Running a website means a single unpatched vulnerability can take it offline, harm your reputation, or require cleanup. Most compromises begin with automated attacks exploiting known software flaws, usually reported and disclosed already.
To keep you protected from these threats, we’ve compiled this month’s key security updates and vulnerability patches for the WordPress ecosystem.
If you’re already using the Sucuri Firewall, you’re protected. These vulnerabilities are virtually patched for all clients. If not, consider putting a web application firewall in front of your site to block attacks before they reach your environment.
Plugins
Elementor Website Builder – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-49782 Number of Installations: 10,000,000+ Affected Software: Elementor Website Builder ≤ 4.1.0 Patched Versions: 4.1.1
Mitigation steps: Update to Elementor Website Builder version 4.1.1 or greater.
WPForms – Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
Security Risk: Medium Vulnerability: Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint CVE: CVE-2026-7792 Number of Installations: 6,000,000+ Affected Software: WPForms ≤ 1.10.0.4 Patched Versions: 1.10.0.5
Mitigation steps: Update to WPForms version 1.10.0.5 or greater.
Rank Math SEO – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-34892 Number of Installations: 4,000,000+ Affected Software: Rank Math SEO ≤ 1.0.271 Patched Versions: 1.0.271.1
Mitigation steps: Update to Rank Math SEO version 1.0.271.1 or greater.
UpdraftPlus – Unauthenticated Authentication Bypass via UpdraftCentral udrpc
Security Risk: Critical Vulnerability: Unauthenticated Authentication Bypass via UpdraftCentral udrpc CVE: CVE-2026-10795 Number of Installations: 3,000,000+ Affected Software: UpdraftPlus ≤ 1.26.4 Patched Versions: 1.26.5
Mitigation steps: Update to UpdraftPlus version 1.26.5 or greater.
Really Simple Security (formerly Really Simple SSL) – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-48970 Number of Installations: 3,000,000+ Affected Software: Really Simple Security (formerly Really Simple SSL) ≤ 9.5.10 Patched Versions: 9.5.10.1
Mitigation steps: Update to Really Simple Security (formerly Really Simple SSL) version 9.5.10.1 or greater.
Really Simple Security (formerly Really Simple SSL) – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-48969 Number of Installations: 3,000,000+ Affected Software: Really Simple Security (formerly Really Simple SSL) ≤ 9.5.9 Patched Versions: 9.5.10
Mitigation steps: Update to Really Simple Security (formerly Really Simple SSL) version 9.5.10 or greater.
Essential Addons for Elementor – Missing Authorization to Unauthenticated Information Exposure via ‘load_more’ AJAX Handler
Security Risk: High Vulnerability: Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler CVE: CVE-2026-7665 Number of Installations: 2,000,000+ Affected Software: Essential Addons for Elementor ≤ 6.6.4 Patched Versions: 6.6.5
Mitigation steps: Update to Essential Addons for Elementor version 6.6.5 or greater.
All-In-One Security (AIOS) – Unauthenticated Stored Cross-Site Scripting via REST API Request Path
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting via REST API Request Path CVE: CVE-2026-8438 Number of Installations: 1,000,000+ Affected Software: All-In-One Security (AIOS) ≤ 5.4.7 Patched Versions: 5.4.8
Mitigation steps: Update to All-In-One Security (AIOS) version 5.4.8 or greater.
WPvivid – Authenticated (Admin+) Arbitrary Directory Deletion
Security Risk: Low Vulnerability: Authenticated (Admin+) Arbitrary Directory Deletion CVE: CVE-2025-12656 Number of Installations: 900,000+ Affected Software: WPvivid ≤ 0.9.128 Patched Versions: 0.9.129
Mitigation steps: Update to WPvivid version 0.9.129 or greater.
Smart Slider 3 – Authenticated (Administrator+) Path Traversal to Arbitrary File Read via ‘src’/’srcset’ Attribute in HTML Export
Security Risk: Low Vulnerability: Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export CVE: CVE-2026-9197 Number of Installations: 800,000+ Affected Software: Smart Slider 3 ≤ 3.5.1.36 Patched Versions: 3.5.1.37
Mitigation steps: Update to Smart Slider 3 version 3.5.1.37 or greater.
The Events Calendar – Unauthenticated SQL Injection
Security Risk: Critical Vulnerability: Unauthenticated SQL Injection CVE: CVE-2026-49772 Number of Installations: 700,000+ Affected Software: The Events Calendar 6.15.12 - 6.16.2 Patched Versions: 6.16.3
Mitigation steps: Update to The Events Calendar version 6.16.3 or greater.
