If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation following an attack. Most security breaches we observe originate from automated attacks that exploit known software vulnerabilities, often the same ones that have been previously reported and disclosed.
To assist in maintaining your security posture, we have compiled this month’s summary of essential security updates and vulnerability patches pertinent to the WordPress ecosystem.
For those already utilizing the Sucuri Firewall, your website is protected, as these vulnerabilities are effectively addressed for all clients. If you do not currently have such protection, it is advisable to deploy a web application firewall to prevent attacks from reaching your environment.
Plugins
Elementor Website Builder – Authenticated (Author+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting CVE: CVE-2026-81812 Number of Installations: 10,000,000+ Affected Software: Elementor Website Builder ≤ 4.3.4 Patched Versions: 4.3.5
Mitigation steps: Update to Elementor Website Builder version 4.3.5 or greater.
Elementor Website Builder – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-81813 Number of Installations: 10,000,000+ Affected Software: Elementor Website Builder ≤ 4.3.4 Patched Versions: 4.3.5
Mitigation steps: Update to Elementor Website Builder version 4.3.5 or greater.
Elementor Website Builder – Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via ‘is_public’ and ‘keys_conversion_map’ Parameters
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters CVE: CVE-2026-11905 Number of Installations: 10,000,000+ Affected Software: Elementor Website Builder ≤ 4.2.3 Patched Versions: 4.2.4
Mitigation steps: Update to Elementor Website Builder version 4.2.4 or greater.
LiteSpeed Cache – Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization CVE: CVE-2026-109215 Number of Installations: 7,000,000+ Affected Software: LiteSpeed Cache ≤ 7.9.1 Patched Versions: 7.9.2
Mitigation steps: Update to LiteSpeed Cache version 7.9.2 or greater.
LiteSpeed Cache – Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) CVE: CVE-2026-116763 Number of Installations: 7,000,000+ Affected Software: LiteSpeed Cache ≤ 7.9.1 Patched Versions: 7.9.2
Mitigation steps: Update to LiteSpeed Cache version 7.9.2 or greater.
LiteSpeed Cache – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-113500 Number of Installations: 7,000,000+ Affected Software: LiteSpeed Cache < 7.9.2 Patched Versions: 7.9.2
Mitigation steps: Update to LiteSpeed Cache version 7.9.2 or greater.
LiteSpeed Cache – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-113501 Number of Installations: 7,000,000+ Affected Software: LiteSpeed Cache < 7.9.2 Patched Versions: 7.9.2
Mitigation steps: Update to LiteSpeed Cache version 7.9.2 or greater.
LiteSpeed Cache – Unauthenticated Information Exposure
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-114190 Number of Installations: 7,000,000+ Affected Software: LiteSpeed Cache ≤ 7.9 Patched Versions: 7.10
Mitigation steps: Update to LiteSpeed Cache version 7.10 or greater.
WooCommerce – Authenticated (Shop Manager+) Privilege Escalation
Security Risk: High Exploitation Level: Requires Shop Manager or higher level authentication. Vulnerability: Authenticated (Shop Manager+) Privilege Escalation CVE: CVE-2026-106608 Number of Installations: 7,000,000+ Affected Software: WooCommerce 9.8.0 - 11.1.2 Patched Versions: 11.1.3
Mitigation steps: Update to WooCommerce version 11.1.3 or greater.
WPForms – Reflected Cross-Site Scripting via ‘query_var’ Smart Tag in iframe srcdoc Attribute
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute CVE: CVE-2026-101921 Number of Installations: 5,000,000+ Affected Software: WPForms ≤ 2.0.2.1 Patched Versions: 2.0.2.2
Mitigation steps: Update to WPForms version 2.0.2.2 or greater.
Rank Math SEO – Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) PHP Object Injection to Remote Code Execution CVE: CVE-2026-1928 Number of Installations: 4,000,000+ Affected Software: Rank Math SEO ≤ 1.0.276 Patched Versions: 1.0.277
Mitigation steps: Update to Rank Math SEO version 1.0.277 or greater.
Rank Math SEO – Authenticated (Administrator+) SQL Injection
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Administrator+) SQL Injection CVE: CVE-2026-104753 Number of Installations: 4,000,000+ Affected Software: Rank Math SEO ≤ 1.0.279 Patched Versions: 1.0.280
Mitigation steps: Update to Rank Math SEO version 1.0.280 or greater.
Rank Math SEO – Authenticated (Administrator+) Arbitrary File Upload
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Administrator+) Arbitrary File Upload CVE: CVE-2026-104752 Number of Installations: 4,000,000+ Affected Software: Rank Math SEO ≤ 1.0.279 Patched Versions: 1.0.280
Mitigation steps: Update to Rank Math SEO version 1.0.280 or greater.
Rank Math SEO – Authenticated (Administrator+) Stored Cross-Site Scripting
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting CVE: CVE-2026-104754 Number of Installations: 4,000,000+ Affected Software: Rank Math SEO ≤ 1.0.279 Patched Versions: 1.0.280
Mitigation steps: Update to Rank Math SEO version 1.0.280 or greater.
Jetpack – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-106601 Number of Installations: 3,000,000+ Affected Software: Jetpack ≤ 16.2 Patched Versions: 16.3
Mitigation steps: Update to Jetpack version 16.3 or greater.
All in One SEO – Unauthenticated Sensitive Information Disclosure in ‘s’ Search Query Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter CVE: CVE-2026-109367 Number of Installations: 2,000,000+ Affected Software: All in One SEO ≤ 5.0.3 Patched Versions: 5.0.4
Mitigation steps: Update to All in One SEO version 5.0.4 or greater.
All in One SEO – Unauthenticated Arbitrary Shortcode Execution via ‘s’ Search Query Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter CVE: CVE-2026-100152 Number of Installations: 2,000,000+ Affected Software: All in One SEO ≤ 5.0.2 Patched Versions: 5.0.3
Mitigation steps: Update to All in One SEO version 5.0.3 or greater.
All in One SEO – Unauthenticated Arbitrary Shortcode Execution
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution CVE: CVE-2026-19856 Number of Installations: 2,000,000+ Affected Software: All in One SEO ≤ 5.0.2.0 Patched Versions: 5.0.2.1
Mitigation steps: Update to All in One SEO version 5.0.2.1 or greater.
All in One SEO – Reflected DOM-Based Cross-Site Scripting via URL Pathname
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected DOM-Based Cross-Site Scripting via URL Pathname CVE: CVE-2026-85492 Number of Installations: 2,000,000+ Affected Software: All in One SEO ≤ 5.0.1.1 Patched Versions: 5.0.1.2
Mitigation steps: Update to All in One SEO version 5.0.1.2 or greater.
Essential Addons for Elementor – Unauthenticated Privilege Escalation to ‘page_id’ Parameter via Elementor Revision
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision CVE: CVE-2026-118205 Number of Installations: 1,000,000+ Affected Software: Essential Addons for Elementor ≤ 6.8.7 Patched Versions: 6.8.8
Mitigation steps: Update to Essential Addons for Elementor version 6.8.8 or greater.
Essential Addons for Elementor – Unauthenticated Information Exposure
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-110509 Number of Installations: 1,000,000+ Affected Software: Essential Addons for Elementor < 6.8.7 Patched Versions: 6.8.7
Mitigation steps: Update to Essential Addons for Elementor version 6.8.7 or greater.
Essential Addons for Elementor – Authenticated (Author+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting CVE: CVE-2026-110510 Number of Installations: 1,000,000+ Affected Software: Essential Addons for Elementor < 6.8.7 Patched Versions: 6.8.7
Mitigation steps: Update to Essential Addons for Elementor version 6.8.7 or greater.
Speed Optimizer – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-111738 Number of Installations: 1,000,000+ Affected Software: Speed Optimizer < 7.8.5 Patched Versions: 7.8.5
Mitigation steps: Update to Speed Optimizer version 7.8.5 or greater.
Duplicator – Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution
Security Risk: Low Exploitation Level: Requires Multisite Subsite Admin or higher level authentication. Vulnerability: Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution CVE: CVE-2026-115251 Number of Installations: 1,000,000+ Affected Software: Duplicator ≤ 1.5.17 Patched Versions: 1.5.18
Mitigation steps: Update to Duplicator version 1.5.18 or greater.
Speed Optimizer – Authenticated (Administrator+) Stored Cross-Site Scripting
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting CVE: CVE-2026-111737 Number of Installations: 1,000,000+ Affected Software: Speed Optimizer < 7.8.5 Patched Versions: 7.8.5
Mitigation steps: Update to Speed Optimizer version 7.8.5 or greater.
Essential Addons for Elementor – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-110537 Number of Installations: 1,000,000+ Affected Software: Essential Addons for Elementor < 6.8.7 Patched Versions: 6.8.7
Mitigation steps: Update to Essential Addons for Elementor version 6.8.7 or greater.
Essential Addons for Elementor – Authenticated (Author+) Privilege Escalation
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Authenticated (Author+) Privilege Escalation CVE: CVE-2026-110898 Number of Installations: 1,000,000+ Affected Software: Essential Addons for Elementor ≤ 6.8.5 Patched Versions: 6.8.6
Mitigation steps: Update to Essential Addons for Elementor version 6.8.6 or greater.
Complianz GDPR/CCPA Cookie Consent Banner – Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter CVE: CVE-2026-97339 Number of Installations: 1,000,000+ Affected Software: Complianz GDPR/CCPA Cookie Consent Banner ≤ 7.5.5 Patched Versions: 7.5.6
Mitigation steps: Update to Complianz GDPR/CCPA Cookie Consent Banner version 7.5.6 or greater.
Code Snippets – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-106095 Number of Installations: 1,000,000+ Affected Software: Code Snippets ≤ 3.9.0 Patched Versions: 3.9.1
Mitigation steps: Update to Code Snippets version 3.9.1 or greater.
Code Snippets – Authenticated (Administrator+) SQL Injection
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Administrator+) SQL Injection CVE: CVE-2026-106097 Number of Installations: 1,000,000+ Affected Software: Code Snippets ≤ 3.9.0 Patched Versions: 3.9.1
Mitigation steps: Update to Code Snippets version 3.9.1 or greater.
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-39721 Number of Installations: 1,000,000+ Affected Software: Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg ≤ 4.7.7 Patched Versions: 4.7.8
Mitigation steps: Update to Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg version 4.7.8 or greater.
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-102393 Number of Installations: 1,000,000+ Affected Software: Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg ≤ 4.7.7 Patched Versions: 4.7.8
Mitigation steps: Update to Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg version 4.7.8 or greater.
EWWW Image Optimizer – Reflected Cross-Site Scripting via REQUEST_URI Parameter Key
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via REQUEST_URI Parameter Key CVE: CVE-2026-92826 Number of Installations: 1,000,000+ Affected Software: EWWW Image Optimizer ≤ 8.7.7 Patched Versions: 8.7.8
Mitigation steps: Update to EWWW Image Optimizer version 8.7.8 or greater.
W3 Total Cache – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-114178 Number of Installations: 900,000+ Affected Software: W3 Total Cache ≤ 2.10.7 Patched Versions: 2.10.8
Mitigation steps: Update to W3 Total Cache version 2.10.8 or greater.
Polylang – Authenticated (Editor+) PHP Object Injection
Security Risk: Medium Exploitation Level: Requires Editor or higher level authentication. Vulnerability: Authenticated (Editor+) PHP Object Injection CVE: CVE-2026-97278 Number of Installations: 900,000+ Affected Software: Polylang ≤ 3.8.9 Patched Versions: 3.8.10
Mitigation steps: Update to Polylang version 3.8.10 or greater.
Redux Framework – Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension CVE: CVE-2025-14123 Number of Installations: 900,000+ Affected Software: Redux Framework <= 4.5.11 Patched Versions: Redux Framework 4.5.13
Mitigation steps: Update to Redux Framework version 4.5.13 or greater.
W3 Total Cache – Authenticated (Author+) Path Traversal
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Authenticated (Author+) Path Traversal CVE: CVE-2026-107321 Number of Installations: 900,000+ Affected Software: W3 Total Cache ≤ 2.10.5 Patched Versions: 2.10.6
Mitigation steps: Update to W3 Total Cache version 2.10.6 or greater.
Polylang – Authenticated (Contributor+) Information Exposure
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Information Exposure CVE: CVE-2026-39783 Number of Installations: 900,000+ Affected Software: Polylang ≤ 3.8.7 Patched Versions: 3.8.8
Mitigation steps: Update to Polylang version 3.8.8 or greater.
W3 Total Cache – Unauthenticated Stored Cross-Site Scripting via Comment Content
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content CVE: CVE-2026-87920 Number of Installations: 900,000+ Affected Software: W3 Total Cache ≤ 2.10.6 Patched Versions: 2.10.7
Mitigation steps: Update to W3 Total Cache version 2.10.7 or greater.
Fluent Forms – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-111831 Number of Installations: 800,000+ Affected Software: Fluent Forms ≤ 6.2.15 Patched Versions: 6.2.16
Mitigation steps: Update to Fluent Forms version 6.2.16 or greater.
Autoptimize – Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Author Name CVE: CVE-2026-78471 Number of Installations: 800,000+ Affected Software: Autoptimize ≤ 3.1.15.1 Patched Versions: 3.1.15.2
Mitigation steps: Update to Autoptimize version 3.1.15.2 or greater.
Fluent Forms – Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
Security Risk: Medium Exploitation Level: Requires Custom or higher level authentication. Vulnerability: Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification CVE: CVE-2026-15178 Number of Installations: 700,000+ Affected Software: Fluent Forms ≤ 6.2.5 Patched Versions: 6.2.6
Mitigation steps: Update to Fluent Forms version 6.2.6 or greater.
Fluent Forms – Reflected Cross-Site Scripting via ‘{get.*}’ Editor SmartCode Parameter
Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
CVE: CVE-2026-101324
Number of Installations: 700,000+
Affected Software: Fluent Forms ≤ 6.2.14
Patched Versions: 6.2.15Mitigation steps: Update to Fluent Forms version 6.2.15 or greater.
MainWP Child – Unauthenticated PHP Object Injection
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated PHP Object Injection CVE: CVE-2026-105436 Number of Installations: 700,000+ Affected Software: MainWP Child ≤ 6.2.1 Patched Versions: 6.2.2
Mitigation steps: Update to MainWP Child version 6.2.2 or greater.
