytynher (LyT)
More Details >
IMPress for IDX Broker <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-54869
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
IMPress for IDX Broker [idx-broker-platinum]
Researcher
Ananda Dhakal
More Details >
JetElements <= 2.9.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107866
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
JetElements [jet-elements]
Researcher
nh4tvd
More Details >
JetMenu <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107865
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
JetMenu [jet-menu]
Researcher
nh4tvd
More Details >
JetSmartFilters <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110890
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
JetSmartFilters [jet-smart-filters]
Researcher
nh4tvd
More Details >
Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-14572
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]
Researcher
Pham Duc Anh
More Details >
Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104761
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Mang Board [mangboard]
Researcher
Wordfence PRISM
More Details >
Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109512
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Mang Board [mangboard]
Researcher
Wordfence PRISM
More Details >
MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111405
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Prakrit
More Details >
MDTF – Meta Data and Taxonomies Filter <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-108175
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]
Researcher
Ananda Dhakal
More Details >
Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107756
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Meow Lightbox [meow-lightbox]
Researcher
crow
More Details >
Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104726
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Name Directory [name-directory]
Researcher
Wordfence PRISM
More Details >
News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
News Kit Addons For Elementor [news-kit-elementor-addons]
Researcher
mamgad (mamgad)
More Details >
PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2025-9373
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
PeproDev Branches Map (Mapify) [pepro-mapify]
Researcher
Nabil Irawan
More Details >
PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97020
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
PO/MO Editor [pomo-editor]
Researcher
sermsak
More Details >
Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-78001
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor [post-and-page-builder]
Researcher
Omar Elshopky (3l5h0pky)
More Details >
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-108488
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
PowerPack Addons for Elementor: Widgets, Form Styler and Templates [powerpack-lite-for-elementor]
Researcher
nh4tvd
More Details >
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111400
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
PowerPack Addons for Elementor: Widgets, Form Styler and Templates [powerpack-lite-for-elementor]
Researcher
nh4tvd
More Details >
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-108490
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]
Researcher
Jacek Sowiński (dzaku)
More Details >
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-108482
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]
Researcher
nh4tvd
More Details >
Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110664
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Wordfence PRISM
More Details >
Presto Player <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109893
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Presto Player [presto-player]
Researcher
Jacek Sowiński (dzaku)
More Details >
Pricing Table – Block – Show Product or Service Pricing in Table Format 1.0.7 - 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-86797
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Pricing Table – Block – Show Product or Service Pricing in Table Format [b-pricing-table]
Researcher
Philipp Doblhofer
More Details >
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109691
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite]
Researcher
nh4tvd
More Details >
Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110017
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Quick PayPal Payments: Payment Button & Form [quick-paypal-payments]
Researcher
Wordfence PRISM
More Details >
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107862
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
hhhai
More Details >
Responsive Slider <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-54867
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Responsive Slider [responsive-slider]
Researcher
Ananda Dhakal
More Details >
Salon Booking System <= 10.31.10 - Authenticated (Salon Staff+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110033
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
vuxvinh
More Details >
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories 4.10.1 - 4.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105261
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator]
Researcher
Civitasmass
More Details >
Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103369
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Social Share Buttons & Analytics Plugin – GetSocial.io [wp-share-buttons-analytics-by-getsocial]
Researcher
Alz
More Details >
Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-100108
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Social Share Buttons [share-button]
Researcher
chimerascope
More Details >
Social Share Buttons <= 1.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109702
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Social Share Buttons [share-button]
Researcher
Prakrit
More Details >
SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-100158
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
SQL Chart Builder [sql-chart-builder]
Researcher
JEON GYEOMSEONG
More Details >
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109697
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]
Researcher
Jacek Sowiński (dzaku)
More Details >
SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96870
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
SureDash – Community, Courses & Member Dashboard [suredash]
Researcher
Jacek Sowiński (dzaku)
More Details >
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-108495
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms]
Researcher
Jacek Sowiński (dzaku)
More Details >
The Events Calendar <= 6.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110903
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Jacek Sowiński (dzaku)
More Details >
Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111726
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Themify Builder [themify-builder]
Researcher
Wordfence PRISM
More Details >
Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109989
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Themify Popup [themify-popup]
Researcher
Wordfence PRISM
More Details >
Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103480
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental [tourfic]
Researcher
Wordfence PRISM
More Details >
Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97470
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental [tourfic]
Researcher
nudien
More Details >
Tutor LMS – eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-111407
Patch Status
Patched
Published
Oct 17, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
jydae
More Details >
Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-93681
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
lhking
More Details >
User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107748
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]
Researcher
UKO
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105881
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
Deva Parekh
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105882
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
Deva Parekh
More Details >
VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-78087
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