WooCommerce Stripe Payment Gateway – Missing Authorization to Unauthenticated Order Status Manipulation via ‘order’ Parameter
Security Risk: Medium Vulnerability: Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter CVE: CVE-2026-2381 Number of Installations: 700,000+ Affected Software: WooCommerce Stripe Payment Gateway ≤ 10.7.0 Patched Versions: 10.8.0
Mitigation steps: Update to WooCommerce Stripe Payment Gateway version 10.8.0 or greater.
Click to Chat – HoliThemes – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘num’ Shortcode Parameter
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter CVE: CVE-2026-7795 Number of Installations: 700,000+ Affected Software: Click to Chat – HoliThemes ≤ 4.39 Patched Versions: 4.40
Mitigation steps: Update to Click to Chat – HoliThemes version 4.40 or greater.
MainWP Child – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-27366 Number of Installations: 700,000+ Affected Software: MainWP Child ≤ 6.1.1 Patched Versions: 6.1.2
Mitigation steps: Update to MainWP Child version 6.1.2 or greater.
Forminator Forms – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-56071 Number of Installations: 600,000+ Affected Software: Forminator Forms ≤ 1.53.1 Patched Versions: 1.53.2
Mitigation steps: Update to Forminator Forms version 1.53.2 or greater.
WP Statistics – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-48839 Number of Installations: 600,000+ Affected Software: WP Statistics ≤ 14.16.6 Patched Versions: 14.16.7
Mitigation steps: Update to WP Statistics version 14.16.7 or greater.
Royal Addons for Elementor – Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source CVE: CVE-2026-8118 Number of Installations: 600,000+ Affected Software: Royal Addons for Elementor 1.7.1058 - 1.7.1059 Patched Versions: 1.7.1060
Mitigation steps: Update to Royal Addons for Elementor version 1.7.1060 or greater.
Enable Media Replace – Authenticated (Author+) Stored Cross-Site Scripting via ‘location_dir’ Parameter
Security Risk: Medium Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter CVE: CVE-2026-5714 Number of Installations: 600,000+ Affected Software: Enable Media Replace ≤ 4.1.8 Patched Versions: 4.1.9
Mitigation steps: Update to Enable Media Replace version 4.1.9 or greater.
TablePress – Reflected Cross-Site Scripting
Security Risk: Low Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-56051 Number of Installations: 600,000+ Affected Software: TablePress ≤ 3.3.1 Patched Versions: 3.3.2
Mitigation steps: Update to TablePress version 3.3.2 or greater.
Kadence Blocks – Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization CVE: CVE-2026-11357 Number of Installations: 600,000+ Affected Software: Kadence Blocks ≤ 3.7.5 Patched Versions: 3.7.6
Mitigation steps: Update to Kadence Blocks version 3.7.6 or greater.
Kirki – Unauthenticated Privilege Escalation via ‘handle_forgot_password’
Security Risk: Critical Vulnerability: Unauthenticated Privilege Escalation via 'handle_forgot_password' CVE: CVE-2026-8206 Number of Installations: 500,000+ Affected Software: Kirki 6.0.0 - 6.0.6 Patched Versions: 6.0.7
Mitigation steps: Update to Kirki version 6.0.7 or greater.
Page Builder by SiteOrigin – Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter CVE: CVE-2026-13295 Number of Installations: 400,000+ Affected Software: Page Builder by SiteOrigin ≤ 2.34.3 Patched Versions: 2.34.4
Mitigation steps: Update to Page Builder by SiteOrigin version 2.34.4 or greater.
Page Builder: Pagelayer – Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block CVE: CVE-2026-3297 Number of Installations: 400,000+ Affected Software: Page Builder: Pagelayer ≤ 2.0.9 Patched Versions: 2.1.0
Mitigation steps: Update to Page Builder: Pagelayer version 2.1.0 or greater.
Page Builder: Pagelayer – Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via ‘contacts’
Security Risk: Medium Vulnerability: Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts' CVE: CVE-2026-2470 Number of Installations: 400,000+ Affected Software: Page Builder: Pagelayer ≤ 2.0.9 Patched Versions: 2.1.0
Mitigation steps: Update to Page Builder: Pagelayer version 2.1.0 or greater.
WP Activity Log – Unauthenticated PHP Object Injection
Security Risk: High Vulnerability: Unauthenticated PHP Object Injection CVE: CVE-2026-54806 Number of Installations: 300,000+ Affected Software: WP Activity Log ≤ 5.6.3.1 Patched Versions: 5.6.4
Mitigation steps: Update to WP Activity Log version 5.6.4 or greater.
WP Activity Log – Authenticated (Subscriber+) Stored Cross-Site Scripting
Security Risk: Medium Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting CVE: CVE-2026-56005 Number of Installations: 300,000+ Affected Software: WP Activity Log ≤ 5.6.3.1 Patched Versions: 5.6.4
Mitigation steps: Update to WP Activity Log version 5.6.4 or greater.