Forminator Forms – Unauthenticated Limited File Deletion via Draft Upload Metadata
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Limited File Deletion via Draft Upload Metadata CVE: CVE-2026-5461 Number of Installations: 600,000+ Affected Software: Forminator Forms ≤ 1.55.0.2 Patched Versions: 1.55.0.3
Mitigation steps: Update to Forminator Forms version 1.55.0.3 or greater.
Royal Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-107098 Number of Installations: 600,000+ Affected Software: Royal Addons for Elementor 1.7.1037 - 1.7.1069 Patched Versions: 1.7.1070
Mitigation steps: Update to Royal Addons for Elementor version 1.7.1070 or greater.
Royal Addons for Elementor – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-107097 Number of Installations: 600,000+ Affected Software: Royal Addons for Elementor 1.3.71 - 1.7.1069 Patched Versions: 1.7.1070
Mitigation steps: Update to Royal Addons for Elementor version 1.7.1070 or greater.
Royal Addons for Elementor – Unauthenticated Information Exposure
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-107100 Number of Installations: 600,000+ Affected Software: Royal Addons for Elementor 1.3.81 - 1.7.1069 Patched Versions: 1.7.1070
Mitigation steps: Update to Royal Addons for Elementor version 1.7.1070 or greater.
Royal Addons for Elementor – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-106647 Number of Installations: 600,000+ Affected Software: Royal Addons for Elementor 1.3.68 - 1.7.1069 Patched Versions: 1.7.1070
Mitigation steps: Update to Royal Addons for Elementor version 1.7.1070 or greater.
Enable Media Replace – Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow CVE: CVE-2026-85655 Number of Installations: 600,000+ Affected Software: Enable Media Replace ≤ 4.2.2 Patched Versions: 4.2.3
Mitigation steps: Update to Enable Media Replace version 4.2.3 or greater.
Royal Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-112865 Number of Installations: 600,000+ Affected Software: Royal Addons for Elementor ≤ 1.7.1069 Patched Versions: 1.7.1070
Mitigation steps: Update to Royal Addons for Elementor version 1.7.1070 or greater.
Kadence Blocks – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-115602 Number of Installations: 600,000+ Affected Software: Kadence Blocks ≤ 3.8.0.1 Patched Versions: 3.8.0.2
Mitigation steps: Update to Kadence Blocks version 3.8.0.2 or greater.
Royal Addons for Elementor – Unauthenticated Insecure Direct Object Reference
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Insecure Direct Object Reference CVE: CVE-2026-97255 Number of Installations: 600,000+ Affected Software: Royal Addons for Elementor ≤ 1.7.1069 Patched Versions: 1.7.1070
Mitigation steps: Update to Royal Addons for Elementor version 1.7.1070 or greater.
Royal Addons for Elementor – Unauthenticated Unauthorized Email Relay
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Unauthorized Email Relay CVE: CVE-2026-106648 Number of Installations: 600,000+ Affected Software: Royal Addons for Elementor < 1.7.1070 Patched Versions: 1.7.1070
Mitigation steps: Update to Royal Addons for Elementor version 1.7.1070 or greater.
MetForm – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-114180 Number of Installations: 600,000+ Affected Software: MetForm ≤ 4.3.2 Patched Versions: 4.3.3
Mitigation steps: Update to MetForm version 4.3.3 or greater.
Royal Addons for Elementor – Authenticated (Contributor+) Remote Code Execution
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Remote Code Execution CVE: CVE-2026-111851 Number of Installations: 600,000+ Affected Software: Royal Addons for Elementor ≤ 1.7.1068 Patched Versions: 1.7.1069
Mitigation steps: Update to Royal Addons for Elementor version 1.7.1069 or greater.
The Events Calendar – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-110903 Number of Installations: 600,000+ Affected Software: The Events Calendar ≤ 6.18.1 Patched Versions: 6.18.2
Mitigation steps: Update to The Events Calendar version 6.18.2 or greater.
Backuply – Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation CVE: CVE-2026-93953 Number of Installations: 600,000+ Affected Software: Backuply ≤ 1.5.8 Patched Versions: 1.5.9
Mitigation steps: Update to Backuply version 1.5.9 or greater.
Forminator Forms – Unauthenticated Arbitrary Shortcode Execution via ‘User-Agent’ Header and ‘referer_url’ Parameter via Quiz Notification Merge Tags
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags CVE: CVE-2026-101335 Number of Installations: 600,000+ Affected Software: Forminator Forms ≤ 1.58.1 Patched Versions: 1.58.2
Mitigation steps: Update to Forminator Forms version 1.58.2 or greater.
Forminator Forms – Unauthenticated Arbitrary Shortcode Execution via ‘s’ Search Parameter and Anonymous Comment via render_block
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block CVE: CVE-2026-103911 Number of Installations: 600,000+ Affected Software: Forminator Forms ≤ 1.58.1 Patched Versions: 1.58.2
Mitigation steps: Update to Forminator Forms version 1.58.2 or greater.
Database Addon for Contact Form 7 – Unauthenticated Limited File Deletion via Injected ‘attackcfdb7_file’ Submission Field
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field CVE: CVE-2026-107652 Number of Installations: 600,000+ Affected Software: Database Addon for Contact Form 7 ≤ 1.4.1 Patched Versions: 1.4.2
Mitigation steps: Update to Database Addon for Contact Form 7 version 1.4.2 or greater.
Click to Chat – Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
CVE: CVE-2026-92097
Number of Installations: 600,000+
Affected Software: Click to Chat ≤ 4.44
Patched Versions: 4.45Mitigation steps: Update to Click to Chat version 4.45 or greater.
Premium Addons for Elementor – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-109890 Number of Installations: 600,000+ Affected Software: Premium Addons for Elementor ≤ 4.11.110 Patched Versions: 4.11.111
Mitigation steps: Update to Premium Addons for Elementor version 4.11.111 or greater.
Premium Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-108482 Number of Installations: 600,000+ Affected Software: Premium Addons for Elementor ≤ 4.11.110 Patched Versions: 4.11.111
Mitigation steps: Update to Premium Addons for Elementor version 4.11.111 or greater.
Forminator Forms – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-108486 Number of Installations: 600,000+ Affected Software: Forminator Forms ≤ 1.58.0 Patched Versions: 1.58.1
Mitigation steps: Update to Forminator Forms version 1.58.1 or greater.
Kadence Blocks – Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute CVE: CVE-2026-104762 Number of Installations: 600,000+ Affected Software: Kadence Blocks ≤ 3.7.12 Patched Versions: 3.7.13
Mitigation steps: Update to Kadence Blocks version 3.7.13 or greater.
Kadence Blocks – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-105890 Number of Installations: 600,000+ Affected Software: Kadence Blocks ≤ 3.7.12 Patched Versions: 3.7.13
Mitigation steps: Update to Kadence Blocks version 3.7.13 or greater.
Forminator Forms – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-102388 Number of Installations: 600,000+ Affected Software: Forminator Forms ≤ 1.57.3 Patched Versions: 1.57.4
Mitigation steps: Update to Forminator Forms version 1.57.4 or greater.
Forminator Forms – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-65459 Number of Installations: 600,000+ Affected Software: Forminator Forms ≤ 1.57.3 Patched Versions: 1.57.4
Mitigation steps: Update to Forminator Forms version 1.57.4 or greater.
Forminator Forms – Unauthenticated Privilege Escalation
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Privilege Escalation CVE: CVE-2026-96341 Number of Installations: 600,000+ Affected Software: Forminator Forms ≤ 1.57.3 Patched Versions: 1.57.4
Mitigation steps: Update to Forminator Forms version 1.57.4 or greater.
Premium Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-103084 Number of Installations: 600,000+ Affected Software: Premium Addons for Elementor ≤ 4.11.109 Patched Versions: 4.11.110
Mitigation steps: Update to Premium Addons for Elementor version 4.11.110 or greater.
Kadence Blocks – Unauthenticated Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-103354 Number of Installations: 600,000+ Affected Software: Kadence Blocks ≤ 3.7.11.1 Patched Versions: 3.7.11.2
Mitigation steps: Update to Kadence Blocks version 3.7.11.2 or greater.
Forminator Forms – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-96335 Number of Installations: 600,000+ Affected Software: Forminator Forms ≤ 1.57.2 Patched Versions: 1.57.3
Mitigation steps: Update to Forminator Forms version 1.57.3 or greater.
The Events Calendar – Unauthenticated PHP Object Injection
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated PHP Object Injection CVE: CVE-2026-95606 Number of Installations: 600,000+ Affected Software: The Events Calendar ≤ 6.17.4 Patched Versions: 6.17.5
Mitigation steps: Update to The Events Calendar version 6.17.5 or greater.
Ninja Forms – Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission CVE: CVE-2026-90438 Number of Installations: 600,000+ Affected Software: Ninja Forms ≤ 3.15.4 Patched Versions: 3.15.5
Mitigation steps: Update to Ninja Forms version 3.15.5 or greater.
WP Statistics – Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key CVE: CVE-2026-97652 Number of Installations: 600,000+ Affected Software: WP Statistics ≤ 14.16.14 Patched Versions: 14.16.15
Mitigation steps: Update to WP Statistics version 14.16.15 or greater.
Ninja Forms – Reflected DOM-Based Cross-Site Scripting via ‘querystring:<key>’ URL Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter CVE: CVE-2026-100151 Number of Installations: 500,000+ Affected Software: Ninja Forms ≤ 3.15.5 Patched Versions: 3.15.6
Mitigation steps: Update to Ninja Forms version 3.15.6 or greater.
GoSMTP – Authenticated (Custom Role+) Privilege Escalation
Security Risk: High Exploitation Level: Requires Custom Role or higher level authentication. Vulnerability: Authenticated (Custom Role+) Privilege Escalation CVE: CVE-2026-111577 Number of Installations: 500,000+ Affected Software: GoSMTP < 1.2.5 Patched Versions: 1.2.5
Mitigation steps: Update to GoSMTP version 1.2.5 or greater.
Meta Box – Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys CVE: CVE-2026-109216 Number of Installations: 500,000+ Affected Software: Meta Box ≤ 5.15.2 Patched Versions: 5.15.3
Mitigation steps: Update to Meta Box version 5.15.3 or greater.
Kirki – Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via ‘get-single-symbol’ AJAX Endpoint
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint CVE: CVE-2026-75891 Number of Installations: 500,000+ Affected Software: Kirki ≤ 6.2.5 Patched Versions: 6.2.6
Mitigation steps: Update to Kirki version 6.2.6 or greater.
MailPoet – Reflected Cross-Site Scripting
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting CVE: VULN-46345 Number of Installations: 500,000+ Affected Software: MailPoet < 5.14.2 Patched Versions: 5.14.2
Mitigation steps: Update to MailPoet version 5.14.2 or greater.
Meta Box – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-109700 Number of Installations: 500,000+ Affected Software: Meta Box ≤ 5.15.2 Patched Versions: 5.15.3
Mitigation steps: Update to Meta Box version 5.15.3 or greater.
Ninja Forms – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-110899 Number of Installations: 500,000+ Affected Software: Ninja Forms ≤ 3.15.5 Patched Versions: 3.15.6
Mitigation steps: Update to Ninja Forms version 3.15.6 or greater.
Kirki – Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via ‘context’ Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter CVE: CVE-2026-107762 Number of Installations: 500,000+ Affected Software: Kirki ≤ 6.3.2 Patched Versions: 6.3.3
Mitigation steps: Update to Kirki version 6.3.3 or greater.
Kirki – Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import CVE: CVE-2026-104734 Number of Installations: 500,000+ Affected Software: Kirki ≤ 6.3.2 Patched Versions: 6.3.3
Mitigation steps: Update to Kirki version 6.3.3 or greater.
Broken Link Checker – Unauthenticated Arbitrary Shortcode Execution via parser_callback
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution via parser_callback CVE: CVE-2026-96562 Number of Installations: 500,000+ Affected Software: Broken Link Checker ≤ 2.4.14.1 Patched Versions: 2.4.14.2
Mitigation steps: Update to Broken Link Checker version 2.4.14.2 or greater.
Ocean Extra – Unauthenticated Arbitrary Shortcode Execution via ‘oceanwp_library’ Shortcode Template
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template CVE: CVE-2026-86803 Number of Installations: 500,000+ Affected Software: Ocean Extra ≤ 2.6.0 Patched Versions: 2.6.1
Mitigation steps: Update to Ocean Extra version 2.6.1 or greater.
Kirki – Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
Security Risk: Low Exploitation Level: Requires Custom or higher level authentication. Vulnerability: Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content CVE: CVE-2026-14572 Number of Installations: 500,000+ Affected Software: Kirki ≤ 6.2.0 Patched Versions: 6.2.1
Mitigation steps: Update to Kirki version 6.2.1 or greater.
SureForms – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-108495 Number of Installations: 500,000+ Affected Software: SureForms ≤ 2.12.7 Patched Versions: 2.12.8
Mitigation steps: Update to SureForms version 2.12.8 or greater.
Kirki – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘display_name’
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' CVE: CVE-2026-102291 Number of Installations: 500,000+ Affected Software: Kirki ≤ 6.3.1 Patched Versions: 6.3.2
Mitigation steps: Update to Kirki version 6.3.2 or greater.
SpeedyCache – Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check CVE: CVE-2026-104006 Number of Installations: 500,000+ Affected Software: SpeedyCache ≤ 1.4.2 Patched Versions: 1.4.3
Mitigation steps: Update to SpeedyCache version 1.4.3 or greater.
Kirki – Authenticated (Editor+) Server-Side Request Forgery
Security Risk: Low Exploitation Level: Requires Editor or higher level authentication. Vulnerability: Authenticated (Editor+) Server-Side Request Forgery CVE: CVE-2026-84224 Number of Installations: 500,000+ Affected Software: Kirki ≤ 6.3.1 Patched Versions: 6.3.2
Mitigation steps: Update to Kirki version 6.3.2 or greater.
Kirki – Unauthenticated Arbitrary Shortcode Execution
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution CVE: CVE-2026-84220 Number of Installations: 500,000+ Affected Software: Kirki ≤ 6.3.1 Patched Versions: 6.3.2
Mitigation steps: Update to Kirki version 6.3.2 or greater.
Kirki – Unauthenticated Stored Cross-Site Scripting via Registration Metadata
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Registration Metadata CVE: CVE-2026-102173 Number of Installations: 500,000+ Affected Software: Kirki ≤ 6.3.1 Patched Versions: 6.3.2
Mitigation steps: Update to Kirki version 6.3.2 or greater.
