WordPress CVEs

CVE-2026-111372 October 28, 2026

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a… Full details

MEDIUM 4.3

CVE-2026-111213 October 28, 2026

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly… Full details

MEDIUM 4.3

CVE-2026-111120 October 28, 2026

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the… Full details

HIGH 8.8

CVE-2026-111111 October 28, 2026

The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2… Full details

HIGH 7.2

CVE-2026-111068 October 28, 2026

The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it… Full details

MEDIUM 4.4

CVE-2026-110662 October 28, 2026

The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to… Full details

HIGH 7.2

CVE-2026-110185 October 28, 2026

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via… Full details

MEDIUM 5.9

CVE-2026-110071 October 28, 2026

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes… Full details

MEDIUM 6.4

CVE-2026-110020 October 28, 2026

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user… Full details

MEDIUM 6.5

CVE-2026-109988 October 28, 2026

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to… Full details

MEDIUM 4.4

CVE-2026-109980 October 28, 2026

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. This makes it possible for authenticated attackers, with… Full details

MEDIUM 4.3

CVE-2026-109979 October 28, 2026

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page. The handle_create_link() handler… Full details

MEDIUM 4.3

CVE-2026-109978 October 28, 2026

The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to,… Full details

MEDIUM 6.4

CVE-2026-109975 October 28, 2026

The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout /… Full details

MEDIUM 6.4

CVE-2026-109972 October 28, 2026

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to,… Full details

MEDIUM 6.4

CVE-2026-109590 October 28, 2026

The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is… Full details

MEDIUM 6.4

CVE-2026-109385 October 28, 2026

The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in all versions up to, and including,… Full details

MEDIUM 6.4

CVE-2026-109384 October 28, 2026

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file… Full details

HIGH 8.8

CVE-2026-109381 October 28, 2026

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable… Full details

HIGH 7.2

CVE-2026-109370 October 28, 2026

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to,… Full details

MEDIUM 6.4

CVE-2026-109218 October 28, 2026

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails… Full details

CRITICAL 9.8

CVE-2026-108366 October 28, 2026

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg… Full details

MEDIUM 6.4

CVE-2026-107710 October 28, 2026

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input… Full details

MEDIUM 6.4

CVE-2026-104743 October 28, 2026

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and… Full details

MEDIUM 4.9

CVE-2026-104740 October 28, 2026

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'conversion' Shortcode Attribute in all versions up to, and including, 1.10.2 due to… Full details

MEDIUM 6.4

CVE-2026-104729 October 28, 2026

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 6.4

CVE-2026-103996 October 28, 2026

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to… Full details

MEDIUM 6.4

CVE-2026-103370 October 28, 2026

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input… Full details

MEDIUM 6.4

CVE-2026-100175 October 28, 2026

The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This makes… Full details

MEDIUM 5.4

CVE-2026-15323 October 28, 2026

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated… Full details

HIGH 7.5

CVE-2026-115281 October 28, 2026

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to… Full details

MEDIUM 6.8

CVE-2026-115255 October 28, 2026

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members. Full details

MEDIUM 5.3

CVE-2026-115225 October 28, 2026

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections… Full details

MEDIUM 5.8

CVE-2026-115224 October 28, 2026

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with… Full details

MEDIUM 4.1

CVE-2026-113813 October 28, 2026

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers… Full details

MEDIUM 6.5

CVE-2026-113494 October 28, 2026

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and… Full details

LOW 2.7

CVE-2026-113488 October 28, 2026

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and… Full details

MEDIUM 6.8

CVE-2026-113487 October 28, 2026

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role… Full details

MEDIUM 6.8

CVE-2026-113486 October 28, 2026

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role… Full details

MEDIUM 6.5

CVE-2026-113485 October 28, 2026

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request… Full details

MEDIUM 6.5

CVE-2026-111967 October 28, 2026

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject… Full details

MEDIUM 6.8

CVE-2026-111961 October 28, 2026

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full… Full details

LOW 3.8

CVE-2026-111960 October 28, 2026

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content… Full details

MEDIUM 4.3

CVE-2026-111577 October 28, 2026

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a… Full details

HIGH 7.2

CVE-2026-111032 October 28, 2026

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any… Full details

LOW 3.8

CVE-2026-111031 October 28, 2026

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites. Full details

MEDIUM 4.7

CVE-2026-111027 October 28, 2026

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing… Full details

MEDIUM 6.8

CVE-2026-111021 October 28, 2026

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is… Full details

HIGH 7.1

CVE-2026-110691 October 28, 2026

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery… Full details

MEDIUM 6.5

CVE-2026-110524 October 28, 2026

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which… Full details

MEDIUM 6.8