Ad Inserter – Reflected Cross-Site Scripting via URL Parameters in iframe Mode
Security Risk: Medium Vulnerability: Reflected Cross-Site Scripting via URL Parameters in iframe Mode CVE: CVE-2026-9280 Number of Installations: 300,000+ Affected Software: Ad Inserter ≤ 2.8.15 Patched Versions: 2.8.16
Mitigation steps: Update to Ad Inserter version 2.8.16 or greater.
WP Go Maps – Unauthenticated Arbitrary Record Creation
Security Risk: Medium Vulnerability: Unauthenticated Arbitrary Record Creation CVE: CVE-2026-12238 Number of Installations: 300,000+ Affected Software: WP Go Maps ≤ 10.1.01 Patched Versions: 10.1.02
Mitigation steps: Update to WP Go Maps version 10.1.02 or greater.
WP Go Maps – Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
Security Risk: Medium Vulnerability: Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback CVE: CVE-2026-8385 Number of Installations: 300,000+ Affected Software: WP Go Maps ≤ 10.0.09 Patched Versions: 10.0.10
Mitigation steps: Update to WP Go Maps version 10.0.10 or greater.
Blocksy Companion – Authenticated (Editor+) Stored Cross-Site Scripting via ‘product_description’ Parameter
Security Risk: Medium Vulnerability: Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter CVE: CVE-2026-12430 Number of Installations: 300,000+ Affected Software: Blocksy Companion ≤ 2.1.45 Patched Versions: 2.1.46
Mitigation steps: Update to Blocksy Companion version 2.1.46 or greater.
Ultimate Member – Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
Security Risk: High Vulnerability: Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure CVE: CVE-2026-7761 Number of Installations: 200,000+ Affected Software: Ultimate Member ≤ 2.11.4 Patched Versions: 2.12.0
Mitigation steps: Update to Ultimate Member version 2.12.0 or greater.
Advanced Google reCAPTCHA – Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link
Security Risk: High Vulnerability: Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link CVE: CVE-2026-5415 Number of Installations: 200,000+ Affected Software: Advanced Google reCAPTCHA ≤ 5.38 Patched Versions: 5.39
Mitigation steps: Update to Advanced Google reCAPTCHA version 5.39 or greater.
Advanced Google reCAPTCHA – Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
Security Risk: High Vulnerability: Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload CVE: CVE-2026-5411 Number of Installations: 200,000+ Affected Software: Advanced Google reCAPTCHA ≤ 5.38 Patched Versions: 5.39
Mitigation steps: Update to Advanced Google reCAPTCHA version 5.39 or greater.
Post Duplicator – Authenticated (Contributor+) PHP Object Injection
Security Risk: Medium Vulnerability: Authenticated (Contributor+) PHP Object Injection CVE: CVE-2026-10749 Number of Installations: 200,000+ Affected Software: Post Duplicator < 3.0.15 Patched Versions: 3.0.15
Mitigation steps: Update to Post Duplicator version 3.0.15 or greater.
CleanTalk Anti-Spam – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-8071 Number of Installations: 200,000+ Affected Software: CleanTalk Anti-Spam < 6.79 Patched Versions: 6.79
Mitigation steps: Update to CleanTalk Anti-Spam version 6.79 or greater.
Gutenberg Essential Blocks – Authenticated (Author+) Server-Side Request Forgery
Security Risk: Low Vulnerability: Authenticated (Author+) Server-Side Request Forgery CVE: CVE-2026-10586 Number of Installations: 200,000+ Affected Software: Gutenberg Essential Blocks ≤ 6.1.3 Patched Versions: 6.1.4
Mitigation steps: Update to Gutenberg Essential Blocks version 6.1.4 or greater.
MW WP Form – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-48871 Number of Installations: 200,000+ Affected Software: MW WP Form ≤ 5.1.3 Patched Versions: 5.1.4
Mitigation steps: Update to MW WP Form version 5.1.4 or greater.
Photo Gallery by 10Web – Authenticated (Contributor+) SQL Injection via ‘compact_album_order_by’ Shortcode Parameter
Security Risk: Medium Vulnerability: Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter CVE: CVE-2026-9829 Number of Installations: 200,000+ Affected Software: Photo Gallery by 10Web ≤ 1.8.41 Patched Versions: 1.8.42
Mitigation steps: Update to Photo Gallery by 10Web version 1.8.42 or greater.
Photo Gallery by 10Web – Authenticated (Contributor+) SQL Injection
Security Risk: Medium Vulnerability: Authenticated (Contributor+) SQL Injection CVE: CVE-2026-49771 Number of Installations: 200,000+ Affected Software: Photo Gallery by 10Web ≤ 1.8.41 Patched Versions: 1.8.42
Mitigation steps: Update to Photo Gallery by 10Web version 1.8.42 or greater.