WP Statistics – Reflected Cross-Site Scripting
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-97276 Number of Installations: 500,000+ Affected Software: WP Statistics ≤ 14.16.14 Patched Versions: 14.16.15
Mitigation steps: Update to WP Statistics version 14.16.15 or greater.
Page Builder by SiteOrigin – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-110506 Number of Installations: 400,000+ Affected Software: Page Builder by SiteOrigin < 2.38.0 Patched Versions: 2.38.0
Mitigation steps: Update to Page Builder by SiteOrigin version 2.38.0 or greater.
Page Builder by SiteOrigin – Authenticated (Contributor+) Information Exposure
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Information Exposure CVE: CVE-2026-110507 Number of Installations: 400,000+ Affected Software: Page Builder by SiteOrigin < 2.38.0 Patched Versions: 2.38.0
Mitigation steps: Update to Page Builder by SiteOrigin version 2.38.0 or greater.
YITH WooCommerce Wishlist – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-112199 Number of Installations: 400,000+ Affected Software: YITH WooCommerce Wishlist ≤ 4.18.1 Patched Versions: 4.18.2
Mitigation steps: Update to YITH WooCommerce Wishlist version 4.18.2 or greater.
TranslatePress – Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers CVE: CVE-2026-107768 Number of Installations: 400,000+ Affected Software: TranslatePress ≤ 3.3.7 Patched Versions: 3.3.8
Mitigation steps: Update to TranslatePress version 3.3.8 or greater.
SiteOrigin Widgets Bundle – Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode ‘value’ JSON Instance (design.colors LESS Variable)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable) CVE: CVE-2026-97348 Number of Installations: 400,000+ Affected Software: SiteOrigin Widgets Bundle ≤ 1.74.3 Patched Versions: 1.74.4
Mitigation steps: Update to SiteOrigin Widgets Bundle version 1.74.4 or greater.
BackWPup – Unauthenticated Information Exposure
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-86826 Number of Installations: 400,000+ Affected Software: BackWPup < 5.7.7 Patched Versions: 5.7.7
Mitigation steps: Update to BackWPup version 5.7.7 or greater.
BackWPup – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-86827 Number of Installations: 400,000+ Affected Software: BackWPup 3.3 - 5.7.6 Patched Versions: 5.7.7
Mitigation steps: Update to BackWPup version 5.7.7 or greater.
BackWPup – Authenticated (Administrator+) Path Traversal
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Administrator+) Path Traversal CVE: CVE-2026-86828 Number of Installations: 400,000+ Affected Software: BackWPup < 5.7.7 Patched Versions: 5.7.7
Mitigation steps: Update to BackWPup version 5.7.7 or greater.
HappyAddons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-104393 Number of Installations: 400,000+ Affected Software: HappyAddons for Elementor ≤ 3.50.0 Patched Versions: 3.50.1
Mitigation steps: Update to HappyAddons for Elementor version 3.50.1 or greater.
TranslatePress – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-103062 Number of Installations: 400,000+ Affected Software: TranslatePress ≤ 3.3.6 Patched Versions: 3.3.7
Mitigation steps: Update to TranslatePress version 3.3.7 or greater.
SiteOrigin Widgets Bundle – Authenticated (Contributor+) Local File Inclusion via ‘theme’ Parameter
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter CVE: CVE-2026-92174 Number of Installations: 400,000+ Affected Software: SiteOrigin Widgets Bundle ≤ 1.73.2 Patched Versions: 1.73.3
Mitigation steps: Update to SiteOrigin Widgets Bundle version 1.73.3 or greater.
Photo Gallery, Sliders, Proofing and Themes – Authenticated (Custom+) Remote Code Execution via XML-RPC ‘meta_data’ Mass Assignment and Path Traversal
Security Risk: High Exploitation Level: Requires Custom or higher level authentication. Vulnerability: Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal CVE: CVE-2026-76010 Number of Installations: 300,000+ Affected Software: Photo Gallery, Sliders, Proofing and Themes ≤ 4.4.1 Patched Versions: 4.4.2
Mitigation steps: Update to Photo Gallery, Sliders, Proofing and Themes version 4.4.2 or greater.
Formidable Forms – Authenticated (Subscriber+) Arbitrary Plugin Installation via ‘file_url’ Parameter
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter CVE: CVE-2026-89435 Number of Installations: 300,000+ Affected Software: Formidable Forms ≤ 6.35 Patched Versions: 6.36
Mitigation steps: Update to Formidable Forms version 6.36 or greater.
Password Protected – Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler CVE: CVE-2026-93293 Number of Installations: 300,000+ Affected Software: Password Protected ≤ 2.8.4 Patched Versions: 2.8.5
Mitigation steps: Update to Password Protected version 2.8.5 or greater.
CMB2 – Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form CVE: CVE-2026-116761 Number of Installations: 300,000+ Affected Software: CMB2 ≤ 2.13.4 Patched Versions: 2.13.5
Mitigation steps: Update to CMB2 version 2.13.5 or greater.
Otter Blocks – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-109933 Number of Installations: 300,000+ Affected Software: Otter Blocks < 3.2.8 Patched Versions: 3.2.8
Mitigation steps: Update to Otter Blocks version 3.2.8 or greater.
Otter Blocks – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-109934 Number of Installations: 300,000+ Affected Software: Otter Blocks 3.1.1 - 3.2.7 Patched Versions: 3.2.8
Mitigation steps: Update to Otter Blocks version 3.2.8 or greater.
Otter Blocks – Unauthenticated Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-109936 Number of Installations: 300,000+ Affected Software: Otter Blocks < 3.2.8 Patched Versions: 3.2.8
Mitigation steps: Update to Otter Blocks version 3.2.8 or greater.
Otter Blocks – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Editor or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-109935 Number of Installations: 300,000+ Affected Software: Otter Blocks < 3.2.8 Patched Versions: 3.2.8
Mitigation steps: Update to Otter Blocks version 3.2.8 or greater.
Ad Inserter – Reflected Cross-Site Scripting
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-114194 Number of Installations: 300,000+ Affected Software: Ad Inserter ≤ 2.8.18 Patched Versions: 2.8.19
Mitigation steps: Update to Ad Inserter version 2.8.19 or greater.
Formidable Forms – Unauthenticated Denial of Service
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Denial of Service CVE: CVE-2026-85642 Number of Installations: 300,000+ Affected Software: Formidable Forms < 7.0 Patched Versions: 7.0
Mitigation steps: Update to Formidable Forms version 7.0 or greater.
WebP Express – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-97328 Number of Installations: 300,000+ Affected Software: WebP Express ≤ 0.25.15 Patched Versions: 0.25.16
Mitigation steps: Update to WebP Express version 0.25.16 or greater.
WP Mail Logging – Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email CVE: CVE-2026-109401 Number of Installations: 300,000+ Affected Software: WP Mail Logging ≤ 1.17.0 Patched Versions: 1.17.1
Mitigation steps: Update to WP Mail Logging version 1.17.1 or greater.
Cart Abandonment Recovery for WooCommerce – Unauthenticated Insecure Direct Object Reference
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Insecure Direct Object Reference CVE: CVE-2026-96900 Number of Installations: 300,000+ Affected Software: Cart Abandonment Recovery for WooCommerce < 2.1.4 Patched Versions: 2.1.4
Mitigation steps: Update to Cart Abandonment Recovery for WooCommerce version 2.1.4 or greater.
Jeg Kit for Elementor – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via ‘jeg_find_author’ AJAX Action
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action CVE: CVE-2026-103907 Number of Installations: 300,000+ Affected Software: Jeg Kit for Elementor ≤ 3.2.19 Patched Versions: 3.2.20
Mitigation steps: Update to Jeg Kit for Elementor version 3.2.20 or greater.
Ad Inserter – Authenticated (Subscriber+) Sensitive Information Disclosure in ‘ai-debug-processing-fe’ & ‘ai-debug-meta’ URL Parameters
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters CVE: CVE-2026-89097 Number of Installations: 300,000+ Affected Software: Ad Inserter ≤ 2.8.18 Patched Versions: 2.8.19
Mitigation steps: Update to Ad Inserter version 2.8.19 or greater.
Ad Inserter – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-107864 Number of Installations: 300,000+ Affected Software: Ad Inserter ≤ 2.8.18 Patched Versions: 2.8.19
Mitigation steps: Update to Ad Inserter version 2.8.19 or greater.
Blocksy Companion – Unauthenticated Privilege Escalation to ‘role’ Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Privilege Escalation to 'role' Parameter CVE: CVE-2026-107645 Number of Installations: 300,000+ Affected Software: Blocksy Companion ≤ 2.1.58 Patched Versions: 2.1.59
Mitigation steps: Update to Blocksy Companion version 2.1.59 or greater.
ShortPixel Image Optimizer – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-103070 Number of Installations: 300,000+ Affected Software: ShortPixel Image Optimizer ≤ 6.5.6 Patched Versions: 6.5.7
Mitigation steps: Update to ShortPixel Image Optimizer version 6.5.7 or greater.
WP Rollback – Unauthenticated Information Exposure
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-66435 Number of Installations: 300,000+ Affected Software: WP Rollback ≤ 3.1.2 Patched Versions: 3.1.3
Mitigation steps: Update to WP Rollback version 3.1.3 or greater.
OMGF – Unauthenticated Stored Cross-Site Scripting via ‘s’ Search Parameter in comments-atom Feed
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed CVE: CVE-2026-89417 Number of Installations: 300,000+ Affected Software: OMGF ≤ 6.3.10 Patched Versions: 6.3.11
Mitigation steps: Update to OMGF version 6.3.11 or greater.
Post SMTP – Unauthenticated Stored DOM-Based Cross-Site Scripting via ‘user_email’ Parameter (Multisite Registration → Failed Email Log)
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log) CVE: CVE-2026-75962 Number of Installations: 300,000+ Affected Software: Post SMTP ≤ 4.0.1 Patched Versions: 4.0.2
Mitigation steps: Update to Post SMTP version 4.0.2 or greater.
Unlimited Elements for Elementor – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-105064 Number of Installations: 300,000+ Affected Software: Unlimited Elements for Elementor ≤ 2.0.22 Patched Versions: 2.0.23
Mitigation steps: Update to Unlimited Elements for Elementor version 2.0.23 or greater.
Jeg Kit for Elementor – Unauthenticated Stored Cross-Site Scripting via Comment
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment CVE: CVE-2026-100180 Number of Installations: 300,000+ Affected Software: Jeg Kit for Elementor ≤ 3.2.19 Patched Versions: 3.2.20
Mitigation steps: Update to Jeg Kit for Elementor version 3.2.20 or greater.
SEOPress – Unauthenticated Stored Cross-Site Scripting via Author Display Name
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Author Display Name CVE: CVE-2026-96564 Number of Installations: 300,000+ Affected Software: SEOPress ≤ 10.2 Patched Versions: 10.3
Mitigation steps: Update to SEOPress version 10.3 or greater.
SEOPress – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘seopress_google_analytics_matomo_id’ Parameter
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter CVE: CVE-2026-101357 Number of Installations: 300,000+ Affected Software: SEOPress ≤ 10.2 Patched Versions: 10.3
Mitigation steps: Update to SEOPress version 10.3 or greater.
Unlimited Elements for Elementor – Unauthenticated SQL Injection
Security Risk: Critical Exploitation Level: No authentication required. Vulnerability: Unauthenticated SQL Injection CVE: CVE-2026-103355 Number of Installations: 300,000+ Affected Software: Unlimited Elements for Elementor ≤ 2.0.20 Patched Versions: 2.0.21
Mitigation steps: Update to Unlimited Elements for Elementor version 2.0.21 or greater.
Unlimited Elements for Elementor – Authenticated (Contributor+) PHP Object Injection
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) PHP Object Injection CVE: CVE-2026-95534 Number of Installations: 300,000+ Affected Software: Unlimited Elements for Elementor ≤ 2.0.19 Patched Versions: 2.0.20
Mitigation steps: Update to Unlimited Elements for Elementor version 2.0.20 or greater.
Unlimited Elements for Elementor – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-94662 Number of Installations: 300,000+ Affected Software: Unlimited Elements for Elementor ≤ 2.0.19 Patched Versions: 2.0.20
Mitigation steps: Update to Unlimited Elements for Elementor version 2.0.20 or greater.
CMB2 – Unauthenticated Stored Cross-Site Scripting via ‘file_list’ Field Type
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type CVE: CVE-2026-97336 Number of Installations: 300,000+ Affected Software: CMB2 ≤ 2.13.0 Patched Versions: 2.13.1
Mitigation steps: Update to CMB2 version 2.13.1 or greater.
CMB2 – Unauthenticated Stored Cross-Site Scripting via ‘textarea_code’ Field
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field CVE: CVE-2026-102772 Number of Installations: 300,000+ Affected Software: CMB2 ≤ 2.13.1 Patched Versions: 2.13.2
Mitigation steps: Update to CMB2 version 2.13.2 or greater.
Otter Blocks – Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget CVE: CVE-2026-102002 Number of Installations: 300,000+ Affected Software: Otter Blocks ≤ 3.2.6 Patched Versions: 3.2.7
Mitigation steps: Update to Otter Blocks version 3.2.7 or greater.
MW WP Form – Unauthenticated Sensitive Information Exposure in ‘post_id’ Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Sensitive Information Exposure in 'post_id' Parameter CVE: CVE-2026-92086 Number of Installations: 200,000+ Affected Software: MW WP Form ≤ 5.1.7 Patched Versions: 5.1.8
Mitigation steps: Update to MW WP Form version 5.1.8 or greater.
Ultimate Member – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘user_url’ Profile Field
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field CVE: CVE-2026-107625 Number of Installations: 200,000+ Affected Software: Ultimate Member ≤ 2.14.0 Patched Versions: 2.14.1
Mitigation steps: Update to Ultimate Member version 2.14.1 or greater.
Popup Builder – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-112230 Number of Installations: 200,000+ Affected Software: Popup Builder < 4.4.6 Patched Versions: 4.4.6
Mitigation steps: Update to Popup Builder version 4.4.6 or greater.
Qi Addons For Elementor – Authenticated (Contributor+) Arbitrary HTML Injection
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Arbitrary HTML Injection CVE: CVE-2026-115183 Number of Installations: 200,000+ Affected Software: Qi Addons For Elementor ≤ 1.11.1 Patched Versions: 1.11.2
Mitigation steps: Update to Qi Addons For Elementor version 1.11.2 or greater.
