WordPress CVEs

CVE-2026-121848 November 7, 2026

The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber,… Full details

HIGH 8.8

CVE-2026-121796 November 7, 2026

The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing… Full details

MEDIUM 6.8

CVE-2026-121492 November 7, 2026

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation… Full details

MEDIUM 5.3

CVE-2026-121491 November 7, 2026

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute… Full details

CRITICAL 9

CVE-2026-121380 November 7, 2026

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams. Full details

MEDIUM 5.3

CVE-2026-121379 November 7, 2026

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a… Full details

CRITICAL 9.6

CVE-2026-119073 November 7, 2026

The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above… Full details

MEDIUM 6.8

CVE-2026-118534 November 7, 2026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated… Full details

MEDIUM 4.3

CVE-2026-118533 November 7, 2026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a… Full details

MEDIUM 4.3

CVE-2026-118532 November 7, 2026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above… Full details

MEDIUM 6.5

CVE-2026-118530 November 7, 2026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing… Full details

MEDIUM 5

CVE-2026-118529 November 7, 2026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such… Full details

LOW 3.1

CVE-2026-118528 November 7, 2026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated… Full details

MEDIUM 4.3

CVE-2026-117588 November 7, 2026

The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided… Full details

MEDIUM 4.3

CVE-2026-117525 November 7, 2026

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script… Full details

HIGH 7.5

CVE-2025-15708 November 7, 2026

The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as… Full details

LOW 3.5

CVE-2026-9601 November 7, 2026

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and… Full details

MEDIUM 6.4

CVE-2026-93902 November 7, 2026

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it… Full details

MEDIUM 6.4

CVE-2026-93779 November 7, 2026

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.2 via the init_routes due to missing validation… Full details

MEDIUM 6.5

CVE-2026-120477 November 7, 2026

The Stop Spammers Classic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' POST parameter in versions up to, and including, 2026.6. An unauthenticated POST handled on init stores the attacker-supplied… Full details

MEDIUM 4.7

CVE-2026-120043 November 7, 2026

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.2.14 due to insufficient escaping on the… Full details

HIGH 7.5

CVE-2026-119167 November 7, 2026

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input… Full details

HIGH 7.2

CVE-2026-110705 November 7, 2026

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to… Full details

MEDIUM 5.3

CVE-2026-110534 November 7, 2026

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes… Full details

MEDIUM 6.4

CVE-2026-19803 November 7, 2026

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image`… Full details

CRITICAL 9.8

CVE-2026-121516 November 7, 2026

The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 6.1

CVE-2026-120739 November 7, 2026

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's (missing_srcsets[*][*].s)' parameter in all… Full details

HIGH 7.2

CVE-2026-120677 November 7, 2026

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions… Full details

HIGH 7.2

CVE-2026-120560 November 7, 2026

The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Media Library File Deletion in all versions up to, and including, 2.1.5 This is due to the `get_table_data()` AJAX… Full details

MEDIUM 6.5

CVE-2026-119158 November 7, 2026

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 3.8.4.16 due to insufficient… Full details

HIGH 7.2

CVE-2026-93754 November 7, 2026

The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are… Full details

CRITICAL 9.8

CVE-2026-121519 November 7, 2026

The Social Slider Feed – Social Media Feed & Gallery Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slidespeed' parameter in all versions up to, and including, 2.3.8 due to… Full details

MEDIUM 6.4

CVE-2026-121515 November 7, 2026

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 5.4

CVE-2026-120741 November 7, 2026

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback =>… Full details

MEDIUM 5.4

CVE-2026-120737 November 7, 2026

The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized… Full details

MEDIUM 5.9

CVE-2026-120555 November 7, 2026

The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read… Full details

MEDIUM 5.3

CVE-2026-120540 November 7, 2026

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.13.6. This is due to the… Full details

HIGH 7.2

CVE-2026-120520 November 7, 2026

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 13.2.2 via the 'img (or any key the publisher references… Full details

MEDIUM 5.3

CVE-2026-120512 November 7, 2026

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdform__element (Hidden Input field, name = user-defined, e.g. hidden_probe)' parameter… Full details

HIGH 7.2

CVE-2026-120082 November 7, 2026

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.200 due to… Full details

HIGH 7.2

CVE-2026-119616 November 7, 2026

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes… Full details

MEDIUM 5.9

CVE-2026-119219 November 7, 2026

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[]' parameter in all versions up to, and including, 4.62.0 due to insufficient input sanitization and output escaping. This… Full details

MEDIUM 5.4

CVE-2026-119218 November 7, 2026

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 13.2.2 due to insufficient… Full details

MEDIUM 5.4

CVE-2026-119213 November 7, 2026

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party… Full details

LOW 3.7

CVE-2026-119175 November 7, 2026

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.4.15 due… Full details

HIGH 7.2

CVE-2026-119165 November 7, 2026

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output… Full details

MEDIUM 6.4

CVE-2026-119152 November 7, 2026

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customer[email] (inside params)' parameter in all versions up to, and including,… Full details

MEDIUM 5.4

CVE-2026-119098 November 7, 2026

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer[]' parameter in all versions up to, and including, 10.3.2 due to… Full details

MEDIUM 6.4

CVE-2026-119070 November 7, 2026

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions… Full details

HIGH 7.2

CVE-2026-118067 November 7, 2026

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdform__element (payload) + disabled_fields (pivot)' parameter in all versions up… Full details

MEDIUM 5.4