VK Blocks [vk-blocks]
Researcher
theviper17y
More Details >
Weaver Xtreme Theme Support <= 7.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-54870
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Weaver Xtreme Theme Support [weaverx-theme-support]
Researcher
Ananda Dhakal
More Details >
WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-110290
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WebberZone Top 10 — Popular Posts [top-10]
Researcher
Wordfence PRISM
More Details >
WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-93535
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Dark Mode – Improve Accessibility with AI Powered Dark Theme [wp-dark-mode]
Researchers
Athiwat Tiprasaharn (Jitlada)
Itthidej Aramsri (Boeing777)
Suphakit Phrmduang (TORTY)
More Details >
WP Testimonials <= 1.4.13 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-89269
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
WP Testimonials [testimonial-widgets]
Researcher
Jaze
More Details >
WP w3all phpBB <= 3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107422
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
WP w3all phpBB [wp-w3all-phpbb-integration]
Researcher
Peter Tang
More Details >
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109985
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN [xspeed]
Researcher
Wordfence PRISM
More Details >
YITH WooCommerce Compare <= 3.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-106604
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
YITH WooCommerce Compare [yith-woocommerce-compare]
Researcher
Intrudify
More Details >
YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-109983
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
YMC Filter [ymc-smart-filter]
Researcher
Wordfence PRISM
More Details >
Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.5 - Authenticated (Author+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-110898
Patch Status
Patched
Published
Oct 17, 2026
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Adam Kahlon
More Details >
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.5 - Authenticated (Contributor+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-109693
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution [fluent-crm]
Researcher
SVO
More Details >
Frontend Dashboard <= 3.0.7 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-107424
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Frontend Dashboard [frontend-dashboard]
Researcher
Đỗ Trung Kiên
More Details >
Document Gallery <= 5.1.1 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-74920
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Document Gallery [document-gallery]
Researcher
Pedro Pinho
More Details >
eStore <= 1.6.13 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-108485
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
eStore [estore]
Researcher
Jacek Sowiński (dzaku)
More Details >
Fancy Comments WordPress <= 1.2.21 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-110384
Patch Status
Unpatched
Published
Oct 15, 2026
Affected Software
Fancy Comments WordPress [fancy-facebook-comments]
Researcher
Pablo González Pérez
More Details >
Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-103481
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Gwolle Guestbook [gwolle-gb]
Researcher
crow
More Details >
Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-108483
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Hippoo Mobile App for WooCommerce [hippoo]
Researcher
sengtocxoen
More Details >
Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-111601
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Hippoo Mobile App for WooCommerce [hippoo]
Researcher
Wordfence PRISM
More Details >
Houzez <= 4.4.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-96339
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Houzez [houzez]
Researcher
Rafie Muhammad
More Details >
Link Whisper Free <= 0.9.7 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-109685
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Link Whisper Free [link-whisper]
Researcher
braintx
More Details >
Marin <= 0.1.1 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2024-10303
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Marin [marin]
Researcher
0xd4rk5id3
More Details >
PAYCOMET for WooCommerce <= 5.45 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-109701
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
PAYCOMET for WooCommerce [paytpv-for-woocommerce]
Researcher
Ananda Dhakal
More Details >
Photo Album Plus <= 9.2.11.1 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-110981
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Karthik Ramakrishnan
More Details >
Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-18557
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Dmitrii Ignatyev
More Details >
Quiz Maker by AYS <= 6.7.1.91 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-110379
Patch Status
Patched
Published
Oct 17, 2026
Affected Software
Quiz Maker by AYS [quiz-maker]
Researcher
Taegyeong Yun
More Details >
SimplyRETS Real Estate IDX <= 3.2.9 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-105066
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
SimplyRETS Real Estate IDX [simply-rets]
Researcher
Peter Tang
More Details >
Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-15180
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Tracking Code Manager [tracking-code-manager]
Researcher
Suredsi Ulpada (cyberdesu)
More Details >
Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-88963
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
Sevada797
More Details >
XStore < 9.7.9 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-105065
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
XStore [xstore]
Researcher
Nguyen Ba Khanh
More Details >
Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>
5.9
CVSS Rating
5.9 (Medium)
CVE-ID
CVE-2026-104769
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Debloat – Remove Unused CSS, Optimize JS [debloat]
Researcher
Kuba
More Details >
Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-107649
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Events Made Easy [events-made-easy]
Researcher
Jacek Sowiński (dzaku)
More Details >
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-104003
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar]
Researcher
Kuba
More Details >
Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-104001
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated [slim-seo]
Researcher
Kuba
More Details >
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-15222
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
hashiramasenju333
More Details >
weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-110253
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
weForms – Easy Drag & Drop Contact Form Builder For WordPress [weforms]
Researcher
Kuba
More Details >
WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-8145
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
WholesaleX – All-in-One B2B Solution with Wholesale Pricing [wholesalex]
Researcher
Ronnachai Chaipha (rxnr)
More Details >
WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-110252
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Elieve
More Details >
2Way VideoCalls and Random Chat – HTML5 Webcam Videochat <= 6.1.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110883
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
2Way VideoCalls and Random Chat – HTML5 Webcam Videochat [webcam-2way-videochat]
Researcher
Anatoly Gorbounov
More Details >
Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.3 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108489
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Active Woot Products Tables for WooCommerce. 100% FREE [profit-products-tables-for-woocommerce]
Researcher
hooman
More Details >
ActiveTrail for WooCommerce <= 1.2.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106028
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
ActiveTrail for WooCommerce [activetrail-for-woocommerce]
Researcher
Ryan Fabella
More Details >
Ajax Search Lite – Live Search & Filter <= 4.14.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110360
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Ajax Search Lite – Live Search & Filter [ajax-search-lite]
Researcher
Alex J.