CleanTalk Anti-Spam – Unauthenticated Stored Cross-Site Scripting via ‘user_email’ Registration Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter CVE: CVE-2026-109198 Number of Installations: 200,000+ Affected Software: CleanTalk Anti-Spam ≤ 6.89.1 Patched Versions: 6.89.2
Mitigation steps: Update to CleanTalk Anti-Spam version 6.89.2 or greater.
JetBackup – Authenticated (Admin+) Arbitrary File Write
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Admin+) Arbitrary File Write CVE: CVE-2026-104068 Number of Installations: 200,000+ Affected Software: JetBackup ≤ 3.1.24.9 Patched Versions: 3.1.24.10
Mitigation steps: Update to JetBackup version 3.1.24.10 or greater.
Redirection for Contact Form 7 – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-111574 Number of Installations: 200,000+ Affected Software: Redirection for Contact Form 7 2.2.7 - 3.2.11 Patched Versions: 3.2.12
Mitigation steps: Update to Redirection for Contact Form 7 version 3.2.12 or greater.
WPConsent – Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) CVE: CVE-2026-97640 Number of Installations: 200,000+ Affected Software: WPConsent ≤ 1.1.9 Patched Versions: 1.1.10
Mitigation steps: Update to WPConsent version 1.1.10 or greater.
Anti-Spam by CleanTalk – Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex CVE: CVE-2026-103424 Number of Installations: 200,000+ Affected Software: Anti-Spam by CleanTalk ≤ 6.88 Patched Versions: 6.89
Mitigation steps: Update to Anti-Spam by CleanTalk version 6.89 or greater.
Optimole – Authenticated (Subscriber+) Information Exposure
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Information Exposure CVE: CVE-2026-96530 Number of Installations: 200,000+ Affected Software: Optimole 4.0.0 - 4.2.14 Patched Versions: 4.2.15
Mitigation steps: Update to Optimole version 4.2.15 or greater.
Advanced Google reCAPTCHA – Unauthenticated Login Protection Bypass
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Login Protection Bypass CVE: CVE-2026-100518 Number of Installations: 200,000+ Affected Software: Advanced Google reCAPTCHA ≤ 5.40 Patched Versions: 5.41
Mitigation steps: Update to Advanced Google reCAPTCHA version 5.41 or greater.
Ultimate Member – Unauthenticated Stored Cross-Site Scripting via ‘form_id’ Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter CVE: CVE-2026-96270 Number of Installations: 200,000+ Affected Software: Ultimate Member ≤ 2.13.1 Patched Versions: 2.13.2
Mitigation steps: Update to Ultimate Member version 2.13.2 or greater.
Ultimate Member – Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass CVE: CVE-2026-93428 Number of Installations: 200,000+ Affected Software: Ultimate Member ≤ 2.13.1 Patched Versions: 2.13.2
Mitigation steps: Update to Ultimate Member version 2.13.2 or greater.
Burst Statistics – Improper Authentication to Account Persistence via Share-Link Authentication Bypass via ‘burst_share_token’
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token' CVE: CVE-2026-97343 Number of Installations: 200,000+ Affected Software: Burst Statistics ≤ 3.7.1 Patched Versions: 3.7.2
Mitigation steps: Update to Burst Statistics version 3.7.2 or greater.
MW WP Form – Unauthenticated Stored Cross-Site Scripting via ‘post_id’ Parameter (via stored form-submitted post meta)
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta) CVE: CVE-2026-96567 Number of Installations: 200,000+ Affected Software: MW WP Form ≤ 5.1.7 Patched Versions: 5.1.8
Mitigation steps: Update to MW WP Form version 5.1.8 or greater.
Newsletter – Unauthenticated Stored Cross-Site Scripting via ‘np1’ Custom Field Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter CVE: CVE-2026-96566 Number of Installations: 200,000+ Affected Software: Newsletter ≤ 9.4.0 Patched Versions: 9.4.1
Mitigation steps: Update to Newsletter version 9.4.1 or greater.
Smash Balloon Social Post Feed – Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview CVE: CVE-2026-93756 Number of Installations: 200,000+ Affected Software: Smash Balloon Social Post Feed ≤ 4.13.0 Patched Versions: 4.13.1
Mitigation steps: Update to Smash Balloon Social Post Feed version 4.13.1 or greater.
Rich Showcase for Google Reviews – Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via ‘grw_auth_code’ Site Secret Disclosure via grw-builder Admin Page
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page CVE: CVE-2026-110020 Number of Installations: 100,000+ Affected Software: Rich Showcase for Google Reviews ≤ 7.1.6 Patched Versions: 7.1.7
Mitigation steps: Update to Rich Showcase for Google Reviews version 7.1.7 or greater.
Prime Slider – Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape CVE: CVE-2026-111111 Number of Installations: 100,000+ Affected Software: Prime Slider ≤ 4.7.2 Patched Versions: 4.7.3
Mitigation steps: Update to Prime Slider version 4.7.3 or greater.
Advanced Custom Fields: Extended – Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints CVE: CVE-2026-2839 Number of Installations: 100,000+ Affected Software: Advanced Custom Fields: Extended ≤ 0.9.2.7 Patched Versions: Advanced Custom Fields: Extended 0.9.2.8
Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.8 or greater.
Advanced Custom Fields: Extended – Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field CVE: CVE-2026-10752 Number of Installations: 100,000+ Affected Software: Advanced Custom Fields: Extended ≤ 0.9.2.6 Patched Versions: 0.9.2.7
Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.7 or greater.
GiveWP – Unauthenticated Information Exposure
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-111976 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.19.0.0 Patched Versions: 4.19.0.1
Mitigation steps: Update to GiveWP version 4.19.0.1 or greater.
GiveWP – Authenticated (Give Worker+) Stored Cross-Site Scripting
Security Risk: High Exploitation Level: Requires Give Worker or higher level authentication. Vulnerability: Authenticated (Give Worker+) Stored Cross-Site Scripting CVE: CVE-2026-111979 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.19.0.0 Patched Versions: 4.19.0.1
Mitigation steps: Update to GiveWP version 4.19.0.1 or greater.
Advanced Custom Fields: Extended – Unauthenticated Arbitrary Non-Admin Account Takeover
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Non-Admin Account Takeover CVE: CVE-2026-94262 Number of Installations: 100,000+ Affected Software: Advanced Custom Fields: Extended ≤ 0.9.2.7 Patched Versions: Advanced Custom Fields: Extended 0.9.2.8
Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.8 or greater.
Advanced Custom Fields: Extended – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-94264 Number of Installations: 100,000+ Affected Software: Advanced Custom Fields: Extended ≤ 0.9.2.7 Patched Versions: Advanced Custom Fields: Extended 0.9.2.8
Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.8 or greater.
GiveWP – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-111980 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.19.0.0 Patched Versions: 4.19.0.1
Mitigation steps: Update to GiveWP version 4.19.0.1 or greater.
GiveWP – Unauthenticated Donation Amount Restriction Bypass
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Donation Amount Restriction Bypass CVE: CVE-2026-111974 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.19.0.0 Patched Versions: 4.19.0.1
Mitigation steps: Update to GiveWP version 4.19.0.1 or greater.
Advanced Custom Fields: Extended – Unauthenticated Privilege Escalation via Account Takeover
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Privilege Escalation via Account Takeover CVE: CVE-2026-94268 Number of Installations: 100,000+ Affected Software: Advanced Custom Fields: Extended ≤ 0.9.2.7 Patched Versions: Advanced Custom Fields: Extended 0.9.2.8
Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.8 or greater.
Advanced Custom Fields: Extended – Unauthenticated Remote Code Execution
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Remote Code Execution CVE: CVE-2026-94267 Number of Installations: 100,000+ Affected Software: Advanced Custom Fields: Extended ≤ 0.9.2.7 Patched Versions: Advanced Custom Fields: Extended 0.9.2.8
Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.8 or greater.
GiveWP – Authenticated (Give Manager+) Path Traversal
Security Risk: High Exploitation Level: Requires Give Manager or higher level authentication. Vulnerability: Authenticated (Give Manager+) Path Traversal CVE: CVE-2026-111978 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.19.0.0 Patched Versions: 4.19.0.1
Mitigation steps: Update to GiveWP version 4.19.0.1 or greater.
Relevanssi – Authenticated (Editor+) PHP Object Injection
Security Risk: Medium Exploitation Level: Requires Editor or higher level authentication. Vulnerability: Authenticated (Editor+) PHP Object Injection CVE: CVE-2026-114704 Number of Installations: 100,000+ Affected Software: Relevanssi ≤ 4.28.4 Patched Versions: 4.28.5
Mitigation steps: Update to Relevanssi version 4.28.5 or greater.
Advanced File Manager – Authenticated (Custom Role+) Stored Cross-Site Scripting
Security Risk: High Exploitation Level: Requires Custom Role or higher level authentication. Vulnerability: Authenticated (Custom Role+) Stored Cross-Site Scripting CVE: CVE-2026-79627 Number of Installations: 100,000+ Affected Software: Advanced File Manager < 6.0.0 Patched Versions: 6.0.0
Mitigation steps: Update to Advanced File Manager version 6.0.0 or greater.
Advanced Custom Fields: Extended – Unauthenticated Arbitrary Shortcode Execution
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution CVE: CVE-2026-94263 Number of Installations: 100,000+ Affected Software: Advanced Custom Fields: Extended ≤ 0.9.2.7 Patched Versions: Advanced Custom Fields: Extended 0.9.2.8
Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.8 or greater.
Advanced Custom Fields: Extended – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-112312 Number of Installations: 100,000+ Affected Software: Advanced Custom Fields: Extended ≤ 0.9.2.7 Patched Versions: Advanced Custom Fields: Extended 0.9.2.8
Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.8 or greater.
Advanced Custom Fields: Extended – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-112313 Number of Installations: 100,000+ Affected Software: Advanced Custom Fields: Extended ≤ 0.9.2.7 Patched Versions: Advanced Custom Fields: Extended 0.9.2.8
Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.8 or greater.
TI WooCommerce Wishlist – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-15261 Number of Installations: 100,000+ Affected Software: TI WooCommerce Wishlist ≤ 2.12.0 Patched Versions: 2.12.1
Mitigation steps: Update to TI WooCommerce Wishlist version 2.12.1 or greater.
Appointment Booking Plugin – Unauthenticated Payment Bypass
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Payment Bypass CVE: CVE-2026-105256 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.4 Patched Versions: 5.7.5
Mitigation steps: Update to Appointment Booking Plugin version 5.7.5 or greater.
Appointment Booking Plugin – Authenticated (Agent+) Insecure Direct Object Reference
Security Risk: High Exploitation Level: Requires Agent or higher level authentication. Vulnerability: Authenticated (Agent+) Insecure Direct Object Reference CVE: CVE-2026-105257 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.4 Patched Versions: 5.7.5
Mitigation steps: Update to Appointment Booking Plugin version 5.7.5 or greater.
Tutor LMS – Authenticated (Subscriber+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting CVE: CVE-2026-111407 Number of Installations: 100,000+ Affected Software: Tutor LMS ≤ 4.1.2 Patched Versions: 4.1.3
Mitigation steps: Update to Tutor LMS version 4.1.3 or greater.
Appointment Booking Plugin – Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter CVE: CVE-2026-110653 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.4 Patched Versions: 5.7.5
Mitigation steps: Update to Appointment Booking Plugin version 5.7.5 or greater.
Tutor LMS – Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via ‘ID’ Parameter
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter CVE: CVE-2026-92715 Number of Installations: 100,000+ Affected Software: Tutor LMS ≤ 4.1.0 Patched Versions: 4.1.1
Mitigation steps: Update to Tutor LMS version 4.1.1 or greater.
Appointment Booking Plugin – Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in ‘customer[uuid]’ Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter CVE: CVE-2026-111602 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.4 Patched Versions: 5.7.5
Mitigation steps: Update to Appointment Booking Plugin version 5.7.5 or greater.
Schema & Structured Data for WP & AMP – Unauthenticated Stored Cross-Site Scripting via ‘saswp_review_text’ Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter CVE: CVE-2026-96570 Number of Installations: 100,000+ Affected Software: Schema & Structured Data for WP & AMP ≤ 1.67 Patched Versions: 1.68
Mitigation steps: Update to Schema & Structured Data for WP & AMP version 1.68 or greater.
Tutor LMS – Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter CVE: CVE-2026-93681 Number of Installations: 100,000+ Affected Software: Tutor LMS ≤ 4.1.0 Patched Versions: 4.1.1
Mitigation steps: Update to Tutor LMS version 4.1.1 or greater.
FiboSearch – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘purchased_plan’ Parameter
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter CVE: CVE-2026-100106 Number of Installations: 100,000+ Affected Software: FiboSearch ≤ 1.34.2 Patched Versions: 1.34.3
Mitigation steps: Update to FiboSearch version 1.34.3 or greater.
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile ‘Comments’ Tab
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab CVE: CVE-2026-104003 Number of Installations: 100,000+ Affected Software: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content ≤ 4.17.5 Patched Versions: 4.17.6
Mitigation steps: Update to Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content version 4.17.6 or greater.
Hide My WP Ghost – Unauthenticated Stored Cross-Site Scripting via Comment Content
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content CVE: CVE-2026-89051 Number of Installations: 100,000+ Affected Software: Hide My WP Ghost ≤ 7.0.12 Patched Versions: 7.0.13
Mitigation steps: Update to Hide My WP Ghost version 7.0.13 or greater.
SiteOrigin CSS – Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector CVE: CVE-2026-111122 Number of Installations: 100,000+ Affected Software: SiteOrigin CSS ≤ 1.6.7 Patched Versions: 1.6.8
Mitigation steps: Update to SiteOrigin CSS version 1.6.8 or greater.
SiteOrigin CSS – Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink CVE: CVE-2026-107764 Number of Installations: 100,000+ Affected Software: SiteOrigin CSS ≤ 1.6.7 Patched Versions: 1.6.8
Mitigation steps: Update to SiteOrigin CSS version 1.6.8 or greater.
Search Regex – Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption CVE: CVE-2026-104932 Number of Installations: 100,000+ Affected Software: Search Regex <= 3.5 Patched Versions: Search Regex 3.5.1
Mitigation steps: Update to Search Regex version 3.5.1 or greater.
Modula Image Gallery – Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed ‘modulaSettings’ REST field on the modula-gallery CPT
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT CVE: CVE-2026-107659 Number of Installations: 100,000+ Affected Software: Modula Image Gallery ≤ 3.0.11 Patched Versions: 3.0.12
Mitigation steps: Update to Modula Image Gallery version 3.0.12 or greater.
