WordPress CVEs

CVE-2026-14876 September 30, 2026

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This… Full details

MEDIUM 6.4

CVE-2026-11895 September 30, 2026

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1… Full details

MEDIUM 6.4

CVE-2026-89294 September 30, 2026

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with… Full details

HIGH 7.5

CVE-2026-97316 September 30, 2026

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal… Full details

MEDIUM 5.8

CVE-2026-96886 September 30, 2026

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked… Full details

MEDIUM 5.3

CVE-2026-94297 September 30, 2026

The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to… Full details

LOW 2.7

CVE-2026-94274 September 30, 2026

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and… Full details

MEDIUM 5.3

CVE-2026-93580 September 30, 2026

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers… Full details

MEDIUM 5.3

CVE-2026-92994 September 30, 2026

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers… Full details

HIGH 8.8

CVE-2026-92424 September 30, 2026

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before… Full details

MEDIUM 6.8

CVE-2026-91832 September 30, 2026

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a… Full details

HIGH 7.1

CVE-2026-91072 September 30, 2026

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative… Full details

MEDIUM 4.4

CVE-2026-91051 September 30, 2026

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered,… Full details

MEDIUM 6.6

CVE-2026-90953 September 30, 2026

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should… Full details

MEDIUM 4.3

CVE-2026-89193 September 30, 2026

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit… Full details

HIGH 7.5

CVE-2026-89190 September 30, 2026

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin… Full details

MEDIUM 4.3

CVE-2026-88797 September 30, 2026

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such… Full details

HIGH 7.1

CVE-2026-88791 September 30, 2026

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an… Full details

LOW 3.4

CVE-2026-87777 September 30, 2026

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts… Full details

MEDIUM 6.8

CVE-2026-86789 September 30, 2026

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or… Full details

MEDIUM 5.3

CVE-2026-85576 September 30, 2026

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such… Full details

MEDIUM 4.3

CVE-2026-85573 September 30, 2026

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing… Full details

HIGH 8.8

CVE-2026-85415 September 30, 2026

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store… Full details

MEDIUM 6.8

CVE-2026-85001 September 30, 2026

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above… Full details

MEDIUM 6.8

CVE-2026-83560 September 30, 2026

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id,… Full details

MEDIUM 5.3

CVE-2026-82127 September 30, 2026

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users… Full details

LOW 3.5

CVE-2026-80333 September 30, 2026

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of… Full details

MEDIUM 5.3

CVE-2026-75873 September 30, 2026

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files,… Full details

CRITICAL 9.8

CVE-2026-75824 September 30, 2026

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created… Full details

MEDIUM 5.3

CVE-2026-75823 September 30, 2026

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects… Full details

HIGH 7.4

CVE-2026-100143 September 30, 2026

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest… Full details

MEDIUM 6.5

CVE-2026-96649 September 30, 2026

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including,… Full details

HIGH 7.2

CVE-2026-96326 September 29, 2026

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including,… Full details

HIGH 7.2

CVE-2026-87741 September 28, 2026

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability exists because the… Full details

HIGH 8.8

CVE-2026-93000 September 28, 2026

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks. Full details

MEDIUM 6.8

CVE-2026-92996 September 28, 2026

The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order… Full details

MEDIUM 5.3

CVE-2026-89411 September 28, 2026

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as… Full details

MEDIUM 5.3

CVE-2026-89303 September 28, 2026

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks. Full details

MEDIUM 6.4

CVE-2026-89300 September 28, 2026

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well… Full details

MEDIUM 5.3

CVE-2026-88828 September 28, 2026

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep… Full details

MEDIUM 5.4

CVE-2026-86838 September 28, 2026

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services… Full details

MEDIUM 5.3

CVE-2026-84744 September 28, 2026

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered… Full details

MEDIUM 6.5

CVE-2026-97319 September 27, 2026

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above… Full details

MEDIUM 6.8

CVE-2026-97227 September 27, 2026

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access… Full details

MEDIUM 5.9

CVE-2026-96899 September 27, 2026

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the… Full details

MEDIUM 6.8

CVE-2026-96897 September 27, 2026

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of… Full details

MEDIUM 5.3

CVE-2026-96896 September 27, 2026

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite… Full details

HIGH 7.2

CVE-2026-96895 September 27, 2026

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a… Full details

MEDIUM 6.8

CVE-2026-92995 September 27, 2026

The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization. Full details

MEDIUM 5.3

CVE-2026-92436 September 27, 2026

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an… Full details

MEDIUM 5.3