WordPress CVEs

CVE-2026-18233 August 29, 2026

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders… Full details

MEDIUM 6.5

CVE-2026-17522 August 29, 2026

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make… Full details

MEDIUM 5.4

CVE-2026-17520 August 29, 2026

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged… Full details

MEDIUM 4.8

CVE-2026-16947 August 29, 2026

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the… Full details

CRITICAL 9.1

CVE-2026-16600 August 29, 2026

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access… Full details

HIGH 7.7

CVE-2026-16259 August 29, 2026

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing… Full details

CRITICAL 9.8

CVE-2026-16061 August 29, 2026

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated… Full details

HIGH 8.6

CVE-2026-10522 August 29, 2026

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator,… Full details

CRITICAL 9.8

CVE-2026-39071 August 28, 2026

WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site… Full details

MEDIUM 5.4

CVE-2026-39070 August 28, 2026

WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect user to malicious site or control… Full details

MEDIUM 4.8

CVE-2026-6176 August 28, 2026

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization… Full details

HIGH 7.2

CVE-2026-5934 August 28, 2026

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the… Full details

HIGH 7.2

CVE-2026-5096 August 28, 2026

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from… Full details

MEDIUM 5.3

CVE-2026-3423 August 28, 2026

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 6.4

CVE-2026-6128 August 28, 2026

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization… Full details

MEDIUM 6.4

CVE-2026-5510 August 28, 2026

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient… Full details

MEDIUM 6.4

CVE-2026-79996 August 28, 2026

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin… Full details

HIGH 7.2

CVE-2026-79995 August 28, 2026

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level… Full details

MEDIUM 4.3

CVE-2026-79706 August 28, 2026

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files… Full details

MEDIUM 5.3

CVE-2026-79615 August 28, 2026

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as… Full details

LOW 2.7

CVE-2026-77701 August 28, 2026

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the… Full details

MEDIUM 5.3

CVE-2026-76581 August 28, 2026

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1`… Full details

CRITICAL 9.8

CVE-2026-6286 August 28, 2026

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an… Full details

HIGH 7.2

CVE-2026-5097 August 28, 2026

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter… Full details

HIGH 7.5

CVE-2026-4246 August 28, 2026

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input… Full details

MEDIUM 6.1

CVE-2026-19423 August 28, 2026

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered… Full details

HIGH 8.1

CVE-2026-19084 August 28, 2026

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a… Full details

HIGH 7.5

CVE-2026-14567 August 28, 2026

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators. Full details

MEDIUM 5.3

CVE-2026-14558 August 28, 2026

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP… Full details

HIGH 7.2

CVE-2026-12514 August 28, 2026

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce… Full details

MEDIUM 5.3

CVE-2026-12513 August 28, 2026

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated… Full details

MEDIUM 6.8

CVE-2026-77365 August 28, 2026

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all… Full details

HIGH 7.2

CVE-2026-76053 August 28, 2026

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due… Full details

HIGH 7.2

CVE-2026-3129 August 28, 2026

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `` tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that… Full details

MEDIUM 6.4

CVE-2026-18983 August 28, 2026

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient… Full details

HIGH 7.5

CVE-2026-18978 August 28, 2026

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it… Full details

HIGH 7.2

CVE-2026-18324 August 28, 2026

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due… Full details

HIGH 7.2

CVE-2026-16759 August 28, 2026

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax… Full details

MEDIUM 6.5

CVE-2026-16654 August 28, 2026

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This… Full details

MEDIUM 6.4

CVE-2026-15798 August 28, 2026

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This… Full details

MEDIUM 6.4

CVE-2026-19092 August 27, 2026

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output. Full details

CRITICAL 9.8

CVE-2026-32566 August 27, 2026

Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress Full details

CRITICAL 9.8

CVE-2026-32564 August 27, 2026

Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress Full details

HIGH 8.5

CVE-2026-78333 August 27, 2026

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin… Full details

HIGH 8.8

CVE-2026-78139 August 27, 2026

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers… Full details

MEDIUM 4.3

CVE-2026-78138 August 27, 2026

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above)… Full details

MEDIUM 4.3

CVE-2026-78137 August 27, 2026

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price… Full details

HIGH 7.5

CVE-2026-78125 August 27, 2026

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status… Full details

MEDIUM 5.3

CVE-2026-77018 August 27, 2026

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with… Full details

HIGH 8.8

CVE-2026-77017 August 27, 2026

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role… Full details

HIGH 7.7