Gutenberg Essential Blocks – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘configurablePrefix’ Block Attribute
Security Risk: Medium Vulnerability: Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute CVE: CVE-2026-10833 Number of Installations: 200,000+ Affected Software: Gutenberg Essential Blocks ≤ 6.1.4 Patched Versions: 6.2.0
Mitigation steps: Update to Gutenberg Essential Blocks version 6.2.0 or greater.
MW WP Form – Authenticated (Editor+) Stored Cross-Site Scripting via ‘memo’ Parameter
Security Risk: Medium Vulnerability: Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter CVE: CVE-2026-8853 Number of Installations: 200,000+ Affected Software: MW WP Form ≤ 5.1.3 Patched Versions: 5.1.4
Mitigation steps: Update to MW WP Form version 5.1.4 or greater.
Optimole – Cross-Site Request Forgery via ‘optml_replace_file’ AJAX Action
Security Risk: Low Vulnerability: Cross-Site Request Forgery via 'optml_replace_file' AJAX Action CVE: CVE-2026-11784 Number of Installations: 200,000+ Affected Software: Optimole ≤ 4.2.6 Patched Versions: 4.2.7
Mitigation steps: Update to Optimole version 4.2.7 or greater.
WP Migrate Lite – Cross-Site Request Forgery
Security Risk: Low Vulnerability: Cross-Site Request Forgery CVE: CVE-2026-49043 Number of Installations: 200,000+ Affected Software: WP Migrate Lite ≤ 2.7.8 Patched Versions: 2.7.9
Mitigation steps: Update to WP Migrate Lite version 2.7.9 or greater.
Widget Options – Authenticated (Contributor+) Remote Code Execution
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Remote Code Execution CVE: CVE-2026-54823 Number of Installations: 100,000+ Affected Software: Widget Options ≤ 4.2.3 Patched Versions: 4.2.4
Mitigation steps: Update to Widget Options version 4.2.4 or greater.
Admin Columns – Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value
Security Risk: High Vulnerability: Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value CVE: CVE-2026-7654 Number of Installations: 100,000+ Affected Software: Admin Columns ≤ 7.0.18 Patched Versions: 7.0.19
Mitigation steps: Update to Admin Columns version 7.0.19 or greater.
LatePoint – Authenticated (Contributor+) Privilege Escalation
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Privilege Escalation CVE: CVE-2026-49083 Number of Installations: 100,000+ Affected Software: LatePoint ≤ 5.5.1 Patched Versions: 5.5.2
Mitigation steps: Update to LatePoint version 5.5.2 or greater.
Advanced Ads – Authenticated (Contributor+) Remote Code Execution
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Remote Code Execution CVE: CVE-2026-54816 Number of Installations: 100,000+ Affected Software: Advanced Ads – ≤ 2.0.21 Patched Versions: 2.0.22
Mitigation steps: Update to Advanced Ads 2.0.22 or greater.
LatePoint – Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
Security Risk: High Vulnerability: Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset CVE: CVE-2026-8176 Number of Installations: 100,000+ Affected Software: LatePoint ≤ 5.5.1 Patched Versions: 5.5.2
Mitigation steps: Update to LatePoint – Calendar Booking Plugin for Appointments and Events version 5.5.2 or greater.
Responsive Lightbox & Gallery – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-56041 Number of Installations: 100,000+ Affected Software: Responsive Lightbox & Gallery ≤ 2.7.6 Patched Versions: 2.7.7
Mitigation steps: Update to Responsive Lightbox & Gallery version 2.7.7 or greater.
Pods – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-54191 Number of Installations: 100,000+ Affected Software: Pods ≤ 3.3.8 Patched Versions: 3.3.9
Mitigation steps: Update to Pods version 3.3.9 or greater.
Email Address Encoder – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-5305 Number of Installations: 100,000+ Affected Software: Email Address Encoder < 1.0.25 Patched Versions: 1.0.25
Mitigation steps: Update to Email Address Encoder version 1.0.25 or greater.
Advanced Order Export For WooCommerce – Authenticated (Customer+) Stored Cross-Site Scripting
Security Risk: High Vulnerability: Authenticated (Customer+) Stored Cross-Site Scripting CVE: CVE-2026-56042 Number of Installations: 100,000+ Affected Software: Advanced Order Export For WooCommerce ≤ 4.0.9 Patched Versions: 4.0.10
Mitigation steps: Update to Advanced Order Export For WooCommerce version 4.0.10 or greater.
Permalink Manager Lite – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title CVE: CVE-2026-8494 Number of Installations: 100,000+ Affected Software: Permalink Manager Lite ≤ 2.5.3.3 Patched Versions: 2.5.3.4
Mitigation steps: Update to Permalink Manager Lite version 2.5.3.4 or greater.