More Details >
App Builder 3.8.4 - 5.7.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94294
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
App Builder – Create Native Android & iOS Apps On The Flight [app-builder]
Researcher
RIA Labs
More Details >
Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Arbitrary Order Status Manipulation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87974
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Asaas Gateway for WooCommerce [woo-asaas]
Researcher
Guillermo Álvarez Fernández
More Details >
Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97471
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Avada (Fusion) Builder [fusion-builder]
Researcher
Luke Eldridge (system)
More Details >
AWP Classifieds < 4.4.9 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-96904
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
AWP Classifieds [another-wordpress-classifieds-plugin]
Researcher
Usama Arshad
More Details >
bbPress < 2.6.19 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110762
Patch Status
Unpatched
Published
Oct 14, 2026
Affected Software
bbPress [bbpress]
Researcher
Truong Nguyen Long
More Details >
BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106010
Patch Status
Unpatched
Published
Oct 16, 2026
Affected Software
BDM Digital Payment Gateway [bdm-digital-payment-gateway]
Researcher
Enrico Marcolini
More Details >
Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109684
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Parlix
More Details >
Bookit — Booking & Appointment Calendar <= 2.6.0.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110900
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Bookit — Booking & Appointment Calendar [bookit]
Researcher
Alpaslan Fatih Sözer
More Details >
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108477
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Booktics – Appointment Booking Calendar for Service Businesses [booktics]
Researcher
myhappyhoon
More Details >
Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary HTML Attribute Injection
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-102389
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Broken Link Checker [broken-link-checker]
Researcher
changsheng
More Details >
Bus Ticket Booking with Seat Reservation <= 5.9.7 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107425
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Bus Ticket Booking with Seat Reservation [bus-ticket-booking-with-seat-reservation]
Researcher
Peter Tang
More Details >
CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Arbitrary Payment Status Manipulation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105975
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
CamPay Shortcode Payment Gateway [campay-shortcode-payment-gateway]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Status Manipulation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103324
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Cardinity Payment Gateway for WooCommerce [cardinity-free-payment-gateway-for-woocommerce]
Researcher
Naoki Kawahigashi
More Details >
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails < 2.1.4 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-96900
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails [woo-cart-abandonment-recovery]
Researcher
JunHee CHO
More Details >
CodeAtoZ B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105969
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
CodeAtoZ B2B Suite for WooCommerce [codeatoz-b2b-suite-for-woocommerce]
Researcher
Pedro Pinho
More Details >
Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103311
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Coinbase Commerce Payment Gateway for WooCommerce [coinbase-commerce]
Researcher
Naoki Kawahigashi
More Details >
Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-92427
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Coinsnap Bitcoin Crowdfunding [coinsnap-bitcoin-crowdfunding]
Researcher
Pedro Pinho
More Details >
Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107652
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Database Addon for Contact Form 7 – CFDB7 [contact-form-cfdb7]
Researcher
Sawyer
More Details >
Document Gallery <= 5.1.1 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-74923
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Document Gallery [document-gallery]
Researcher
a0yark
More Details >
Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-74922
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Document Gallery [document-gallery]
Researcher
Artus KG
More Details >
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar <= 6.5.2 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107416
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar [webba-booking-lite]
Researcher
HyeonMin Kim
More Details >
Easy Property Listings <= 3.5.27 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-96902
Patch Status
Patched
Published
Oct 17, 2026
Affected Software
Easy Property Listings [easy-property-listings]
Researcher
Usama Arshad
More Details >
eaSYNC <= 1.3.30 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103304
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
eaSYNC Booking – Hotels, Restaurants & Car Rentals [easync-booking]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Electronic Signature Add-on for Fluent Forms <= 2.0.5 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110383
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Electronic Signature Add-on for Fluent Forms [signature-fluent-contract-forms-add-on]
Researcher
Oly Hossen
More Details >
ElementsReady Addons for Elementor <= 6.7.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-91047
Patch Status
Unpatched
Published
Oct 16, 2026
Affected Software
ElementsReady Addons for Elementor [element-ready-lite]
Researcher
Ryan Fabella
More Details >
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109898
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Charles Vosburgh
More Details >
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110380
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
myhappyhoon
More Details >
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Unauthenticated Race Condition
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42689
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
Ananda Dhakal
More Details >
Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.22 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106605
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Flexible Quantity – Measurement Price Calculator for WooCommerce [flexible-quantity-measurement-price-calculator-for-woocommerce]