Tutor LMS – Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via ‘redirect_url’ Parameter
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter CVE: CVE-2026-88963 Number of Installations: 100,000+ Affected Software: Tutor LMS ≤ 4.0.8 Patched Versions: 4.0.9
Mitigation steps: Update to Tutor LMS version 4.0.9 or greater.
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-105261 Number of Installations: 100,000+ Affected Software: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories 4.10.1 - 4.10.5 Patched Versions: 4.10.6
Mitigation steps: Update to Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories version 4.10.6 or greater.
WP 2FA – Authenticated (Administrator+) Insecure Direct Object Reference
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Administrator+) Insecure Direct Object Reference CVE: CVE-2026-108066 Number of Installations: 100,000+ Affected Software: WP 2FA < 4.2.0 Patched Versions: 4.2.0
Mitigation steps: Update to WP 2FA version 4.2.0 or greater.
Photo Gallery by 10Web – Reflected Cross-Site Scripting via ‘title’ Parameter
Security Risk: Low Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Reflected Cross-Site Scripting via 'title' Parameter CVE: CVE-2026-18557 Number of Installations: 100,000+ Affected Software: Photo Gallery by 10Web ≤ 1.8.42 Patched Versions: 1.8.43
Mitigation steps: Update to Photo Gallery by 10Web version 1.8.43 or greater.
VK Blocks – Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block ‘linkToPost’ Feature
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature CVE: CVE-2026-78087 Number of Installations: 100,000+ Affected Software: VK Blocks ≤ 1.126.1 Patched Versions: 1.126.2
Mitigation steps: Update to VK Blocks version 1.126.2 or greater.
Appointment Booking Plugin – Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback CVE: CVE-2026-100163 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.2 Patched Versions: 5.7.3
Mitigation steps: Update to Appointment Booking Plugin version 5.7.3 or greater.
Appointment Booking Plugin – Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via ‘booking[id]’ and ‘cart[id]’ Parameters
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters CVE: CVE-2026-103366 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.3 Patched Versions: 5.7.4
Mitigation steps: Update to Appointment Booking Plugin version 5.7.4 or greater.
Tutor LMS – Reflected Cross-Site Scripting via ‘tab’ Parameter
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via 'tab' Parameter CVE: CVE-2026-100193 Number of Installations: 100,000+ Affected Software: Tutor LMS ≤ 4.1.0 Patched Versions: 4.1.1
Mitigation steps: Update to Tutor LMS version 4.1.1 or greater.
Appointment Booking Plugin – Authenticated (Subscriber+) Sensitive Information Exposure in ‘first_name’ Parameter Template Re-expansion
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion CVE: CVE-2026-103380 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.3 Patched Versions: 5.7.4
Mitigation steps: Update to Appointment Booking Plugin version 5.7.4 or greater.
Prime Slider – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-109691 Number of Installations: 100,000+ Affected Software: Prime Slider ≤ 4.7.1 Patched Versions: 4.7.2
Mitigation steps: Update to Prime Slider version 4.7.2 or greater.
Element Pack Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-108478 Number of Installations: 100,000+ Affected Software: Element Pack Addons for Elementor ≤ 8.8.8 Patched Versions: 8.8.9
Mitigation steps: Update to Element Pack Addons for Elementor version 8.8.9 or greater.
Appointment Booking Plugin – Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via ‘params[presets][order_item_id]’ Parameter
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter CVE: CVE-2026-91050 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.2 Patched Versions: 5.7.3
Mitigation steps: Update to Appointment Booking Plugin version 5.7.3 or greater.
Appointment Booking Plugin – Unauthenticated SQL Injection via ‘booking[service_id]’ Parameter
Security Risk: Critical Exploitation Level: No authentication required. Vulnerability: Unauthenticated SQL Injection via 'booking[service_id]' Parameter CVE: CVE-2026-96662 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.2 Patched Versions: 5.7.3
Mitigation steps: Update to Appointment Booking Plugin version 5.7.3 or greater.
Appointment Booking Plugin – Authenticated (Custom+) Privilege Escalation to ‘settings[default_wp_role_for_customer]’ Parameter
Security Risk: Low Exploitation Level: Requires Custom or higher level authentication. Vulnerability: Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter CVE: CVE-2026-104766 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.3 Patched Versions: 5.7.4
Mitigation steps: Update to Appointment Booking Plugin version 5.7.4 or greater.
Download Manager – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘regurl’ Shortcode Attribute
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute CVE: CVE-2026-102401 Number of Installations: 100,000+ Affected Software: Download Manager ≤ 3.3.71 Patched Versions: 3.3.72
Mitigation steps: Update to Download Manager version 3.3.72 or greater.
Payment Plugins for Stripe WooCommerce – Reflected DOM-Based Cross-Site Scripting via ‘#response’ URL Fragment
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment CVE: CVE-2026-89100 Number of Installations: 100,000+ Affected Software: Payment Plugins for Stripe WooCommerce ≤ 4.0.17 Patched Versions: 4.0.18
Mitigation steps: Update to Payment Plugins for Stripe WooCommerce version 4.0.18 or greater.
Responsive Lightbox & Gallery – Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content ‘title’ Attribute
Security Risk: Medium Exploitation Level: Requires Editor or higher level authentication. Vulnerability: Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute CVE: CVE-2026-103897 Number of Installations: 100,000+ Affected Software: Responsive Lightbox & Gallery ≤ 2.7.9 Patched Versions: 2.7.10
Mitigation steps: Update to Responsive Lightbox & Gallery version 2.7.10 or greater.
Download Manager – Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in ‘first_name’ Profile Field Token Injection into Suspension Email
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email CVE: CVE-2026-103964 Number of Installations: 100,000+ Affected Software: Download Manager ≤ 3.3.71 Patched Versions: 3.3.72
Mitigation steps: Update to Download Manager version 3.3.72 or greater.
LazyLoad Plugin – Unauthenticated Stored Cross-Site Scripting via Comment Content
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content CVE: CVE-2026-100196 Number of Installations: 100,000+ Affected Software: LazyLoad Plugin ≤ 2.4.0 Patched Versions: 2.4.1
Mitigation steps: Update to LazyLoad Plugin version 2.4.1 or greater.
Presto Player – Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag CVE: CVE-2026-96682 Number of Installations: 100,000+ Affected Software: Presto Player ≤ 4.5.1 Patched Versions: 4.5.2
Mitigation steps: Update to Presto Player version 4.5.2 or greater.
GiveWP – Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes CVE: CVE-2026-97643 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.17.0 Patched Versions: 4.17.1
Mitigation steps: Update to GiveWP version 4.17.1 or greater.
Download Manager – Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode CVE: CVE-2026-9696 Number of Installations: 100,000+ Affected Software: Download Manager ≤ 3.3.58 Patched Versions: 3.3.59
Mitigation steps: Update to Download Manager version 3.3.59 or greater.
Download Manager – Unauthenticated DOM-Based Reflected Cross-Site Scripting via ‘REFERRER’ Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter CVE: CVE-2026-12054 Number of Installations: 100,000+ Affected Software: Download Manager ≤ 3.3.57 Patched Versions: 3.3.58
Mitigation steps: Update to Download Manager version 3.3.58 or greater.
Envira Gallery – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-104682 Number of Installations: 100,000+ Affected Software: Envira Gallery ≤ 1.16.1 Patched Versions: 1.16.2
Mitigation steps: Update to Envira Gallery version 1.16.2 or greater.
Envira Gallery – Authenticated (Author+) Insecure Direct Object Reference
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Authenticated (Author+) Insecure Direct Object Reference CVE: CVE-2026-104684 Number of Installations: 100,000+ Affected Software: Envira Gallery ≤ 1.16.1 Patched Versions: 1.16.2
Mitigation steps: Update to Envira Gallery version 1.16.2 or greater.
DTX – Unauthenticated Information Exposure
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-62043 Number of Installations: 100,000+ Affected Software: DTX ≤ 5.0.7 Patched Versions: 5.0.8
Mitigation steps: Update to DTX version 5.0.8 or greater.
Envira Gallery – Authenticated (Author+) Information Exposure
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Authenticated (Author+) Information Exposure CVE: CVE-2026-104681 Number of Installations: 100,000+ Affected Software: Envira Gallery ≤ 1.16.1 Patched Versions: 1.16.2
Mitigation steps: Update to Envira Gallery version 1.16.2 or greater.
Envira Gallery – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-104079 Number of Installations: 100,000+ Affected Software: Envira Gallery ≤ 1.16.1 Patched Versions: 1.16.2
Mitigation steps: Update to Envira Gallery version 1.16.2 or greater.
Envira Gallery – Authenticated (Admin+) Arbitrary Plugin Installation
Security Risk: Low Exploitation Level: Requires Administrator or higher level authentication. Vulnerability: Authenticated (Admin+) Arbitrary Plugin Installation CVE: CVE-2026-104680 Number of Installations: 100,000+ Affected Software: Envira Gallery ≤ 1.16.1 Patched Versions: 1.16.2
Mitigation steps: Update to Envira Gallery version 1.16.2 or greater.
Appointment Booking Plugin – Authenticated (Custom Role+) Insecure Direct Object Reference
Security Risk: High Exploitation Level: Requires Custom Role or higher level authentication. Vulnerability: Authenticated (Custom Role+) Insecure Direct Object Reference CVE: CVE-2026-105197 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin < 5.6.5 Patched Versions: 5.6.5
Mitigation steps: Update to Appointment Booking Plugin version 5.6.5 or greater.
Appointment Booking Plugin – Authenticated (Custom Role+) Insecure Direct Object Reference
Security Risk: High Exploitation Level: Requires Custom Role or higher level authentication. Vulnerability: Authenticated (Custom Role+) Insecure Direct Object Reference CVE: CVE-2026-105196 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin < 5.6.9 Patched Versions: 5.6.9
Mitigation steps: Update to Appointment Booking Plugin version 5.6.9 or greater.
GiveWP – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-106600 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.18.0 Patched Versions: 4.18.1
Mitigation steps: Update to GiveWP version 4.18.1 or greater.
Appointment Booking Plugin – Unauthenticated Insecure Direct Object Reference
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Insecure Direct Object Reference CVE: CVE-2026-105198 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin < 5.7.3 Patched Versions: 5.7.3
Mitigation steps: Update to Appointment Booking Plugin version 5.7.3 or greater.
WPML Multilingual & Multicurrency for WooCommerce – Authenticated (Shop Manager+) PHP Object Injection
Security Risk: High Exploitation Level: Requires Shop Manager or higher level authentication. Vulnerability: Authenticated (Shop Manager+) PHP Object Injection CVE: CVE-2026-62130 Number of Installations: 100,000+ Affected Software: WPML Multilingual & Multicurrency for WooCommerce ≤ 5.5.8 Patched Versions: 5.5.9
Mitigation steps: Update to WPML Multilingual & Multicurrency for WooCommerce version 5.5.9 or greater.
Tutor LMS – Authenticated (Subscriber+) Race Condition
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Race Condition CVE: CVE-2026-42698 Number of Installations: 100,000+ Affected Software: Tutor LMS ≤ 4.1.2 Patched Versions: 4.1.3
Mitigation steps: Update to Tutor LMS version 4.1.3 or greater.
Tutor LMS – Authenticated (Instructor+) Insecure Direct Object Reference
Security Risk: High Exploitation Level: Requires Instructor or higher level authentication. Vulnerability: Authenticated (Instructor+) Insecure Direct Object Reference CVE: CVE-2026-85571 Number of Installations: 100,000+ Affected Software: Tutor LMS 4.0.5 - 4.1.0 Patched Versions: 4.1.1
Mitigation steps: Update to Tutor LMS version 4.1.1 or greater.
Appointment Booking Plugin – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification CVE: CVE-2026-17538 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.6.9 Patched Versions: 5.6.10
Mitigation steps: Update to Appointment Booking Plugin version 5.6.10 or greater.
Prime Slider – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-105875 Number of Installations: 100,000+ Affected Software: Prime Slider ≤ 4.6.2 Patched Versions: 4.6.3
Mitigation steps: Update to Prime Slider version 4.6.3 or greater.
Modula Image Gallery – Unauthenticated Information Exposure
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-105876 Number of Installations: 100,000+ Affected Software: Modula Image Gallery ≤ 3.0.11 Patched Versions: 3.0.12
Mitigation steps: Update to Modula Image Gallery version 3.0.12 or greater.
Element Pack Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-105871 Number of Installations: 100,000+ Affected Software: Element Pack Addons for Elementor ≤ 8.8.6 Patched Versions: 8.8.7
Mitigation steps: Update to Element Pack Addons for Elementor version 8.8.7 or greater.
LazyLoad Plugin – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-105884 Number of Installations: 100,000+ Affected Software: LazyLoad Plugin ≤ 2.4.0 Patched Versions: 2.4.1
Mitigation steps: Update to LazyLoad Plugin version 2.4.1 or greater.
Photo Gallery by 10Web – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-42715 Number of Installations: 100,000+ Affected Software: Photo Gallery by 10Web ≤ 1.8.47 Patched Versions: 1.8.48
Mitigation steps: Update to Photo Gallery by 10Web version 1.8.48 or greater.
Tutor LMS – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-42702 Number of Installations: 100,000+ Affected Software: Tutor LMS ≤ 4.1.0 Patched Versions: 4.1.1
Mitigation steps: Update to Tutor LMS version 4.1.1 or greater.
Envira Gallery – Authenticated (Author+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting CVE: CVE-2026-104653 Number of Installations: 100,000+ Affected Software: Envira Gallery ≤ 1.16.0 Patched Versions: 1.16.1
Mitigation steps: Update to Envira Gallery version 1.16.1 or greater.
Presto Player – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-102914 Number of Installations: 100,000+ Affected Software: Presto Player ≤ 4.5.2 Patched Versions: 4.5.3
Mitigation steps: Update to Presto Player version 4.5.3 or greater.
GiveWP – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-104404 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.17.0 Patched Versions: 4.17.1
Mitigation steps: Update to GiveWP version 4.17.1 or greater.
GiveWP – Unauthenticated Privilege Escalation
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Privilege Escalation CVE: CVE-2026-104405 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.17.0 Patched Versions: 4.17.1
Mitigation steps: Update to GiveWP version 4.17.1 or greater.
GiveWP – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-104672 Number of Installations: 100,000+ Affected Software: GiveWP ≤ 4.17.0 Patched Versions: 4.17.1
Mitigation steps: Update to GiveWP version 4.17.1 or greater.