Photo Gallery by FooGallery – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘custom_attribute_key’ Shortcode Parameter
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter CVE: CVE-2026-9134 Number of Installations: 100,000+ Affected Software: Photo Gallery by FooGallery ≤ 3.1.31 Patched Versions: 3.1.32
Mitigation steps: Update to Photo Gallery by FooGallery version 3.1.32 or greater.
Presto Player – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘link_url’ Shortcode Attribute
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute CVE: CVE-2026-9125 Number of Installations: 100,000+ Affected Software: Presto Player ≤ 4.2.0 Patched Versions: 4.2.1
Mitigation steps: Update to Presto Player version 4.2.1 or greater.
EmbedPress – Authenticated (Contributor+) Stored Cross-Site Scripting via Block ‘url’ Attribute
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute CVE: CVE-2026-7796 Number of Installations: 100,000+ Affected Software: EmbedPress ≤ 4.5.3 Patched Versions: 4.5.4
Mitigation steps: Update to EmbedPress version 4.5.4 or greater.
Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) – Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute
Security Risk: Medium Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute CVE: CVE-2026-3722 Number of Installations: 100,000+ Affected Software: Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) ≤ 4.9 Patched Versions: 4.9.1
Mitigation steps: Update to Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) version 4.9.1 or greater.
Envira Gallery – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-54190 Number of Installations: 100,000+ Affected Software: Envira Gallery ≤ 1.12.5 Patched Versions: 1.12.6
Mitigation steps: Update to Envira Gallery version 1.12.6 or greater.
Schema & Structured Data for WP & AMP – Unauthenticated Arbitrary Media Upload
Security Risk: High Vulnerability: Unauthenticated Arbitrary Media Upload CVE: CVE-2026-9067 Number of Installations: 100,000+ Affected Software: Schema & Structured Data for WP & AMP < 1.60 Patched Versions: 1.60
Mitigation steps: Update to Schema & Structured Data for WP & AMP version 1.60 or greater.
EmbedPress – Unauthenticated Information Exposure
Security Risk: High Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-48872 Number of Installations: 100,000+ Affected Software: EmbedPress ≤ 4.5.2 Patched Versions: 4.5.3
Mitigation steps: Update to EmbedPress version 4.5.3 or greater.
WP All Import – Authenticated (Administrator+) SQL Injection
Security Risk: Low Vulnerability: Authenticated (Administrator+) SQL Injection CVE: CVE-2026-57628 Number of Installations: 100,000+ Affected Software: WP All Import ≤ 4.0.1 Patched Versions: 4.1.0
Mitigation steps: Update to WP All Import version 4.1.0 or greater.
Tutor LMS – Authenticated (Administrator+) SQL Injection via ‘data’ Parameter
Security Risk: Low Vulnerability: Authenticated (Administrator+) SQL Injection via 'data' Parameter CVE: CVE-2026-10736 Number of Installations: 100,000+ Affected Software: Tutor LMS ≤ 3.9.11 Patched Versions: 3.9.12
Mitigation steps: Update to Tutor LMS version 3.9.12 or greater.
Advanced Order Export For WooCommerce – Authenticated (Shop Manager+) SQL Injection via ‘sort_direction’ Parameter
Security Risk: Medium Vulnerability: Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter CVE: CVE-2026-11360 Number of Installations: 100,000+ Affected Software: Advanced Order Export For WooCommerce ≤ 4.0.10 Patched Versions: 4.1.0
Mitigation steps: Update to Advanced Order Export For WooCommerce version 4.1.0 or greater.
Ivory Search – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘menu_title’ and ‘menu_magnifier_color’ Settings
Security Risk: Low Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings CVE: CVE-2026-11356 Number of Installations: 100,000+ Affected Software: Ivory Search ≤ 5.5.15 Patched Versions: 5.5.16
Mitigation steps: Update to Ivory Search version 5.5.16 or greater.
Orbit Fox – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘menu-item-icon’ Parameter
Security Risk: Low Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter CVE: CVE-2026-11358 Number of Installations: 100,000+ Affected Software: Orbit Fox ≤ 3.0.6 Patched Versions: 3.0.7
Mitigation steps: Update to Orbit Fox version 3.0.7 or greater.
Feeds for YouTube (YouTube video, channel, and gallery plugin) – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-1631 Number of Installations: 100,000+ Affected Software: Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4 Patched Versions: 2.6.4
Mitigation steps: Update to Feeds for YouTube (YouTube video, channel, and gallery plugin) version 2.6.4 or greater.
