WordPress CVEs

CVE-2026-11905 October 15, 2026

The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes… Full details

MEDIUM 4.3

CVE-2026-109145 October 15, 2026

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of… Full details

CRITICAL 9.8

CVE-2026-106031 October 15, 2026

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the… Full details

MEDIUM 6.5

CVE-2026-104643 October 15, 2026

The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner… Full details

MEDIUM 4.2

CVE-2026-103324 October 15, 2026

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing… Full details

MEDIUM 5.3

CVE-2026-103304 October 15, 2026

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and… Full details

MEDIUM 5.3

CVE-2026-88043 October 15, 2026

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This… Full details

HIGH 7.2

CVE-2026-86803 October 15, 2026

The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that… Full details

MEDIUM 6.5

CVE-2026-78087 October 15, 2026

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This… Full details

MEDIUM 6.4

CVE-2026-78001 October 15, 2026

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and… Full details

MEDIUM 6.4

CVE-2026-18586 October 15, 2026

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and… Full details

HIGH 7.2

CVE-2026-18557 October 15, 2026

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input… Full details

MEDIUM 6.1

CVE-2026-18548 October 15, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization… Full details

HIGH 7.2

CVE-2026-17031 October 15, 2026

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that… Full details

HIGH 8.1

CVE-2026-17001 October 15, 2026

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient… Full details

MEDIUM 6.4

CVE-2026-15180 October 15, 2026

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This… Full details

MEDIUM 6.1

CVE-2026-15090 October 15, 2026

The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and… Full details

HIGH 7.5

CVE-2026-3712 October 15, 2026

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the… Full details

HIGH 7.3

CVE-2026-14572 October 15, 2026

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to… Full details

MEDIUM 6.4

CVE-2026-108587 October 15, 2026

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This… Full details

CRITICAL 9.8

CVE-2026-86461 October 14, 2026

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type… Full details

HIGH 8.8

CVE-2026-97315 October 14, 2026

The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner,… Full details

MEDIUM 5.4

CVE-2026-88998 October 14, 2026

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a… Full details

MEDIUM 5.3

CVE-2026-82844 October 14, 2026

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms… Full details

MEDIUM 5.3

CVE-2026-103308 October 14, 2026

The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered… Full details

MEDIUM 6.5

CVE-2026-101301 October 14, 2026

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's… Full details

MEDIUM 5.3

CVE-2026-110284 October 14, 2026

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode.… Full details

HIGH 7.5

CVE-2026-107757 October 14, 2026

The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization… Full details

MEDIUM 4.9

CVE-2026-107756 October 14, 2026

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 6.4

CVE-2026-107754 October 14, 2026

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] = title)' parameter in all versions up to, and including,… Full details

MEDIUM 6.4

CVE-2026-107751 October 14, 2026

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes… Full details

HIGH 7.2

CVE-2026-107650 October 14, 2026

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 2.8.190 due to… Full details

MEDIUM 6.4

CVE-2026-107631 October 14, 2026

The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and… Full details

HIGH 7.2

CVE-2026-104909 October 14, 2026

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers… Full details

HIGH 8.1

CVE-2026-104764 October 14, 2026

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for… Full details

HIGH 7.2

CVE-2026-104761 October 14, 2026

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes… Full details

MEDIUM 6.4

CVE-2026-104748 October 14, 2026

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due… Full details

CRITICAL 9.8

CVE-2026-103907 October 14, 2026

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to,… Full details

MEDIUM 6.5

CVE-2026-103380 October 14, 2026

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This… Full details

MEDIUM 4.3

CVE-2026-103367 October 14, 2026

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for… Full details

HIGH 8.1

CVE-2026-103366 October 14, 2026

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]`… Full details

HIGH 7.5

CVE-2026-100163 October 14, 2026

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the… Full details

HIGH 7.4

CVE-2025-9373 October 14, 2026

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for… Full details

MEDIUM 6.4

CVE-2026-96904 October 14, 2026

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on… Full details

MEDIUM 5.3

CVE-2026-96900 October 14, 2026

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know… Full details

MEDIUM 5.3

CVE-2026-94360 October 14, 2026

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without… Full details

MEDIUM 5.3

CVE-2026-94261 October 14, 2026

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one… Full details

MEDIUM 5.3

CVE-2026-94260 October 14, 2026

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata… Full details

MEDIUM 5.3

CVE-2026-94254 October 14, 2026

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their… Full details

MEDIUM 5.3

CVE-2026-92426 October 14, 2026

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta… Full details

MEDIUM 4.9