These are not vulnerabilities in WordPress Core, a plugin, or a theme. They are vulnerabilities in PHP, the programming language WordPress uses. Updating WordPress will not install the fixes. On most shared and managed hosting, the hosting provider controls PHP. Agencies and site owners who manage their own servers or containers must update the PHP package or image themselves.

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fixes. Linux distributions and long-term-support vendors may add the same fixes to packages with older version numbers, so the full package revision and the vendor’s security notice matter. After updating, restart PHP so every running process uses the new code. Containers should be rebuilt and redeployed from an updated image.

The Wordfence Threat Intelligence team reviewed PHP’s patches and tested the vulnerable behavior in PHP and WordPress lab environments. This article documents what has been confirmed, shares our preliminary results, and explains what the vulnerabilities mean for WordPress sites.

Wait, what is PHP, and what does it have to do with WordPress?

PHP is the programming language WordPress is primarily written in. It runs on the web server and is usually installed and managed by the hosting provider. Updating WordPress does not update PHP.

The Wordfence Firewall protects the WordPress application layer using Wordfence Threat Intelligence. PHP, the web server, and the operating system run outside WordPress and need their own updates and protection. Keeping a WordPress site secure requires all of these layers to work together.

What has been confirmed about the risk

If an affected PHP package serves your site, treat the update as urgent.

Successful exploitation lets an attacker act with the same access as the website itself. That can be enough to read database credentials, alter site files, steal data, or install a persistent backdoor.

PHP confirmed remote code execution for both vulnerabilities. PHP confirmed one CVE-2026-109618 attack path that runs before WordPress starts. CrowdStrike also reports that its private exploit worked reliably across Intel/AMD and Arm systems and against newly restarted PHP workers. We have not independently tested that unpublished exploit. An attack may need to be adapted to a particular server, but that does not make an unpatched server safe.

A large amount of proof-of-concept code and commentary is already circulating. Some is useful, but some is incomplete, misleading, or incorrect. Site owners should rely on PHP’s official advisories and patch rather than waiting to decide whether a particular public exploit applies to their server.

What the two vulnerabilities do

PHP 8.1 and older no longer receive releases from the PHP project. Some operating-system and long-term-support vendors may still add the fixes. If you use an older branch, obtain an explicit answer from the vendor or move to a supported PHP branch.

What our preliminary testing found

We began testing within hours of the fixes being released and are continuing to study additional attack paths and how reliably they work across common WordPress hosting setups. Our goal is to understand the practical risk to customers still using affected PHP versions.

In a specially configured PHP 8.5.11 Apache lab, CVE-2026-109619 ran a proof-of-concept exploit test against PHP, sent over HTTP and created a temporary text file. This proved code execution in that environment. The same test crashed a normal optimized build of PHP 8.5.11 instead of running code, while fixed PHP 8.5.12 remained healthy.

For CVE-2026-109618, vulnerable PHP 8.5.11 failed while fixed PHP 8.5.12 handled the same proof-of-concept request normally. In separate WordPress 7.1.3 tests with an affected Ubuntu PHP 8.5.4 package, specially prepared requests caused PHP failures or restarts in some setups. We did not independently achieve code execution for this CVE.

What is already clear is that attacks may behave differently on different servers, but an unpatched server should not be considered safe. Install a fixed PHP package and restart PHP.

How to check and update your site

If the PHP service serving your website is older than a fixed release and your vendor has not confirmed that it added the fixes, assume it is affected.

In WordPress, go to Tools > Site Health > Info > Server to see the PHP version used by the website. Do not rely only on php -v at a command prompt; a server can use a different PHP version for websites. Linux and hosting vendors may also add security fixes without changing the main version number, so ask your host or server administrator:

Is the PHP service serving my site patched for CVE-2026-109618 and CVE-2026-109619, and has PHP been restarted?

The first fixed PHP releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Then take the steps that apply to you:

• Managed hosting customers: Ask the host to confirm that both fixes are installed and PHP was restarted.
• Self-managed operators: Update PHP, restart Apache, PHP-FPM, or other PHP services, and rebuild containers from an updated image.
• Agencies and hosting providers: Check every site and environment, including staging sites, origin addresses, and older containers—not only the main public site.
• After updating: Verify the website’s PHP version in Site Health and confirm the complete package revision with the host, operating-system package tools, or image provider.
• Preserve backups and logs: As a precaution, retain backups and preserve web-server, PHP, firewall, and system logs covering at least the 48 hours before the October 21 release through the time PHP was patched and restarted.
• Review delayed updates: If PHP was not patched promptly, review those logs for activity that is unusual for the site and investigate anything suspicious. A lack of obvious entries does not prove that exploitation did not occur.