LatePoint – Cross-Site Request Forgery via invoices__change_status Action
Security Risk: Low Vulnerability: Cross-Site Request Forgery via invoices__change_status Action CVE: CVE-2026-9719 Number of Installations: 100,000+ Affected Software: LatePoint ≤ 5.6.0 Patched Versions: 5.6.1
Mitigation steps: Update to LatePoint version 5.6.1 or greater.
JetFormBuilder – Authenticated (Subscriber+) Privilege Escalation
Security Risk: High Vulnerability: Authenticated (Subscriber+) Privilege Escalation CVE: CVE-2026-54196 Number of Installations: 90,000+ Affected Software: JetFormBuilder ≤ 3.6.1 Patched Versions: 3.6.1.1
Mitigation steps: Update to JetFormBuilder 3.6.1.1 or greater.
Amelia – Authenticated (Subscriber+) Privilege Escalation
Security Risk: Low Vulnerability: Authenticated (Subscriber+) Privilege Escalation CVE: CVE-2026-48889 Number of Installations: 90,000+ Affected Software: Amelia ≤ 2.3 Patched Versions: 2.4
Mitigation steps: Update to Booking for Appointments and Events Calendar – Amelia version 2.4 or greater.
OttoKit – Unauthenticated PHP Object Injection
Security Risk: High Vulnerability: Unauthenticated PHP Object Injection CVE: CVE-2026-49781 Number of Installations: 90,000+ Affected Software: OttoKit ≤ 1.1.27 Patched Versions: 1.1.28
Mitigation steps: Update to OttoKit version 1.1.28 or greater.
JetFormBuilder – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-54195 Number of Installations: 90,000+ Affected Software: JetFormBuilder ≤ 3.6.0.1 Patched Versions: 3.6.1
Mitigation steps: Update to JetFormBuilder version 3.6.1 or greater.
Email Encoder – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-5776 Number of Installations: 90,000+ Affected Software: Email Encoder < 2.4.7 Patched Versions: 2.4.7
Mitigation steps: Update to Email Encoder version 2.4.7 or greater.
SureCart – Authenticated (Subscriber+) Stored Cross-Site Scripting
Security Risk: Medium Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting CVE: CVE-2026-57313 Number of Installations: 90,000+ Affected Software: SureCart ≤ 4.2.2 Patched Versions: 4.2.3
Mitigation steps: Update to SureCart version 4.2.3 or greater.
Advanced Import – Authenticated (Author+) Server-Side Request Forgery via ‘demo_file’ Parameter
Security Risk: Low Vulnerability: Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter CVE: CVE-2026-4328 Number of Installations: 90,000+ Affected Software: Advanced Import ≤ 1.4.6 Patched Versions: 2.0.0
Mitigation steps: Update to Advanced Import version 2.0.0 or greater.
SureCart – Reflected Cross-Site Scripting
Security Risk: TBC Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-57314 Number of Installations: 90,000+ Affected Software: SureCart ≤ 4.3.2 Patched Versions: 4.3.3
Mitigation steps: Update to SureCart Products, Digital Downloads, Subscriptions, Donations, & Payments version 4.3.3 or greater.
Everest Forms – Reflected Cross-Site Scripting
Security Risk: TBC Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-57312 Number of Installations: 90,000+ Affected Software: Everest Forms ≤ 3.4.8 Patched Versions: 3.5.0
Mitigation steps: Update to Everest Forms version 3.5.0 or greater.
SlimStat Analytics – Unauthenticated PHP Object Injection
Security Risk: High Vulnerability: Unauthenticated PHP Object Injection CVE: CVE-2026-27410 Number of Installations: 80,000+ Affected Software: SlimStat Analytics < 5.4.0 Patched Versions: 5.4.0
Mitigation steps: Update to SlimStat Analytics version 5.4.0 or greater.
Customer Reviews for WooCommerce – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-56043 Number of Installations: 80,000+ Affected Software: Customer Reviews for WooCommerce ≤ 5.110.1 Patched Versions: 5.111.0
Mitigation steps: Update to Customer Reviews for WooCommerce version 5.111.0 or greater.
GetGenie – Unauthenticated Information Exposure
Security Risk: TBC Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-54197 Number of Installations: 80,000+ Affected Software: GetGenie ≤ 4.4.1 Patched Versions: 4.4.2
Mitigation steps: Update to GetGenie – AI Content Writer with Keyword Research & SEO Tracking version 4.4.2 or greater.
wpDataTables – Unauthenticated SQL Injection
Security Risk: Critical Vulnerability: Unauthenticated SQL Injection CVE: CVE-2026-54825 Number of Installations: 70,000+ Affected Software: wpDataTables ≤ 7.4 Patched Versions: 7.4.1
Mitigation steps: Update to wpDataTables version 7.4.1 or greater.
wpDataTables – Unauthenticated SQL Injection
Security Risk: Critical Vulnerability: Unauthenticated SQL Injection CVE: CVE-2026-49080 Number of Installations: 70,000+ Affected Software: wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin ≤ 7.3.6 Patched Versions: 7.4
Mitigation steps: Update to wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin version 7.4 or greater.
