WordPress CVEs

CVE-2026-13405 August 20, 2026

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on… Full details

MEDIUM 6.6

CVE-2026-18315 August 19, 2026

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due… Full details

CRITICAL 9.8

CVE-2026-64851 August 19, 2026

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains… Full details

HIGH 8.5

CVE-2026-75981 August 19, 2026

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are… Full details

HIGH 7.2

CVE-2026-15780 August 19, 2026

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input… Full details

HIGH 7.2

CVE-2026-15446 August 19, 2026

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization… Full details

MEDIUM 6.4

CVE-2026-19842 August 19, 2026

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that… Full details

HIGH 8.8

CVE-2026-19782 August 19, 2026

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users. Full details

MEDIUM 5.4

CVE-2026-19709 August 19, 2026

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to… Full details

MEDIUM 5.3

CVE-2026-19417 August 19, 2026

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including… Full details

MEDIUM 6.5

CVE-2026-19416 August 19, 2026

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments. Full details

MEDIUM 4.3

CVE-2026-19406 August 19, 2026

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on… Full details

LOW 2.7

CVE-2026-19056 August 19, 2026

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that… Full details

HIGH 7.1

CVE-2026-19055 August 19, 2026

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered… Full details

HIGH 7.1

CVE-2026-18937 August 19, 2026

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and… Full details

CRITICAL 9

CVE-2026-18779 August 19, 2026

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment… Full details

MEDIUM 5.3

CVE-2026-18778 August 19, 2026

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their… Full details

MEDIUM 5.3

CVE-2026-18777 August 19, 2026

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification… Full details

MEDIUM 5.3

CVE-2026-18776 August 19, 2026

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take… Full details

CRITICAL 9.8

CVE-2026-18466 August 19, 2026

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number… Full details

MEDIUM 5.4

CVE-2026-18231 August 19, 2026

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and… Full details

MEDIUM 5.3

CVE-2026-18202 August 19, 2026

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a… Full details

MEDIUM 6.8

CVE-2026-18051 August 19, 2026

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on… Full details

CRITICAL 10

CVE-2026-18031 August 19, 2026

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered… Full details

CRITICAL 9.8

CVE-2026-17565 August 19, 2026

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site… Full details

HIGH 7.2

CVE-2026-16979 August 19, 2026

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles… Full details

MEDIUM 4.3

CVE-2026-16950 August 19, 2026

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. Full details

HIGH 8.6

CVE-2026-16617 August 19, 2026

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled)… Full details

HIGH 8.8

CVE-2026-16616 August 19, 2026

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate… Full details

HIGH 8.6

CVE-2026-16570 August 19, 2026

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks… Full details

HIGH 7.1

CVE-2026-16058 August 19, 2026

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order… Full details

MEDIUM 5.3

CVE-2026-15253 August 19, 2026

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author… Full details

MEDIUM 6.8

CVE-2026-14861 August 19, 2026

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to… Full details

HIGH 7.5

CVE-2026-14826 August 19, 2026

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access… Full details

LOW 2.7

CVE-2026-14825 August 19, 2026

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the… Full details

LOW 2.7

CVE-2026-14334 August 19, 2026

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin… Full details

HIGH 8.8

CVE-2026-14287 August 19, 2026

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing… Full details

MEDIUM 4.7

CVE-2026-14196 August 19, 2026

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews… Full details

MEDIUM 4.3

CVE-2026-13175 August 19, 2026

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by… Full details

MEDIUM 6.5

CVE-2026-13174 August 19, 2026

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts. Full details

HIGH 7.2

CVE-2026-13173 August 19, 2026

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above… Full details

LOW 2.7

CVE-2026-13169 August 19, 2026

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to… Full details

HIGH 8.1

CVE-2026-12983 August 19, 2026

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a… Full details

HIGH 8.6

CVE-2026-11565 August 19, 2026

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access… Full details

HIGH 8.5

CVE-2026-19942 August 19, 2026

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the… Full details

HIGH 8.1

CVE-2026-15421 August 19, 2026

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization… Full details

MEDIUM 6.4

CVE-2025-11729 August 19, 2026

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions… Full details

MEDIUM 4.3

CVE-2026-66602 August 18, 2026

Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0. Full details

HIGH 8.8

CVE-2026-73351 August 18, 2026

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register Full details

HIGH 7.1

CVE-2026-75091 August 18, 2026

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and… Full details

HIGH 7.2