String locator – Unauthenticated PHP Object Injection
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated PHP Object Injection CVE: CVE-2026-97188 Number of Installations: 100,000+ Affected Software: String locator ≤ 2.6.7 Patched Versions: 2.6.8
Mitigation steps: Update to String locator version 2.6.8 or greater.
Login Lockdown & Protection – Unauthenticated Login Lockout Protection Bypass
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Login Lockout Protection Bypass CVE: CVE-2026-97308 Number of Installations: 100,000+ Affected Software: Login Lockdown & Protection ≤ 2.17 Patched Versions: 2.18
Mitigation steps: Update to Login Lockdown & Protection version 2.18 or greater.
Social Sharing Plugin – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-94170 Number of Installations: 100,000+ Affected Software: Social Sharing Plugin ≤ 3.3.79 Patched Versions: 3.3.80
Mitigation steps: Update to Social Sharing Plugin version 3.3.80 or greater.
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields CVE: CVE-2026-92536 Number of Installations: 100,000+ Affected Software: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content ≤ 4.17.4 Patched Versions: 4.17.5
Mitigation steps: Update to Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content version 4.17.5 or greater.
Beaver Builder Page Builder – Authenticated (Contributor+) SQL Injection via ‘fields[][value]’ Parameter
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter CVE: CVE-2026-95865 Number of Installations: 100,000+ Affected Software: Beaver Builder Page Builder ≤ 2.11.0.5 Patched Versions: 2.11.0.6
Mitigation steps: Update to Beaver Builder Page Builder version 2.11.0.6 or greater.
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter CVE: CVE-2026-92551 Number of Installations: 100,000+ Affected Software: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content ≤ 4.17.4 Patched Versions: 4.17.5
Mitigation steps: Update to Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content version 4.17.5 or greater.
Real Cookie Banner: GDPR & ePrivacy Cookie Consent – Unauthenticated Stored Cross-Site Scripting via Comment
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment CVE: CVE-2026-92977 Number of Installations: 100,000+ Affected Software: Real Cookie Banner: GDPR & ePrivacy Cookie Consent ≤ 5.3.5 Patched Versions: 5.3.6
Mitigation steps: Update to Real Cookie Banner: GDPR & ePrivacy Cookie Consent version 5.3.6 or greater.
EmbedPress – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘slidesShow’ Block Attribute
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute CVE: CVE-2026-92727 Number of Installations: 100,000+ Affected Software: EmbedPress ≤ 4.6.6 Patched Versions: 4.6.7
Mitigation steps: Update to EmbedPress version 4.6.7 or greater.
Photo Gallery by 10Web – Reflected Cross-Site Scripting via ‘thumb_url’ Parameter
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via 'thumb_url' Parameter CVE: CVE-2026-92974 Number of Installations: 100,000+ Affected Software: Photo Gallery by 10Web ≤ 1.8.46 Patched Versions: 1.8.47
Mitigation steps: Update to Photo Gallery by 10Web version 1.8.47 or greater.
Rich Showcase for Google Reviews – Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API) CVE: CVE-2026-100148 Number of Installations: 100,000+ Affected Software: Rich Showcase for Google Reviews ≤ 7.1.3 Patched Versions: 7.1.4
Mitigation steps: Update to Rich Showcase for Google Reviews version 7.1.4 or greater.
Beaver Builder Page Builder – Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output CVE: CVE-2026-92084 Number of Installations: 100,000+ Affected Software: Beaver Builder Page Builder ≤ 2.11.0.5 Patched Versions: 2.11.0.6
Mitigation steps: Update to Beaver Builder Page Builder version 2.11.0.6 or greater.
Download Manager – Unauthenticated Information Exposure
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-94405 Number of Installations: 100,000+ Affected Software: Download Manager ≤ 3.3.70 Patched Versions: 3.3.71
Mitigation steps: Update to Download Manager version 3.3.71 or greater.
Advanced Ads – Ad Manager & AdSense – Authenticated (Subscriber+) Information Exposure
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Information Exposure CVE: CVE-2026-94180 Number of Installations: 100,000+ Affected Software: Advanced Ads – Ad Manager & AdSense ≤ 2.0.26 Patched Versions: 2.0.27
Mitigation steps: Update to Advanced Ads – Ad Manager & AdSense version 2.0.27 or greater.
Disable and Remove Google Fonts – Reflected Cross-Site Scripting
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-95595 Number of Installations: 100,000+ Affected Software: Disable and Remove Google Fonts ≤ 2.0.2 Patched Versions: 2.0.3
Mitigation steps: Update to Disable and Remove Google Fonts version 2.0.3 or greater.
Relevanssi – Unauthenticated Stored Cross-Site Scripting via Comment Content
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content CVE: CVE-2026-97641 Number of Installations: 100,000+ Affected Software: Relevanssi ≤ 4.28.3 Patched Versions: 4.28.4
Mitigation steps: Update to Relevanssi version 4.28.4 or greater.
Download Manager – Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name CVE: CVE-2026-97338 Number of Installations: 100,000+ Affected Software: Download Manager ≤ 3.3.70 Patched Versions: 3.3.71
Mitigation steps: Update to Download Manager version 3.3.71 or greater.
Appointment Booking Plugin – Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via ‘invoice_id’ Parameter
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter CVE: CVE-2026-94432 Number of Installations: 100,000+ Affected Software: Appointment Booking Plugin ≤ 5.7.1 Patched Versions: 5.7.2
Mitigation steps: Update to Appointment Booking Plugin version 5.7.2 or greater.
AI Engine – Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration CVE: CVE-2026-110732 Number of Installations: 90,000+ Affected Software: AI Engine ≤ 3.8.6 Patched Versions: 3.8.7
Mitigation steps: Update to AI Engine version 3.8.7 or greater.
Everest Forms – Reflected Cross-Site Scripting via ‘evf_toast_type’ Parameter
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via 'evf_toast_type' Parameter CVE: CVE-2026-91152 Number of Installations: 90,000+ Affected Software: Everest Forms ≤ 3.6.2 Patched Versions: 3.6.3
Mitigation steps: Update to Everest Forms version 3.6.3 or greater.
Everest Forms – Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=…})
Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
CVE: CVE-2026-91153
Number of Installations: 90,000+
Affected Software: Everest Forms ≤ 3.6.2
Patched Versions: 3.6.3Mitigation steps: Update to Everest Forms version 3.6.3 or greater.
AI Engine – Authenticated (Subscriber+) Limited Media File Deletion via ‘metadata’ Parameter
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter CVE: CVE-2026-107745 Number of Installations: 90,000+ Affected Software: AI Engine ≤ 3.8.4 Patched Versions: 3.8.5
Mitigation steps: Update to AI Engine version 3.8.5 or greater.
AI Engine – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-112828 Number of Installations: 90,000+ Affected Software: AI Engine ≤ 3.8.6 Patched Versions: 3.8.7
Mitigation steps: Update to AI Engine version 3.8.7 or greater.
Booking for Appointments and Events Calendar – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-116396 Number of Installations: 90,000+ Affected Software: Booking for Appointments and Events Calendar ≤ 2.4.12 Patched Versions: 2.4.13
Mitigation steps: Update to Booking for Appointments and Events Calendar version 2.4.13 or greater.
Booking for Appointments and Events Calendar – Unauthenticated SQL Injection
Security Risk: Critical Exploitation Level: No authentication required. Vulnerability: Unauthenticated SQL Injection CVE: CVE-2026-112327 Number of Installations: 90,000+ Affected Software: Booking for Appointments and Events Calendar ≤ 2.4.11 Patched Versions: 2.4.12
Mitigation steps: Update to Booking for Appointments and Events Calendar version 2.4.12 or greater.
Event Tickets and Registration – Authenticated (Contributor+) Insecure Direct Object Reference
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Insecure Direct Object Reference CVE: CVE-2026-110902 Number of Installations: 90,000+ Affected Software: Event Tickets and Registration ≤ 5.30.1 Patched Versions: 5.30.2
Mitigation steps: Update to Event Tickets and Registration version 5.30.2 or greater.
AI Engine – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Editor or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-110982 Number of Installations: 90,000+ Affected Software: AI Engine ≤ 3.8.5 Patched Versions: 3.8.6
Mitigation steps: Update to AI Engine version 3.8.6 or greater.
Tracking Code Manager – Reflected Cross-Site Scripting via ‘TCM_ErrorMessages’
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via 'TCM_ErrorMessages' CVE: CVE-2026-15180 Number of Installations: 90,000+ Affected Software: Tracking Code Manager ≤ 2.6.0 Patched Versions: 2.6.1
Mitigation steps: Update to Tracking Code Manager version 2.6.1 or greater.
Event Tickets and Registration – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-105891 Number of Installations: 90,000+ Affected Software: Event Tickets and Registration ≤ 5.30.0.1 Patched Versions: 5.30.0.2
Mitigation steps: Update to Event Tickets and Registration version 5.30.0.2 or greater.
Event Tickets and Registration – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-104675 Number of Installations: 90,000+ Affected Software: Event Tickets and Registration ≤ 5.30.0 Patched Versions: 5.30.1
Mitigation steps: Update to Event Tickets and Registration version 5.30.1 or greater.
Ivory Search – Reflected DOM-Based Cross-Site Scripting via ‘s’ Parameter
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected DOM-Based Cross-Site Scripting via 's' Parameter CVE: CVE-2026-92243 Number of Installations: 90,000+ Affected Software: Ivory Search ≤ 5.5.18 Patched Versions: 5.5.19
Mitigation steps: Update to Ivory Search version 5.5.19 or greater.
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons – Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`… CVE: CVE-2026-100149 Number of Installations: 90,000+ Affected Software: WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons ≤ 4.7.3 Patched Versions: 4.7.4
Mitigation steps: Update to WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons version 4.7.4 or greater.
WPC Smart Quick View for WooCommerce – Reflected Cross-Site Scripting via ‘woosq-redirect’ Parameter
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via 'woosq-redirect' Parameter CVE: CVE-2026-103888 Number of Installations: 90,000+ Affected Software: WPC Smart Quick View for WooCommerce ≤ 4.4.0 Patched Versions: 4.4.1
Mitigation steps: Update to WPC Smart Quick View for WooCommerce version 4.4.1 or greater.
Everest Forms – Reflected Cross-Site Scripting
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-94670 Number of Installations: 90,000+ Affected Software: Everest Forms ≤ 3.6.1 Patched Versions: 3.6.2
Mitigation steps: Update to Everest Forms version 3.6.2 or greater.
Event Tickets and Registration – Authenticated (Contributor+) SQL Injection via ‘orderby’ Parameter
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) SQL Injection via 'orderby' Parameter CVE: CVE-2026-97634 Number of Installations: 90,000+ Affected Software: Event Tickets and Registration ≤ 5.29.5 Patched Versions: 5.29.6
Mitigation steps: Update to Event Tickets and Registration version 5.29.6 or greater.
Hustle – Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
Security Risk: Low Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title CVE: CVE-2026-107710 Number of Installations: 80,000+ Affected Software: Hustle ≤ 7.8.14.3 Patched Versions: 7.8.14.4
Mitigation steps: Update to Hustle version 7.8.14.4 or greater.
Hustle – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘cta_label’ Parameter
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter CVE: CVE-2026-118169 Number of Installations: 80,000+ Affected Software: Hustle ≤ 7.8.14.3 Patched Versions: 7.8.14.4
Mitigation steps: Update to Hustle version 7.8.14.4 or greater.
Download Monitor – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-112219 Number of Installations: 80,000+ Affected Software: Download Monitor < 5.3.5 Patched Versions: 5.3.5
Mitigation steps: Update to Download Monitor version 5.3.5 or greater.
Depicter – Authenticated (Editor+) Arbitrary File Upload
Security Risk: Medium Exploitation Level: Requires Editor or higher level authentication. Vulnerability: Authenticated (Editor+) Arbitrary File Upload CVE: CVE-2026-113472 Number of Installations: 80,000+ Affected Software: Depicter 4.0.5 - 4.8.1 Patched Versions: 4.8.2
Mitigation steps: Update to Depicter version 4.8.2 or greater.
Addon Elements for Elementor (formerly Elementor Addon Elements) – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-114184 Number of Installations: 80,000+ Affected Software: Addon Elements for Elementor (formerly Elementor Addon Elements) ≤ 1.14.4 Patched Versions: 1.14.5
Mitigation steps: Update to Addon Elements for Elementor (formerly Elementor Addon Elements) version 1.14.5 or greater.
Strong Testimonials – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-112843 Number of Installations: 80,000+ Affected Software: Strong Testimonials ≤ 3.3.14 Patched Versions: 3.3.15
Mitigation steps: Update to Strong Testimonials version 3.3.15 or greater.
Download Monitor – Reflected Cross-Site Scripting
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-112207 Number of Installations: 80,000+ Affected Software: Download Monitor ≤ 5.3.3 Patched Versions: 5.3.4
Mitigation steps: Update to Download Monitor version 5.3.4 or greater.
Social Feed Gallery – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-114705 Number of Installations: 80,000+ Affected Software: Social Feed Gallery ≤ 5.0.13 Patched Versions: 5.0.14
Mitigation steps: Update to Social Feed Gallery version 5.0.14 or greater.
SureCart – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-112840 Number of Installations: 80,000+ Affected Software: SureCart ≤ 4.9.5 Patched Versions: 4.9.6
Mitigation steps: Update to SureCart version 4.9.6 or greater.
SureCart – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-112221 Number of Installations: 80,000+ Affected Software: SureCart ≤ 4.9.5 Patched Versions: 4.9.6
Mitigation steps: Update to SureCart version 4.9.6 or greater.
Strong Testimonials – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-107435 Number of Installations: 80,000+ Affected Software: Strong Testimonials ≤ 3.3.12 Patched Versions: 3.3.13
Mitigation steps: Update to Strong Testimonials version 3.3.13 or greater.
SureCart – Unauthenticated Information Exposure
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-108073 Number of Installations: 80,000+ Affected Software: SureCart ≤ 4.9.4 Patched Versions: 4.9.5
Mitigation steps: Update to SureCart version 4.9.5 or greater.
HUSKY – Unauthenticated Sensitive Information Exposure in ‘woof_tm_data’ Localized Script
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script CVE: CVE-2026-107646 Number of Installations: 80,000+ Affected Software: HUSKY ≤ 1.4.5 Patched Versions: 1.4.6
Mitigation steps: Update to HUSKY version 1.4.6 or greater.