Bookly – Unauthenticated Stored Cross-Site Scripting via ‘bookly-customer-full-name’ Cookie
Security Risk: Medium Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie CVE: CVE-2026-5513 Number of Installations: 70,000+ Affected Software: Bookly ≤ 27.2 Patched Versions: 27.3
Mitigation steps: Update to Bookly version 27.3 or greater.
Media Library Assistant – Authenticated (Contributor+) SQL Injection
Security Risk: Medium Vulnerability: Authenticated (Contributor+) SQL Injection CVE: CVE-2026-56012 Number of Installations: 70,000+ Affected Software: Media Library Assistant ≤ 3.35 Patched Versions: 3.36
Mitigation steps: Update to Media Library Assistant version 3.36 or greater.
SlimStat Analytics – Authenticated (Subscriber+) SQL Injection
Security Risk: Medium Vulnerability: Authenticated (Subscriber+) SQL Injection CVE: CVE-2026-54818 Number of Installations: 70,000+ Affected Software: SlimStat Analytics ≤ 5.4.11 Patched Versions: 5.4.12
Mitigation steps: Update to SlimStat Analytics version 5.4.12 or greater.
StatCounter – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-57629 Number of Installations: 70,000+ Affected Software: StatCounter ≤ 2.1.1 Patched Versions: 2.1.2
Mitigation steps: Update to StatCounter version 2.1.2 or greater.
MaxButtons – Reflected Cross-Site Scripting via ‘view’ Parameter
Security Risk: Medium Vulnerability: Reflected Cross-Site Scripting via 'view' Parameter CVE: CVE-2026-13245 Number of Installations: 70,000+ Affected Software: MaxButtons ≤ 9.8.5 Patched Versions: 9.8.6
Mitigation steps: Update to MaxButtons version 9.8.6 or greater.
Media Library Assistant – Reflected Cross-Site Scripting
Security Risk: TBC Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-54198 Number of Installations: 70,000+ Affected Software: Media Library Assistant ≤ 3.35 Patched Versions: 3.36
Mitigation steps: Update to Media Library Assistant version 3.36 or greater.
LearnPress – Reflected Cross-Site Scripting
Security Risk: Medium Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-48865 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.3.6 Patched Versions: 4.3.7
Mitigation steps: Update to LearnPress version 4.3.7 or greater.
LearnPress – Unauthenticated Sensitive Information Exposure via ‘c_status’ and ‘return_type’ Parameters
Security Risk: High Vulnerability: Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters CVE: CVE-2026-8502 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.3.6 Patched Versions: 4.3.7
Mitigation steps: Update to LearnPress version 4.3.7 or greater.
Database for Contact Form 7, WPforms, Elementor forms – Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
Security Risk: High Vulnerability: Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value CVE: CVE-2026-9843 Number of Installations: 60,000+ Affected Software: Database for Contact Form 7, WPforms, Elementor forms ≤ 1.5.1 Patched Versions: 1.5.2
Mitigation steps: Update to Database for Contact Form 7, WPforms, Elementor forms version 1.5.2 or greater.
WP Maps – Authenticated (Subscriber+) Local File Inclusion
Security Risk: High Vulnerability: Authenticated (Subscriber+) Local File Inclusion CVE: CVE-2026-6381 Number of Installations: 60,000+ Affected Software: WP Maps < 4.9.3 Patched Versions: 4.9.3
Mitigation steps: Update to WP Maps version 4.9.3 or greater.
Appointment Booking Calendar – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-57317 Number of Installations: 60,000+ Affected Software: Appointment Booking Calendar ≤ 1.6.12.2 Patched Versions: 1.6.12.4
Mitigation steps: Update to Appointment Booking Calendar version 1.6.12.4 or greater.
Master Slider – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-56014 Number of Installations: 60,000+ Affected Software: Master Slider ≤ 3.11.2 Patched Versions: N/A
Mitigation steps: Update to Master Slider version N/A or greater.
Drag and Drop Multiple File Upload for Contact Form 7 – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-49055 Number of Installations: 60,000+ Affected Software: Drag and Drop Multiple File Upload for Contact Form 7 ≤ 1.3.9.7 Patched Versions: 1.3.9.8
Mitigation steps: Update to Drag and Drop Multiple File Upload for Contact Form 7 version 1.3.9.8 or greater.