Researcher
Peter Tang
More Details >
Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.23 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110364
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Flexible Quantity – Measurement Price Calculator for WooCommerce [flexible-quantity-measurement-price-calculator-for-woocommerce]
Researcher
myhappyhoon
More Details >
FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler <= 1.7.1 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109695
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler [fluent-cart]
Researcher
AndrewN
More Details >
FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-89286
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
FormFlow for GoHighLevel (GHL) – Send Form Leads to GHL CRM [formflow-for-gohighlevel]
Researcher
Ehab M.Kandah
More Details >
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108486
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
Andrei
More Details >
FOX – Currency Switcher Professional for WooCommerce <= 1.5.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108174
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
FOX – Currency Switcher Professional for WooCommerce [woocommerce-currency-switcher]
Researcher
Je22y
More Details >
Frontend Admin by DynamiApps <= 3.29.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-81343
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
ACF Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Karthik Ramakrishnan
More Details >
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI 7.9.5 - 8.0.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107320
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]
Researcher
Usama Arshad
More Details >
Gantry 5 Framework <= 5.6.4 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110889
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Gantry 5 Framework [gantry5]
Researcher
braintx
More Details >
Gateway for Vantiv on WC <= 1.0.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106014
Patch Status
Unpatched
Published
Oct 16, 2026
Affected Software
Gateway for Vantiv on WC [gateway-for-vantiv-on-wc]
Researcher
Enrico Marcolini
More Details >
HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107646
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
HUSKY – Products Filter for WooCommerce Professional [woocommerce-products-filter]
Researcher
Sawyer
More Details >
iPOSpays Payment Gateway for WooCommerce <= 1.4.6 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86791
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
iPOSpays Payment Gateway for WooCommerce [ipospays-gateways-wc]
Researcher
Pedro Pinho
More Details >
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107431
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Intrudify
More Details >
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110880
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages [convertkit]
Researcher
Dthangws
More Details >
Knowledge Base <= 3.2.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108499
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Knowledge Base [knowledgebase]
Researcher
myhappyhoon
More Details >
Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-12272
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Lightweight Cookie Notice – Cookie Banner for Cookie Consent [lightweight-cookie-notice-free]
Researcher
wesley (wcraft)
More Details >
MAIO <= 7.3.21 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109930
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
MAIO – ChatGPT SEO Tracking & AI Search Optimization [maio-the-new-ai-geo-seo-tool]
Researcher
Ryan Fabella
More Details >
MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111397
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Nixxies
More Details >
NEX-Forms – Ultimate Forms Plugin for WordPress 9.2.1 - 9.3.0 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106166
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Farid Narimanov
More Details >
Ninja Forms Signature Contract Add-On <= 3.2.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110378
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Ninja Forms Signature Contract Add-On [ninja-signature-contract-forms-add-on]
Researcher
Oly Hossen
More Details >
NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110721
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar [notificationx]
Researcher
Eunho Kim
More Details >
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.12 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107426
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]
Researcher
Peter Tang
More Details >
Passster – Password Protect Pages and Content <= 4.3.18 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110896
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Passster – Password Protect Pages and Content [content-protector]
Researcher
azqzazq1
More Details >
Patreon WordPress <= 1.9.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-92431
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Patreon WordPress [patreon-connect]
Researcher
JunHee CHO
More Details >
Pay for Payment for WooCommerce – Payment Gateway Fees & Discounts <= 3.0.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108493
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Pay for Payment for WooCommerce – Payment Gateway Fees & Discounts [woocommerce-pay-for-payment]
Researcher
myhappyhoon
More Details >
PeachPay 1.117.9 - 1.120.69 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103376
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) [peachpay-for-woocommerce]
Researcher
Naoki Kawahigashi
More Details >
PlanetStudio Payment Gateway <= 1.3.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110362
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
PlanetStudio Payment Gateway [planetstudio-payment-gateway]
Researcher
myhappyhoon
More Details >
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109890
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]
Researcher
Mohammed Dsleman
More Details >
Product Designer <= 1.0.40 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87844
Patch Status
Unpatched
Published
Oct 15, 2026
Affected Software
PickPlugins Product Designer for WooCommerce [product-designer]
Researcher
Valida Abdullayeva
More Details >
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant < 5.3.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87968
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant [shopping-feed-for-google]
Researcher
JunHee CHO
More Details >
Products Restricted Users for WooCommerce <= 0.7 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107863