If you cannot patch immediately, review PHP’s temporary recommendations. They may reduce exposure to particular attack paths, but they are incomplete, may disrupt normal site functions, and do not replace the update.

Where Wordfence fits

The Wordfence Firewall protects the WordPress application layer using Wordfence Threat Intelligence. It can block WordPress-specific attacks that general-purpose security tools may not recognize.

These vulnerabilities affect PHP at the server level, and some attacks can begin before WordPress starts. This is why Wordfence recommends defense in depth: use the Wordfence Firewall together with prompt updates and security controls for PHP, the web server, the operating system, and the network edge. For these vulnerabilities, updating and restarting PHP is essential.

Conclusion

CVE-2026-109618 and CVE-2026-109619 are flaws in PHP, but WordPress runs on PHP. A fully updated WordPress installation can therefore remain exposed if the PHP service behind it has not been patched.

Install a fixed PHP package or a vendor package confirmed to contain both fixes. Restart PHP so all running processes use the new code, and verify the package serving the website.

Wordfence Care and Wordfence Response customers can contact our incident response team if they believe a site may have been compromised. Wordfence Response provides 24/7/365 availability with a one-hour response time.

If you know someone who manages WordPress sites, please share this article and ask them to verify the PHP service behind each site.

Sources

• PHP security release announcement
• PHP advisory: CVE-2026-109618, remote code execution through out-of-memory corruption
• PHP advisory: CVE-2026-109619, remote code execution through stale worker state
• PHP complete security patch
• Wordfence’s initial PHP security update PSA
• CrowdStrike’s PHP2Shell research and portability report

The post Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found appeared first on Wordfence.

Remote code execution means an attacker could run their own code on your server. “Unauthenticated” means they would not need to log in first. In its advance notice on October 20, the PHP security team rated both vulnerabilities 9.2 on the CVSS v4.0 scale, which falls in the Critical range.

Every WordPress site runs on PHP. These are vulnerabilities in PHP itself, not in WordPress, a plugin, or a theme, so WordPress automatic updates will not fix them. PHP has to be updated on the server.

The Wordfence Threat Intelligence team is investigating these vulnerabilities, and we will be posting updates as necessary.

Who Is Affected

According to the PHP security advisory, all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP project considers the risk highest for mod_php, where it has a demonstrated exploit in which an unauthenticated request can trigger the attack before any application code runs.

Fixed Versions

PHP 8.1 and older no longer receive updates from the PHP project. The PHP project says some Linux distributions and long-term support (LTS) vendors provide backported fixes, so contact your vendor, or upgrade to a supported version. The PHP security team has also published minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 for people who build PHP from source or don’t have access to an LTS vendor.

What to Do Now

• Check your PHP version. In your WordPress dashboard, go to Tools > Site Health, open the Info tab, and expand the Server section. If your PHP comes from a Linux distribution or LTS vendor, the version number may not change after patching, so confirm with your host or your vendor’s security notice.
• If your hosting provider manages PHP for you, contact them or check their status page to confirm they have updated to one of the fixed versions.
• If you manage your own server, make a backup, then install the updated PHP packages from your Linux distribution or LTS vendor. The PHP project says these vendors received the patches in advance. Source downloads and Windows source and binaries are on the PHP downloads page.
• If you use the volunteer-maintained remirepo repository (rpms.remirepo.net), check it for updated packages. The PHP security advisory said the repository would not have updates on October 21, but the PHP Foundation has since posted that its maintainer is now signing updated packages. The advisory also urges remirepo users to switch to distribution packages or build from source so they can apply updates immediately.

If You Can’t Update Immediately

The PHP project says only an update is a complete solution. For anyone who cannot update immediately, its advisory lists measures that reduce exposure to specific attack paths but do not make an installation safe. If you or your host need them, follow the exact instructions in the PHP security advisory.

The post PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now appeared first on Wordfence.

The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale.

PHP is the programming language WordPress is built on. Every WordPress site runs on a server with PHP installed, which means this release is relevant to every WordPress site owner, regardless of which plugins or themes they use.