User Registration & Membership – Missing Authorization to Unauthenticated Payment Bypass
Security Risk: High Vulnerability: Missing Authorization to Unauthenticated Payment Bypass CVE: CVE-2026-1869 Number of Installations: 60,000+ Affected Software: User Registration & Membership ≤ 5.2.0 Patched Versions: 5.2.1
Mitigation steps: Update to User Registration & Membership version 5.2.1 or greater.
WP Maps – Authenticated (Admin+) Stored Cross-Site Scripting via ‘location_messages’ Parameter
Security Risk: Low Vulnerability: Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter CVE: CVE-2026-9594 Number of Installations: 60,000+ Affected Software: WP Maps ≤ 4.9.4 Patched Versions: 4.9.5
Mitigation steps: Update to WP Maps version 4.9.5 or greater.
Drag and Drop Multiple File Upload for Contact Form 7 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘drag_n_drop_text’ and ‘drag_n_drop_browse_text’ Settings
Security Risk: Low Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings CVE: CVE-2026-8991 Number of Installations: 60,000+ Affected Software: Drag and Drop Multiple File Upload for Contact Form 7 ≤ 1.3.9.7 Patched Versions: 1.3.9.8
Mitigation steps: Update to Drag and Drop Multiple File Upload for Contact Form 7 version 1.3.9.8 or greater.
Slim SEO – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-57429 Number of Installations: 60,000+ Affected Software: Slim SEO ≤ 4.6.2 Patched Versions: 4.7.0
Mitigation steps: Update to Slim SEO version 4.7.0 or greater.
FOX – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-57319 Number of Installations: 50,000+ Affected Software: FOX ≤ 1.4.8 Patched Versions: 1.4.9
Mitigation steps: Update to FOX version 1.4.9 or greater.
Blog2Social – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-56044 Number of Installations: 50,000+ Affected Software: Blog2Social ≤ 8.9.2 Patched Versions: 8.9.3
Mitigation steps: Update to Blog2Social version 8.9.3 or greater.
RTMKit – Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via ‘entries_id’ Parameter
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter CVE: CVE-2026-5149 Number of Installations: 50,000+ Affected Software: RTMKit ≤ 2.0.7 Patched Versions: 2.0.8
Mitigation steps: Update to RTMKit version 2.0.8 or greater.
Exclusive Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-57620 Number of Installations: 50,000+ Affected Software: Exclusive Addons for Elementor ≤ 2.7.9.8 Patched Versions: 2.7.9.9
Mitigation steps: Update to Exclusive Addons for Elementor version 2.7.9.9 or greater.
Popup Box – Reflected Cross-Site Scripting
Security Risk: TBC Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-54192 Number of Installations: 50,000+ Affected Software: Popup Box ≤ 6.2.9 Patched Versions: 6.3.0
Mitigation steps: Update to Popup Box version 6.3.0 or greater.
User Registration & Membership – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-52701 Number of Installations: 50,000+ Affected Software: User Registration & Membership ≤ 5.2.2 Patched Versions: 5.2.3
Mitigation steps: Update to User Registration & Membership version 5.2.3 or greater.
WebToffee – Unauthenticated Information Exposure
Security Risk: TBC Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-49056 Number of Installations: 50,000+ Affected Software: WebToffee ≤ 4.9.4 Patched Versions: 4.9.5
Mitigation steps: Update to WebToffee version 4.9.5 or greater.
Popup Box – Authenticated (Administrator+) SQL Injection
Security Risk: Low Vulnerability: Authenticated (Administrator+) SQL Injection CVE: CVE-2026-57631 Number of Installations: 50,000+ Affected Software: Popup Box ≤ 6.0.1 Patched Versions: 6.0.2
Mitigation steps: Update to Popup Box version 6.0.2 or greater.
Email Marketing for WooCommerce by Omnisend – Missing Authorization
Security Risk: Medium Vulnerability: Missing Authorization CVE: CVE-2026-57632 Number of Installations: 50,000+ Affected Software: Email Marketing for WooCommerce by Omnisend ≤ 1.19.0 Patched Versions: 1.19.1
Mitigation steps: Update to Email Marketing for WooCommerce by Omnisend version 1.19.1 or greater.
Themes
Blocksy – Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via ‘blocksy_meta’ REST API Field
Security Risk: High Vulnerability: Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field CVE: CVE-2026-8365 Number of Installations: 300,000+ Affected Software: Blocksy ≤ 2.1.41 Patched Versions: 2.1.42
Mitigation steps: Update to Blocksy version 2.1.42 or greater.
Update your website software to reduce risk. If you cannot update to the latest version, consider using a web application firewall to patch known vulnerabilities and safeguard your site.
Luke Leal
Peter Gramantik
Marc Kranat
Cesar Anjos
Justin Channell
Sucuri Malware Research Team
Art Martori
Krasimir Konov