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Products Restricted Users for WooCommerce [woo-products-restricted-users]
Researcher
Oly Hossen
More Details >
Push Notification for Post and BuddyPress <= 3.23 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107417
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Push Notification for Post and BuddyPress [push-notification-for-post-and-buddypress]
Researcher
Peter Tang
More Details >
Quick PayPal Payments: Payment Button & Form <= 6.0.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108492
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Quick PayPal Payments: Payment Button & Form [quick-paypal-payments]
Researcher
Oly Hossen
More Details >
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.280 - Missing Authorization to Unauthenticated SEO Data Deletion
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104751
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Duy Tran
More Details >
Restricted Site Access <= 7.6.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110227
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Restricted Site Access [restricted-site-access]
Researcher
myhappyhoon
More Details >
Robokassa payment gateway for Woocommerce < 1.9.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-91076
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Robokassa payment gateway for Woocommerce [robokassa]
Researcher
JunHee CHO
More Details >
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon <= 1.3.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103080
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon [woo-boost-sales]
Researcher
dcs
More Details >
Salon Booking System <= 10.31.10 - Unauthenticated Negative Booking Total Creation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110034
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
vuxvinh
More Details >
Salon Booking System <= 10.31.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110014
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Raphael P. Cigana
More Details >
Sifalo Pay – Mobile Money & Card Payments for WooCommerce 2.0 - 2.5.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94261
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Sifalo Pay – Mobile Money & Card Payments for WooCommerce [sifalo-pay]
Researcher
Ryan Fabella
More Details >
Sifalo Pay – Mobile Money & Card Payments for WooCommerce 2.0 - 2.5.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94260
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Sifalo Pay – Mobile Money & Card Payments for WooCommerce [sifalo-pay]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Site Reviews <= 8.3.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110366
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Site Reviews [site-reviews]
Researcher
Ecologic
More Details >
Skydropx <= 2.1.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108480
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Skydropx [skydropx]
Researcher
Nixxies
More Details >
Snap Finance <= 3.11.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94273
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Snap Finance [snap-finance-checkout]
Researcher
Ryan Fabella
More Details >
Snap Finance 1.0.8 - 3.11.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94272
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Snap Finance [snap-finance-checkout]
Researcher
Enrico Marcolini
More Details >
Spin Wheel <= 2.2.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106031
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Spin Wheel [spin-wheel]
Researcher
Aditya Gurav
More Details >
Subscribe to Comments <= 2.3.2 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-91830
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Subscribe to Comments [subscribe-to-comments]
Researcher
Het Kalariya
More Details >
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers < 3.7.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108069
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Raphael P. Cigana
More Details >
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109689
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Rodrigo Cabo
More Details >
ThirstyAffiliates <= 3.12.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97314
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin [thirstyaffiliates]
Researcher
Usama Arshad
More Details >
Tickera – Sell Tickets & Manage Events < 3.6.0.4 - Unauthenticated Arbitrary Order Payment Confirmation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-88998
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Ryan Fabella
More Details >
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94231
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Ashok Chapagai
More Details >
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94230
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Amity Gilmour
More Details >
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94228
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Mikica Ivosevic
More Details >
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94229
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Enrico Marcolini
More Details >
Trust Payments Gateway for WooCommerce < 3.1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87843
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Trust Payments Gateway for WooCommerce [trust-payments-hosted-payment-pages-integration]
Researcher
Ryan Fabella
More Details >
Tutor LMS <= 4.1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-96537
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
Kevin Chen
More Details >
User Manager 2.9 - 2.9.19 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110527
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]
Researcher
Sanjorn Keeratirungsan
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106597
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
Charles Vosburgh
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109699
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
nov1337
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106598
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
sumayfe
More Details >
Visma Pay for Woocommerce < 1.2.2 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103308
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Visma Pay for Woocommerce [visma-pay-payment-gateway]
Researcher
Naoki Kawahigashi
More Details >
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-110367
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce [woosquare]
Researcher
Peter Tang
More Details >
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps < 5.5.77 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106098