SureCart – Unauthenticated Stored Cross-Site Scripting via sc-cart-loader ‘template’ Attribute in Comment
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment CVE: CVE-2026-109224 Number of Installations: 80,000+ Affected Software: SureCart ≤ 4.9.4 Patched Versions: 4.9.5
Mitigation steps: Update to SureCart version 4.9.5 or greater.
Colibri Page Builder – Unauthenticated Stored Cross-Site Scripting via Comments
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comments CVE: CVE-2026-107758 Number of Installations: 80,000+ Affected Software: Colibri Page Builder ≤ 1.0.390 Patched Versions: 1.0.391
Mitigation steps: Update to Colibri Page Builder version 1.0.391 or greater.
Checkout Field Manager (Checkout Manager) for WooCommerce – Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID CVE: CVE-2026-17031 Number of Installations: 80,000+ Affected Software: Checkout Field Manager (Checkout Manager) for WooCommerce ≤ 7.9.6 Patched Versions: 7.9.7
Mitigation steps: Update to Checkout Field Manager (Checkout Manager) for WooCommerce version 7.9.7 or greater.
SureCart – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-109697 Number of Installations: 80,000+ Affected Software: SureCart ≤ 4.9.4 Patched Versions: 4.9.5
Mitigation steps: Update to SureCart version 4.9.5 or greater.
SureCart – Authenticated (Custom Role+) PHP Object Injection
Security Risk: Medium Exploitation Level: Requires Custom Role or higher level authentication. Vulnerability: Authenticated (Custom Role+) PHP Object Injection CVE: CVE-2026-106599 Number of Installations: 80,000+ Affected Software: SureCart ≤ 4.9.3 Patched Versions: 4.9.4
Mitigation steps: Update to SureCart version 4.9.4 or greater.
JetFormBuilder – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-107431 Number of Installations: 80,000+ Affected Software: JetFormBuilder ≤ 3.6.6 Patched Versions: 3.6.7
Mitigation steps: Update to JetFormBuilder version 3.6.7 or greater.
SureCart – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-105874 Number of Installations: 80,000+ Affected Software: SureCart ≤ 4.9.3 Patched Versions: 4.9.4
Mitigation steps: Update to SureCart version 4.9.4 or greater.
JetFormBuilder – Reflected DOM-Based Cross-Site Scripting via ‘query_var’ Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer CVE: CVE-2026-103912 Number of Installations: 80,000+ Affected Software: JetFormBuilder ≤ 3.6.6 Patched Versions: 3.6.7
Mitigation steps: Update to JetFormBuilder version 3.6.7 or greater.
Hustle – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-103075 Number of Installations: 80,000+ Affected Software: Hustle ≤ 7.8.14.2 Patched Versions: 7.8.14.3
Mitigation steps: Update to Hustle version 7.8.14.3 or greater.
Kubio AI Page Builder – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-94167 Number of Installations: 80,000+ Affected Software: Kubio AI Page Builder ≤ 2.9.3 Patched Versions: 2.9.4
Mitigation steps: Update to Kubio AI Page Builder version 2.9.4 or greater.
Product Feed PRO for WooCommerce by AdTribes – Authenticated (Shop Manager+) PHP Object Injection
Security Risk: Low Exploitation Level: Requires Shop Manager or higher level authentication. Vulnerability: Authenticated (Shop Manager+) PHP Object Injection CVE: CVE-2026-103349 Number of Installations: 80,000+ Affected Software: Product Feed PRO for WooCommerce by AdTribes ≤ 13.5.7 Patched Versions: 13.5.8
Mitigation steps: Update to Product Feed PRO for WooCommerce by AdTribes version 13.5.8 or greater.
Wp Social Login and Register Social Counter – Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write CVE: CVE-2026-97344 Number of Installations: 80,000+ Affected Software: Wp Social Login and Register Social Counter ≤ 3.2.1 Patched Versions: 3.2.2
Mitigation steps: Update to Wp Social Login and Register Social Counter version 3.2.2 or greater.
Strong Testimonials – Unauthenticated Stored Cross-Site Scripting via ‘platform_user_photo’ Custom Field
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field CVE: CVE-2026-96650 Number of Installations: 80,000+ Affected Software: Strong Testimonials ≤ 3.3.11 Patched Versions: 3.3.12
Mitigation steps: Update to Strong Testimonials version 3.3.12 or greater.
Customer Reviews for WooCommerce – Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Author Name CVE: CVE-2026-97663 Number of Installations: 80,000+ Affected Software: Customer Reviews for WooCommerce ≤ 5.122.0 Patched Versions: 5.122.1
Mitigation steps: Update to Customer Reviews for WooCommerce version 5.122.1 or greater.
Download Monitor – Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor CVE: CVE-2026-100182 Number of Installations: 80,000+ Affected Software: Download Monitor ≤ 5.2.10 Patched Versions: 5.2.11
Mitigation steps: Update to Download Monitor version 5.2.11 or greater.
JetFormBuilder – Unauthenticated Stored Cross-Site Scripting via ‘choice’ Post Meta via Insert/Update Post Action
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action CVE: CVE-2026-97342 Number of Installations: 80,000+ Affected Software: JetFormBuilder ≤ 3.6.5.4 Patched Versions: 3.6.5.5
Mitigation steps: Update to JetFormBuilder version 3.6.5.5 or greater.
Kubio AI Page Builder – Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass) CVE: CVE-2026-100107 Number of Installations: 80,000+ Affected Software: Kubio AI Page Builder ≤ 2.9.2 Patched Versions: 2.9.3
Mitigation steps: Update to Kubio AI Page Builder version 2.9.3 or greater.
Germanized for WooCommerce – Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change CVE: CVE-2026-109231 Number of Installations: 70,000+ Affected Software: Germanized for WooCommerce ≤ 4.1.4 Patched Versions: 4.1.5
Mitigation steps: Update to Germanized for WooCommerce version 4.1.5 or greater.
Menu Cart for WooCommerce – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-105972 Number of Installations: 70,000+ Affected Software: Menu Cart for WooCommerce < 3.2.1 Patched Versions: 3.2.1
Mitigation steps: Update to Menu Cart for WooCommerce version 3.2.1 or greater.
Media Library Assistant – Reflected Cross-Site Scripting via ‘search-string’ Parameter via {+request:…+} in Pagination Links
Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
CVE: CVE-2026-103875
Number of Installations: 70,000+
Affected Software: Media Library Assistant ≤ 3.42
Patched Versions: 3.43Mitigation steps: Update to Media Library Assistant version 3.43 or greater.
Greenshift – Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText CVE: CVE-2026-107629 Number of Installations: 70,000+ Affected Software: Greenshift ≤ 13.2.1 Patched Versions: 13.2.2
Mitigation steps: Update to Greenshift version 13.2.2 or greater.
Greenshift – Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block CVE: CVE-2026-107627 Number of Installations: 70,000+ Affected Software: Greenshift ≤ 13.2.1 Patched Versions: 13.2.2
Mitigation steps: Update to Greenshift version 13.2.2 or greater.
Jupiter X Core – Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter CVE: CVE-2026-106013 Number of Installations: 70,000+ Affected Software: Jupiter X Core ≤ 4.61.0 Patched Versions: 4.61.1
Mitigation steps: Update to Jupiter X Core version 4.61.1 or greater.
AMP for WP – Unauthenticated Stored Cross-Site Scripting via ‘headline-*’ Shortcode Attribute
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute CVE: CVE-2026-97019 Number of Installations: 70,000+ Affected Software: AMP for WP ≤ 1.1.17 Patched Versions: 1.1.18
Mitigation steps: Update to AMP for WP version 1.1.18 or greater.
Jupiter X Core – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘forget_password_link’ Parameter
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter CVE: CVE-2026-10511 Number of Installations: 70,000+ Affected Software: Jupiter X Core ≤ 4.61.0 Patched Versions: 4.61.1
Mitigation steps: Update to Jupiter X Core version 4.61.1 or greater.
Media Library Assistant – Authenticated (Author+) SQL Injection
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Authenticated (Author+) SQL Injection CVE: CVE-2026-115948 Number of Installations: 70,000+ Affected Software: Media Library Assistant ≤ 3.42 Patched Versions: 3.43
Mitigation steps: Update to Media Library Assistant version 3.43 or greater.
LearnPress – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-115598 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.11 Patched Versions: 4.4.12
Mitigation steps: Update to LearnPress version 4.4.12 or greater.
Media Library Assistant – Authenticated (Contributor+) Information Exposure
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Information Exposure CVE: CVE-2026-115594 Number of Installations: 70,000+ Affected Software: Media Library Assistant ≤ 3.42 Patched Versions: 3.43
Mitigation steps: Update to Media Library Assistant version 3.43 or greater.
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-114182 Number of Installations: 70,000+ Affected Software: PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) ≤ 3.1.0 Patched Versions: 3.1.1
Mitigation steps: Update to PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) version 3.1.1 or greater.
LearnPress – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-110363 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.10 Patched Versions: 4.4.11
Mitigation steps: Update to LearnPress version 4.4.11 or greater.
Ajax Search Lite – Unauthenticated SQL Injection
Security Risk: Critical Exploitation Level: No authentication required. Vulnerability: Unauthenticated SQL Injection CVE: CVE-2026-111852 Number of Installations: 70,000+ Affected Software: Ajax Search Lite ≤ 4.14.6 Patched Versions: 4.14.7
Mitigation steps: Update to Ajax Search Lite version 4.14.7 or greater.
LearnPress – Unauthenticated PHP Object Injection via ‘checkout-email’ Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated PHP Object Injection via 'checkout-email' Parameter CVE: CVE-2026-104736 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.10 Patched Versions: 4.4.11
Mitigation steps: Update to LearnPress version 4.4.11 or greater.
LearnPress – Unauthenticated Stored Cross-Site Scripting via ‘quantity’ and ‘order_comments’ Parameters
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters CVE: CVE-2026-109208 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.10 Patched Versions: 4.4.11
Mitigation steps: Update to LearnPress version 4.4.11 or greater.
LearnPress – Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via ‘search-authors’ AJAX Action
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action CVE: CVE-2026-107744 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.10 Patched Versions: 4.4.11
Mitigation steps: Update to LearnPress version 4.4.11 or greater.
Slim SEO – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘Biographical Info’ User Meta
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta CVE: CVE-2026-104001 Number of Installations: 70,000+ Affected Software: Slim SEO ≤ 4.11.1 Patched Versions: 4.11.2
Mitigation steps: Update to Slim SEO version 4.11.2 or greater.
Import and export users and customers – Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
Security Risk: Low Exploitation Level: Requires Custom or higher level authentication. Vulnerability: Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields CVE: CVE-2026-17001 Number of Installations: 70,000+ Affected Software: Import and export users and customers ≤ 2.4.5 Patched Versions: 2.4.6
Mitigation steps: Update to Import and export users and customers version 2.4.6 or greater.
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-108488 Number of Installations: 70,000+ Affected Software: PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) ≤ 3.1.0 Patched Versions: 3.1.1
Mitigation steps: Update to PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) version 3.1.1 or greater.
Hello Plus – Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site CVE: CVE-2026-5727 Number of Installations: 70,000+ Affected Software: Hello Plus ≤ 1.7.7 Patched Versions: 1.7.8
Mitigation steps: Update to Hello Plus version 1.7.8 or greater.
Media Library Assistant – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-97294 Number of Installations: 70,000+ Affected Software: Media Library Assistant ≤ 3.41 Patched Versions: 3.42
Mitigation steps: Update to Media Library Assistant version 3.42 or greater.
LearnPress – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-104670 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.9 Patched Versions: 4.4.10
Mitigation steps: Update to LearnPress version 4.4.10 or greater.
Import and export users and customers – Authenticated (Editor+) Privilege Escalation
Security Risk: Medium Exploitation Level: Requires Editor or higher level authentication. Vulnerability: Authenticated (Editor+) Privilege Escalation CVE: CVE-2026-104757 Number of Installations: 70,000+ Affected Software: Import and export users and customers ≤ 2.5.5 Patched Versions: 2.5.6
Mitigation steps: Update to Import and export users and customers version 2.5.6 or greater.
LearnPress – Authenticated (Instructor+) Stored Cross-Site Scripting
Security Risk: Low Exploitation Level: Requires Instructor or higher level authentication. Vulnerability: Authenticated (Instructor+) Stored Cross-Site Scripting CVE: CVE-2026-105397 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.9.1 Patched Versions: 4.4.9.2
Mitigation steps: Update to LearnPress version 4.4.9.2 or greater.
Media Library Assistant – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-95609 Number of Installations: 70,000+ Affected Software: Media Library Assistant ≤ 3.41 Patched Versions: 3.42
Mitigation steps: Update to Media Library Assistant version 3.42 or greater.
LearnPress – Reflected DOM-Based Cross-Site Scripting via ‘orderby’ Parameter
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter CVE: CVE-2026-92538 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.7 Patched Versions: 4.4.8
Mitigation steps: Update to LearnPress version 4.4.8 or greater.
LearnPress – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-39717 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.9.1 Patched Versions: 4.4.9.2
Mitigation steps: Update to LearnPress version 4.4.9.2 or greater.
LearnPress – Unauthenticated Insecure Direct Object Reference
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Insecure Direct Object Reference CVE: CVE-2026-104403 Number of Installations: 70,000+ Affected Software: LearnPress ≤ 4.4.9 Patched Versions: 4.4.10
Mitigation steps: Update to LearnPress version 4.4.10 or greater.
Greenshift – Reflected Cross-Site Scripting via ‘{{GET:}}’ Dynamic Placeholder
Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
CVE: CVE-2026-93880
Number of Installations: 70,000+
Affected Software: Greenshift ≤ 13.2.0
Patched Versions: 13.2.1Mitigation steps: Update to Greenshift version 13.2.1 or greater.
HT Mega Addons for Elementor – Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink CVE: CVE-2026-111318 Number of Installations: 60,000+ Affected Software: HT Mega Addons for Elementor ≤ 3.2.7 Patched Versions: 3.2.8
Mitigation steps: Update to HT Mega Addons for Elementor version 3.2.8 or greater.
Events Manager – Reflected Cross-Site Scripting
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-114694 Number of Installations: 60,000+ Affected Software: Events Manager ≤ 7.4.8 Patched Versions: 7.4.9
Mitigation steps: Update to Events Manager version 7.4.9 or greater.
WP Ultimate Review – Unauthenticated Arbitrary Shortcode Execution
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution CVE: CVE-2026-103234 Number of Installations: 60,000+ Affected Software: WP Ultimate Review ≤ 2.4.4 Patched Versions: 2.4.5
Mitigation steps: Update to WP Ultimate Review version 2.4.5 or greater.
