WordPress CVEs

CVE-2026-110808 October 31, 2026

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above… Full details

MEDIUM 4.2

CVE-2026-110042 October 31, 2026

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway… Full details

MEDIUM 4.9

CVE-2026-109997 October 31, 2026

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and… Full details

HIGH 7.2

CVE-2026-109234 October 31, 2026

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output… Full details

HIGH 7.2

CVE-2026-101326 October 31, 2026

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This… Full details

MEDIUM 5.4

CVE-2026-100155 October 31, 2026

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This… Full details

MEDIUM 6.5

CVE-2026-111578 October 30, 2026

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order… Full details

HIGH 7.5

CVE-2026-9239 October 30, 2026

The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 6.4

CVE-2026-97638 October 30, 2026

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter… Full details

HIGH 7.5

CVE-2026-96894 October 30, 2026

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to… Full details

HIGH 7.2

CVE-2026-76012 October 30, 2026

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due… Full details

HIGH 7.5

CVE-2026-13747 October 30, 2026

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to… Full details

MEDIUM 6.5

CVE-2026-119176 October 30, 2026

The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output… Full details

MEDIUM 6.4

CVE-2026-119113 October 30, 2026

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is… Full details

MEDIUM 6.4

CVE-2026-118635 October 30, 2026

The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the… Full details

MEDIUM 6.5

CVE-2026-118205 October 30, 2026

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()`… Full details

HIGH 7.4

CVE-2026-116552 October 30, 2026

The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization… Full details

MEDIUM 4.7

CVE-2026-115869 October 30, 2026

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient… Full details

MEDIUM 6.4

CVE-2026-115820 October 30, 2026

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns (array keys)' parameter in all versions up to, and including,… Full details

MEDIUM 6.5

CVE-2026-115346 October 30, 2026

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient… Full details

HIGH 8.1

CVE-2026-112365 October 30, 2026

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and… Full details

HIGH 7.2

CVE-2026-110533 October 30, 2026

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 6.4

CVE-2026-110305 October 30, 2026

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract… Full details

HIGH 7.5

CVE-2026-110001 October 30, 2026

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization… Full details

MEDIUM 5.4

CVE-2026-109984 October 30, 2026

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 5.4

CVE-2026-109592 October 30, 2026

The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. This is due to the plugin not… Full details

MEDIUM 4.3

CVE-2026-107630 October 30, 2026

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly… Full details

HIGH 7.5

CVE-2026-105894 October 30, 2026

The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to… Full details

HIGH 8.8

CVE-2026-104744 October 30, 2026

The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This… Full details

HIGH 7.2

CVE-2026-104739 October 30, 2026

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to,… Full details

MEDIUM 4.9

CVE-2026-102918 October 30, 2026

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored… Full details

MEDIUM 6.4

CVE-2026-102905 October 30, 2026

The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing… Full details

MEDIUM 6.5

CVE-2025-8574 October 30, 2026

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be… Full details

HIGH 8.7

CVE-2026-119714 October 30, 2026

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket… Full details

MEDIUM 6.9

CVE-2026-112348 October 30, 2026

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission… Full details

MEDIUM 6.9

CVE-2026-112347 October 30, 2026

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only… Full details

HIGH 7.2

CVE-2026-97645 October 30, 2026

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it… Full details

HIGH 7.2

CVE-2026-90437 October 30, 2026

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to… Full details

HIGH 7.2

CVE-2026-89435 October 30, 2026

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url'… Full details

HIGH 8.8

CVE-2026-116622 October 30, 2026

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input… Full details

HIGH 7.2

CVE-2026-110732 October 30, 2026

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP… Full details

HIGH 7.5

CVE-2026-103039 October 30, 2026

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to… Full details

CRITICAL 9.8

CVE-2026-119087 October 30, 2026

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly… Full details

MEDIUM 4.3

CVE-2026-119059 October 30, 2026

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies… Full details

MEDIUM 4.3

CVE-2026-118698 October 30, 2026

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due… Full details

MEDIUM 6.5

CVE-2026-118634 October 30, 2026

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This… Full details

MEDIUM 6.4

CVE-2026-118500 October 30, 2026

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to… Full details

MEDIUM 6.4

CVE-2026-118194 October 30, 2026

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the current… Full details

MEDIUM 6.5

CVE-2026-118165 October 30, 2026

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a… Full details

MEDIUM 6.8

CVE-2026-118101 October 30, 2026

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form,… Full details

MEDIUM 5.3