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps [wp-data-access]
Researcher
Muni Nitish Kumar Yaddala
More Details >
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps < 5.5.84 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106099
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps [wp-data-access]
Researcher
Raphael P. Cigana
More Details >
WP Easy Pay – Payment and Donation Form Builder for Square <= 4.5.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-96449
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WP Easy Pay – Payment and Donation Form Builder for Square [wp-easy-pay]
Researcher
Asim Alshaya
More Details >
WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security < 7.8.8.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108064
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
WP Encryption: Easy SSL / HTTPS & Free SSL certificate, HTTPS redirect [wp-letsencrypt-ssl]
Researchers
Artus KG
Shhriyash
More Details >
WP OAuth Server ( Login with WordPress ) <= 6.4.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107433
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
WP OAuth Server ( Login with WordPress ) [miniorange-oauth-20-server]
Researcher
nguyen viet tin
More Details >
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.23 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-108496
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]
Researcher
Truebird
More Details >
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass on Paid Forms
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-82844
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite]
Researcher
Abdulrhman Mari
More Details >
WPGraphQL <= 2.24.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-109703
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
WPGraphQL [wp-graphql]
Researcher
Heinrihs Skrodelis
More Details >
YITH PayPal Express Checkout for WooCommerce <= 1.61.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-111409
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
YITH PayPal Express Checkout for WooCommerce [yith-paypal-express-checkout-for-woocommerce]
Researcher
Oly Hossen
More Details >
affiliate-toolkit <= 3.8.8 - Authenticated (Editor+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-110179
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Pedro Pinho
More Details >
Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-15399
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Animated Number Counters [animated-number-counters]
Researcher
Wordfence PRISM
More Details >
FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-103518
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler [fluent-cart]
Researcher
Wordfence PRISM
More Details >
Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-107757
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Gallery Custom Links [gallery-custom-links]
Researcher
crow
More Details >
Link Whisper Free <= 0.9.7 - Authenticated (Editor+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-109687
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Link Whisper Free [link-whisper]
Researcher
mrhaji_8
More Details >
Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-110268
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Post Export Import with Media [post-export-import-with-media]
Researcher
Wordfence PRISM
More Details >
Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-107752
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Wordfence PRISM
More Details >
WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.1.1 - Authenticated (Editor+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-108179
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
WOLF – WordPress Posts Bulk Editor and Manager Professional [bulk-editor]
Researcher
iczdblindman
More Details >
WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-111178
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Wordfence PRISM
More Details >
Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
4.8
CVSS Rating
4.8 (Medium)
CVE-ID
CVE-2026-100159
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups [ays-popup-box]
Researcher
YC_Infosec
More Details >
WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
4.8
CVSS Rating
4.8 (Medium)
CVE-ID
CVE-2026-104755
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
Wordfence PRISM
More Details >
Otter Blocks <= 3.2.2 - Unauthenticated Open Redirect
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-109937
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]
Researcher
John Ryan Albon
More Details >
Patreon WordPress <= 1.9.0 - Unauthenticated Open Redirect
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-92432
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Patreon WordPress [patreon-connect]
Researcher
Mike Gozdiskowski
More Details >
Responsive Blocks – Page Builder for Blocks & Patterns < 2.3.0 - Unauthenticated Arbitrary HTML Injection in Notification Email
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-97315
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Responsive Blocks – Page Builder for Blocks & Patterns [responsive-block-editor-addons]
Researcher
Amin Guliyev
More Details >
Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
4.7
CVSS Rating
4.7 (Medium)
CVE-ID
CVE-2026-100193
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
Kuba
More Details >
Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-89097
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Michal Kanas (Thor)
More Details >
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution <= 5.4.14 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110365
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Intrudify
More Details >
Advanced Post Manager <= 4.5.6 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111396
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Advanced Post Manager [advanced-post-manager]
Researcher
cazy
More Details >
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.8.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110888
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine]
Researcher
Jacek Sowiński (dzaku)
More Details >
Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103380
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
walid213
More Details >
aThemeArt Theme Helper <= 1.0.8 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-111413
Patch Status
Unpatched
Published
Oct 16, 2026
Affected Software
aThemeArt Theme Helper [athemeart-theme-helper]
Researcher
mamgad
More Details >
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107418
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Booktics – Appointment Booking Calendar for Service Businesses [booktics]
Researcher
dzeusking