Brizy – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-111844 Number of Installations: 60,000+ Affected Software: Brizy 2.8.23 Patched Versions: Brizy 2.8.24
Mitigation steps: Update to Brizy version 2.8.24 or greater.
Ultra Addons for Contact Form 7 – Unauthenticated Stored Cross-Site Scripting via File Upload
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via File Upload CVE: CVE-2026-103999 Number of Installations: 60,000+ Affected Software: Ultra Addons for Contact Form 7 ≤ 3.5.54 Patched Versions: 3.5.55
Mitigation steps: Update to Ultra Addons for Contact Form 7 version 3.5.55 or greater.
10Web Booster – Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path CVE: CVE-2026-103896 Number of Installations: 60,000+ Affected Software: 10Web Booster ≤ 2.34.5 Patched Versions: 2.34.6
Mitigation steps: Update to 10Web Booster version 2.34.6 or greater.
10Web Booster – Unauthenticated Arbitrary File Upload via ‘page_id’ Parameter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary File Upload via 'page_id' Parameter CVE: CVE-2026-108587 Number of Installations: 60,000+ Affected Software: 10Web Booster ≤ 2.34.10 Patched Versions: 2.34.11
Mitigation steps: Update to 10Web Booster version 2.34.11 or greater.
Events Manager – Unauthenticated Race Condition
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Race Condition CVE: CVE-2026-42689 Number of Installations: 60,000+ Affected Software: Events Manager ≤ 7.4.8 Patched Versions: 7.4.9
Mitigation steps: Update to Events Manager version 7.4.9 or greater.
Online Scheduling and Appointment Booking System – Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via ‘id’ and ‘wp_user_id’ Parameters via Query String / JSON Body
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body CVE: CVE-2026-104898 Number of Installations: 60,000+ Affected Software: Online Scheduling and Appointment Booking System ≤ 28.4 Patched Versions: 28.5
Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.5 or greater.
Online Scheduling and Appointment Booking System – Authenticated (Custom+) PHP Object Injection via ‘value’ Parameter
Security Risk: Low Exploitation Level: Requires Custom or higher level authentication. Vulnerability: Authenticated (Custom+) PHP Object Injection via 'value' Parameter CVE: CVE-2026-12626 Number of Installations: 60,000+ Affected Software: Online Scheduling and Appointment Booking System ≤ 28.2 Patched Versions: 28.3
Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.3 or greater.
Order Export & Order Import for WooCommerce – Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path() CVE: CVE-2026-94375 Number of Installations: 60,000+ Affected Software: Order Export & Order Import for WooCommerce ≤ 2.7.8 Patched Versions: 2.7.9
Mitigation steps: Update to Order Export & Order Import for WooCommerce version 2.7.9 or greater.
10Web Booster – Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Author Name CVE: CVE-2026-107742 Number of Installations: 60,000+ Affected Software: 10Web Booster ≤ 2.34.8 Patched Versions: 2.34.9
Mitigation steps: Update to 10Web Booster version 2.34.9 or greater.
Online Scheduling and Appointment Booking System – Unauthenticated Sensitive Information Exposure in ‘phone’ Parameter to bookly_render_details
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details CVE: CVE-2026-103365 Number of Installations: 60,000+ Affected Software: Online Scheduling and Appointment Booking System ≤ 28.4 Patched Versions: 28.5
Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.5 or greater.
Brizy – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘brizy-compiled-sections’ Post Meta
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta CVE: CVE-2026-14882 Number of Installations: 60,000+ Affected Software: Brizy ≤ 2.8.18 Patched Versions: 2.8.19
Mitigation steps: Update to Brizy version 2.8.19 or greater.
Events Manager – Authenticated (Subscriber+) SQL Injection
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) SQL Injection CVE: CVE-2026-42633 Number of Installations: 60,000+ Affected Software: Events Manager ≤ 7.4.6 Patched Versions: 7.4.7
Mitigation steps: Update to Events Manager version 7.4.7 or greater.
Events Manager – Unauthenticated Information Exposure
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-105068 Number of Installations: 60,000+ Affected Software: Events Manager ≤ 7.4.5 Patched Versions: 7.4.6
Mitigation steps: Update to Events Manager version 7.4.6 or greater.
WP Ultimate Review – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘xs_reviw_summery’ Parameter
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter CVE: CVE-2026-103519 Number of Installations: 60,000+ Affected Software: WP Ultimate Review ≤ 2.4.3 Patched Versions: 2.4.4
Mitigation steps: Update to WP Ultimate Review version 2.4.4 or greater.
WP Ultimate Review – Unauthenticated Arbitrary Shortcode Execution via ‘xs_reviw_summery’ Parameter (Split-Shortcode / Late-Registered Shortcode)
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode) CVE: CVE-2026-100157 Number of Installations: 60,000+ Affected Software: WP Ultimate Review ≤ 2.4.3 Patched Versions: 2.4.4
Mitigation steps: Update to WP Ultimate Review version 2.4.4 or greater.
Export and Import Users and Customers – Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field CVE: CVE-2026-104368 Number of Installations: 50,000+ Affected Software: Export and Import Users and Customers ≤ 2.7.5 Patched Versions: 2.7.6
Mitigation steps: Update to Export and Import Users and Customers version 2.7.6 or greater.
افزونه پیامک ووکامرس – Reflected Cross-Site Scripting
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting CVE: CVE-2026-111021 Number of Installations: 50,000+ Affected Software: افزونه پیامک ووکامرس 7.2.0 - 7.3.1 Patched Versions: 7.3.2
Mitigation steps: Update to افزونه پیامک ووکامرس version 7.3.2 or greater.
Webheadcoder Multi-Step Forms for Contact Form 7 – Reflected Cross-Site Scripting via ‘l10n_print_after’ Parameter
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via 'l10n_print_after' Parameter CVE: CVE-2026-92098 Number of Installations: 50,000+ Affected Software: Webheadcoder Multi-Step Forms for Contact Form 7 ≤ 4.7 Patched Versions: 4.8
Mitigation steps: Update to Webheadcoder Multi-Step Forms for Contact Form 7 version 4.8 or greater.
Product Filter for WooCommerce by WBW – Unauthenticated SQL Injection
Security Risk: Critical Exploitation Level: No authentication required. Vulnerability: Unauthenticated SQL Injection CVE: CVE-2026-112866 Number of Installations: 50,000+ Affected Software: Product Filter for WooCommerce by WBW ≤ 3.4.6 Patched Versions: 3.4.7
Mitigation steps: Update to Product Filter for WooCommerce by WBW version 3.4.7 or greater.
Simple Banner – Authenticated (Custom Role+) Privilege Escalation
Security Risk: Medium Exploitation Level: Requires Custom Role or higher level authentication. Vulnerability: Authenticated (Custom Role+) Privilege Escalation CVE: CVE-2026-107506 Number of Installations: 50,000+ Affected Software: Simple Banner < 3.3.3 Patched Versions: 3.3.3
Mitigation steps: Update to Simple Banner version 3.3.3 or greater.
Translate WordPress with Weglot 2.0 – Unauthenticated Stored Cross-Site Scripting
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting CVE: CVE-2026-88784 Number of Installations: 50,000+ Affected Software: Translate WordPress with Weglot 2.0 ≤ 6.4.2 Patched Versions: 6.4.3
Mitigation steps: Update to Translate WordPress with Weglot 2.0 version 6.4.3 or greater.
User Registration & Membership – Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value CVE: CVE-2026-96660 Number of Installations: 50,000+ Affected Software: User Registration & Membership ≤ 5.2.8 Patched Versions: 5.2.9
Mitigation steps: Update to User Registration & Membership version 5.2.9 or greater.
User Registration & Membership – Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via ‘referrer_url’ Smart Tag
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag CVE: CVE-2026-92798 Number of Installations: 50,000+ Affected Software: User Registration & Membership ≤ 5.2.8 Patched Versions: 5.2.9
Mitigation steps: Update to User Registration & Membership version 5.2.9 or greater.
Popup Box – Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers CVE: CVE-2026-100159 Number of Installations: 50,000+ Affected Software: Popup Box 6.4.1 - 6.4.2 Patched Versions: 6.4.3
Mitigation steps: Update to Popup Box version 6.4.3 or greater.
Simply Schedule Appointments – Unauthenticated Stored Cross-Site Scripting via ‘status’ Parameter via /wp-json/ssa/v1/appointments/{id}
Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
CVE: CVE-2026-104000
Number of Installations: 50,000+
Affected Software: Simply Schedule Appointments ≤ 1.6.12.35
Patched Versions: 1.6.12.36Mitigation steps: Update to Simply Schedule Appointments version 1.6.12.36 or greater.
Theme My Login – Unauthenticated Privilege Escalation via ‘user_pass1’ POST Parameter in wp_pre_insert_user_data Filter
Security Risk: High Exploitation Level: No authentication required. Vulnerability: Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter CVE: CVE-2026-89079 Number of Installations: 50,000+ Affected Software: Theme My Login ≤ 7.2.1 Patched Versions: 7.2.2
Mitigation steps: Update to Theme My Login version 7.2.2 or greater.
User Registration & Membership – Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
Security Risk: Low Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name CVE: CVE-2026-15222 Number of Installations: 50,000+ Affected Software: User Registration & Membership ≤ 5.2.8 Patched Versions: 5.2.9
Mitigation steps: Update to User Registration & Membership version 5.2.9 or greater.
Post and Page Builder by BoldGrid – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘data-label’ Attribute
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute CVE: CVE-2026-78001 Number of Installations: 50,000+ Affected Software: Post and Page Builder by BoldGrid ≤ 1.27.13 Patched Versions: 1.27.14
Mitigation steps: Update to Post and Page Builder by BoldGrid version 1.27.14 or greater.
WP Encryption – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-108064 Number of Installations: 50,000+ Affected Software: WP Encryption < 7.8.8.2 Patched Versions: 7.8.8.2
Mitigation steps: Update to WP Encryption version 7.8.8.2 or greater.
User Registration & Membership – Missing Authorization
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Missing Authorization CVE: CVE-2026-106597 Number of Installations: 50,000+ Affected Software: User Registration & Membership ≤ 5.2.8 Patched Versions: 5.2.9
Mitigation steps: Update to User Registration & Membership version 5.2.9 or greater.
User Registration & Membership – Unauthenticated Information Exposure
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Unauthenticated Information Exposure CVE: CVE-2026-106598 Number of Installations: 50,000+ Affected Software: User Registration & Membership ≤ 5.2.8 Patched Versions: 5.2.9
Mitigation steps: Update to User Registration & Membership version 5.2.9 or greater.
FOX – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-108174 Number of Installations: 50,000+ Affected Software: FOX ≤ 1.5.4 Patched Versions: 1.5.5
Mitigation steps: Update to FOX version 1.5.5 or greater.
User Registration & Membership – Authenticated (Contributor+) Stored Cross-Site Scripting
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting CVE: CVE-2026-105881 Number of Installations: 50,000+ Affected Software: User Registration & Membership ≤ 5.2.8 Patched Versions: 5.2.9
Mitigation steps: Update to User Registration & Membership version 5.2.9 or greater.
WP-Members Membership Plugin – Missing Authorization
Security Risk: Medium Exploitation Level: Requires Author or higher level authentication. Vulnerability: Missing Authorization CVE: CVE-2026-61994 Number of Installations: 50,000+ Affected Software: WP-Members Membership Plugin ≤ 3.5.7 Patched Versions: 3.5.8
Mitigation steps: Update to WP-Members Membership Plugin version 3.5.8 or greater.
Table Field Add-on for ACF and SCF – Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content CVE: CVE-2026-78068 Number of Installations: 50,000+ Affected Software: Table Field Add-on for ACF and SCF ≤ 1.3.35 Patched Versions: 1.3.36
Mitigation steps: Update to Table Field Add-on for ACF and SCF version 1.3.36 or greater.
Table Field Add-on for ACF and SCF – Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value CVE: CVE-2026-96743 Number of Installations: 50,000+ Affected Software: Table Field Add-on for ACF and SCF < 1.4.1-RC2 Patched Versions: Table Field Add-on for ACF and SCF 1.4.1
Mitigation steps: Update to Table Field Add-on for ACF and SCF version 1.4.1 or greater.
Filter Everything – Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL CVE: CVE-2026-87869 Number of Installations: 50,000+ Affected Software: Filter Everything ≤ 1.9.6 Patched Versions: 1.9.7
Mitigation steps: Update to Filter Everything version 1.9.7 or greater.
Getwid – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘data-image-points’
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points' CVE: CVE-2026-91862 Number of Installations: 50,000+ Affected Software: Getwid ≤ 3.0.1 Patched Versions: 3.0.2
Mitigation steps: Update to Getwid version 3.0.2 or greater.
Embed Any Document – Authenticated (Contributor+) Stored Cross-Site Scripting via ’embeddoc’ Shortcode
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode CVE: CVE-2026-18558 Number of Installations: 50,000+ Affected Software: Embed Any Document ≤ 2.7.13 Patched Versions: 2.7.14
Mitigation steps: Update to Embed Any Document version 2.7.14 or greater.
Simply Schedule Appointments – Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token CVE: CVE-2026-6723 Number of Installations: 50,000+ Affected Software: Simply Schedule Appointments ≤ 1.6.11.11 Patched Versions: 1.6.11.12
Mitigation steps: Update to Simply Schedule Appointments version 1.6.11.12 or greater.
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels – Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via ’email’ Parameter
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter CVE: CVE-2026-93746 Number of Installations: 50,000+ Affected Software: WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels ≤ 5.0.2 Patched Versions: 5.0.3
Mitigation steps: Update to WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels version 5.0.3 or greater.
WPFront Notification Bar – Reflected Cross-Site Scripting via REQUEST_URI
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Reflected Cross-Site Scripting via REQUEST_URI CVE: CVE-2026-93896 Number of Installations: 50,000+ Affected Software: WPFront Notification Bar ≤ 3.5.1 Patched Versions: 3.5.2
Mitigation steps: Update to WPFront Notification Bar version 3.5.2 or greater.
Update your website software to reduce risk. Users unable to upgrade to the latest version are advised to implement a web application firewall, which can virtually patch known vulnerabilities and safeguard their website.
Denis Sinegubko
Juliana Lewis
Ben Martin
Art Martori
Allison Bondi
Kyle Knight
Luke Leal
Rianna MacLeod