More Details >
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.6 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-108475
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]
Researcher
Peter Tang
More Details >
Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110019
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Bulk Page Generator – LPagery [lpagery]
Researcher
Wordfence PRISM
More Details >
Classified Listing – AI-Powered Classified ads & Business Directory < 6.1.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-106646
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Naoki Kawahigashi
More Details >
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-89280
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]
Researcher
Supakiad S. (m3ez)
More Details >
Download Monitor integration for WooCommerce <= 1.0.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109896
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Download Monitor integration for WooCommerce [download-monitor-integration-for-woocommerce]
Researcher
Mash
More Details >
Easy HTTPS Redirection (SSL) <= 2.0.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104643
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
Easy HTTPS Redirection (SSL) [https-redirection]
Researcher
Mohammed Abd Alrahman
More Details >
Easy Property Listings <= 3.5.26 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-96903
Patch Status
Patched
Published
Oct 17, 2026
Affected Software
Easy Property Listings [easy-property-listings]
Researcher
Usama Arshad
More Details >
Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-11905
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Elementor Website Builder – more than just a page builder [elementor]
Researcher
Or Benit
More Details >
ElementsReady Addons for Elementor <= 6.7.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-91046
Patch Status
Unpatched
Published
Oct 16, 2026
Affected Software
ElementsReady Addons for Elementor [element-ready-lite]
Researcher
Stefan Spasic
More Details >
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) <= 1.5.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103083
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) [elex-bulk-edit-products-prices-attributes-for-woocommerce-basic]
Researcher
sanghyeok Kim
More Details >
Event Post <= 6.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107427
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Event Post [event-post]
Researcher
genisis-lab
More Details >
Event Post <= 6.1.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107432
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Event Post [event-post]
Researcher
Ananda Dhakal
More Details >
Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107763
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Fastcache by Host.it [fastcache-by-host-it]
Researcher
Wordfence PRISM
More Details >
Flexible Subscriptions <= 1.8.4 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107869
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Flexible Subscriptions [flexible-subscriptions]
Researcher
Ivan
More Details >
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 2.1.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109696
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]
Researcher
Hamza Tlili
More Details >
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 8.0.6 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107319
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]
Researcher
Shirshak
More Details >
Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109191
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy [image-hub]
Researcher
crow
More Details >
Infinite Uploads – Offload, Optimize & Organize Your Media Library <= 3.4.1 - Authenticated (Contributor+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110361
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Infinite Uploads – Offload, Optimize & Organize Your Media Library [infinite-uploads]
Researcher
Peter Tang
More Details >
MB Custom Post Types & Custom Taxonomies <= 2.12.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109982
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
MB Custom Post Types & Custom Taxonomies [mb-custom-post-type]
Researcher
Naoki Kawahigashi
More Details >
Modern Events Calendar Lite <= 7.36.0 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110069
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Modern Events Calendar Lite [modern-events-calendar-lite]
Researcher
Usama Arshad
More Details >
Modern Events Calendar Lite <= 7.36.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110070
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Modern Events Calendar Lite [modern-events-calendar-lite]
Researcher
Nguyen Duc Thinh
More Details >
OTP Login With Phone Number, OTP Verification <= 1.8.77 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110374
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
OTP Login With Phone Number, OTP Verification [login-with-phone-number]
Researcher
myhappyhoon
More Details >
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.12 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107429
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]
Researcher
Erik Debye
More Details >
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.13 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-108476
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]
Researcher
cazy
More Details >
Patreon WordPress <= 1.10.0 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-108481
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Patreon WordPress [patreon-connect]
Researcher
mamgad
More Details >
Patreon WordPress <= 1.9.0 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-92433
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Patreon WordPress [patreon-connect]
Researcher
JunHee CHO
More Details >
Patreon WordPress <= 1.9.17 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-108479
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
Patreon WordPress [patreon-connect]
Researcher
Asim Alshaya
More Details >
Product Delivery Date for WooCommerce – Lite <= 3.3.1 - Authenticated (Contributor+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110191
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Product Delivery Date for WooCommerce – Lite [product-delivery-date-for-woocommerce-lite]
Researcher
Farid Narimanov
More Details >
rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-88927
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Lawal Qasim
More Details >
Salon Booking System <= 10.31.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110035
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Andy Urlep
More Details >
Salon Booking System <= 10.31.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110032
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Utkarsh Choudhary
More Details >
Salon Booking System <= 10.31.2 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110012
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Andy Urlep
More Details >
Salon Booking System <= 10.31.8 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110015
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Raphael P. Cigana
More Details >
Simply Schedule Appointments <= 1.6.12.35 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110381
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
ssophiz
More Details >
SmartCrawl SEO checker, analyzer & optimizer <= 3.16.4 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110901
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
SmartCrawl SEO checker, analyzer & optimizer [smartcrawl-seo]
Researcher
AndrewN
More Details >
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110882
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]
Researcher
Khubab Ahmed
More Details >
Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-108092
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Blog2Social: Social Media Auto Post & Scheduler [blog2social]
Researcher
Kazuma Matsumoto
More Details >
Squeeze <= 1.8.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110029
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Squeeze – Browser-Based Image Compression & WebP Converter (No API, No Limits) [squeeze]
Researcher
Naoki Kawahigashi
More Details >
Strong Testimonials <= 3.3.12 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110371
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
Ayukiab
More Details >
Strong Testimonials <= 3.3.12 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109897
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
Gwangwon Kim (GOOK_BOB)
More Details >
Tainacan < 1.4.0 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-90989
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Tainacan [tainacan]
Researcher
Artus KG
More Details >
Tasty Recipes Lite 1.2 - 1.2.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110026
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Tasty Recipes Lite – WordPress Recipe Card Plugin with Built-In Recipe Schema [tasty-recipes-lite]
Researcher
Usama Arshad
More Details >
TMDS – Dropshipping for TEMU and Woo <= 1.0.15 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103356
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
TMDS – Dropshipping for TEMU and Woo [tmds-dropshipping-for-temu-and-woo]
Researcher
Aarush Gaur
More Details >
Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-92715
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
owlmind
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103076
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
b1ue0cean
More Details >
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-109692
Patch Status
Patched
Published
Oct 13, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
Anatoly Gorbounov
More Details >
User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-92978
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]
Researcher
Jonah Burgess (CryptoCat)
More Details >
VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok <= 1.2.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107430
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok [videowhisper-site-manager]
Researcher
Erik Debye
More Details >
Visual Form Builder <= 3.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105974
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Visual Form Builder [visual-form-builder]
Researcher
Het Kalariya
More Details >
Visual Form Builder <= 3.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105973
Patch Status
Unpatched
Published
Oct 13, 2026
Affected Software
Visual Form Builder [visual-form-builder]
Researcher
Chamseddine Bouzaiene
More Details >
WordLift – AI powered SEO – Schema <= 3.54.15 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-110891
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WordLift – AI powered SEO – Schema [wordlift]
Researcher
Peter Tang
More Details >
WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-19798
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters [wp-map-block]
Researcher
Wordfence PRISM
More Details >
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.22 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107423
Patch Status
Patched
Published
Oct 12, 2026
Affected Software
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]
Researcher
Atia Avela
More Details >
WP-Members Membership Plugin <= 3.5.7 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-61994
Patch Status
Unpatched
Published
Oct 12, 2026
Affected Software
WP-Members Membership Plugin [wp-members]
Researcher
Intrudify
More Details >
YITH WooCommerce Popup < 1.60.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-92426
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
YITH WooCommerce Popup [yith-woocommerce-popup]
Researcher
JunHee CHO
More Details >
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
3.7
CVSS Rating
3.7 (Low)
CVE-ID
CVE-2026-111602
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]
Researcher
Jiří Fryjauf (jfryjauf)
More Details >
AI Engine <= 3.7.8 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-111041
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine]
Researcher
Karthik Ramakrishnan
More Details >
AI Engine <= 3.7.8 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-110976
Patch Status
Patched
Published
Oct 16, 2026
Affected Software
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine]
Researcher
Karthik Ramakrishnan
More Details >
Smush <= 4.3.3 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-110039
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit]
Researcher
Erwan LR
More Details >
WP 2FA – Two-factor authentication for WordPress < 4.2.0 - Authenticated (Administrator+) Insecure Direct Object Reference
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-108066
Patch Status
Patched
Published
Oct 14, 2026
Affected Software
WP 2FA – Two-factor authentication for WordPress [wp-2fa]
Researcher
Muni Nitish Kumar Yaddala
More Details >
WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-109401
Patch Status
Patched
Published
Oct 15, 2026
Affected Software
WP Mail Logging [wp-mail-logging]
Researcher
Sawyer
More Details >
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026) appeared first on Wordfence.
来源：Wordfence 官方博客 · https://www.wordfence.com/blog/2026/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-october-12-2026-to-october-18-2026/
部分链接为推广/关联链接。