The PHP team has not yet shared which versions are affected, what the vulnerabilities are, or which versions will contain the fix. Those details will be published with the release.

The team has also said it may ship the release earlier than scheduled if details of either vulnerability become public, or if it sees evidence of active exploitation.

There is nothing to install yet. What you can do today is find out who is responsible for updating PHP on your site, and make sure that update can happen quickly once the release is available.

Why This Matters for WordPress Sites

PHP is not part of WordPress itself. It is server software, usually installed and managed by your hosting provider. That has two practical consequences:

• WordPress automatic updates will not apply this fix. Updating WordPress, your plugins, or your themes does not change the version of PHP your server runs.
• Who applies the update depends on how your site is hosted. On most managed and shared hosting, the host updates PHP for you. On a VPS, dedicated server, or any server you administer yourself, you or your developer are responsible for installing the update.

A CVSS score measures how severe a vulnerability is on a scale of 0 to 10, and 9.2 falls in the Critical range. We don’t yet know how these vulnerabilities can be triggered, so we can’t say how easily they could be used against a WordPress site. Treat this as an update to apply as soon as it is available.

What We Know and What We Don’t

Confirmed by the PHP security team:

• A security release is scheduled for Wednesday, October 21, 2026 at 14:00 UTC.
• It addresses two critical vulnerabilities, each rated CVSS v4.0 9.2.
• The release may come earlier if vulnerability details become public or active exploitation is observed.

Not yet published: the affected PHP versions, the fixed version numbers, CVE identifiers, and technical details of either vulnerability. We will update this post when the release is out.

How to Check Your PHP Version

In your WordPress dashboard, go to Tools > Site Health, open the Info tab, and expand the Server section. The PHP version your site is running is listed there. According to the PHP project’s supported versions page, these branches currently receive security fixes:

• PHP 8.5 and PHP 8.4: active support
• PHP 8.3: security fixes only, until December 31, 2027
• PHP 8.2: security fixes only, until December 31, 2026

If your site runs PHP 8.1 or older, it is on a version that no longer receives security fixes from the PHP project. The PHP team has not said whether these vulnerabilities affect older versions, but unsupported versions should not be expected to receive a patch.

Ask your host about moving to a supported version, and test your site on that version first, because older plugins and themes can break on newer PHP.

What to Do Before the Release

• Find out who manages PHP on your server. If you use a hosting provider, check their status page or ask support whether they plan to apply the PHP security release and when. Many hosts update PHP automatically, but it’s worth confirming.
• If you manage your own server, plan a maintenance window for shortly after 14:00 UTC on Wednesday. If you install PHP from your operating system’s packages, a control panel, or container images, those updates may arrive on a different schedule from the official php.net release. Check with that source.
• Make a fresh backup of your site files and database before changing anything on the server, and confirm you can restore it.
• If you have a staging site, be ready to test the update there before applying it to your live site.
• Keep an eye on official channels. The php.net homepage will announce the release, and it may arrive early.

What Wordfence Is Doing

The Wordfence Threat Intelligence team is monitoring this release. Once the PHP team publishes details, we will review both vulnerabilities, assess how they could affect WordPress sites, and determine whether firewall protection is possible.

Some vulnerabilities in PHP itself can only be fixed by updating PHP, so updating your server remains the most important step whatever we find. We will update this post with affected versions, fixed versions, and our analysis as soon as the information is available.

Wordfence Care and Wordfence Response customers can contact our incident response team if they need help. Wordfence Care includes incident response during business hours, while Wordfence Response provides 24/7/365 availability with a one-hour response time.

Learn more about Wordfence Care and Wordfence Response.

Timeline

• October 20, 2026: The PHP security team announced an upcoming critical security release addressing two vulnerabilities rated CVSS v4.0 9.2.
• October 21, 2026, 14:00 UTC: Scheduled release of the PHP security update.

Conclusion

The PHP security team will release a fix for two critical PHP vulnerabilities on Wednesday, October 21, 2026 at 14:00 UTC, or sooner if details leak or exploitation begins.

Because PHP runs underneath every WordPress site, this update matters to every site owner, and it won’t arrive through WordPress updates. Today, check which PHP version your site runs, confirm whether your host or your own team will apply the update, and take a backup.

When the release lands, apply it as quickly as you safely can. We will update this post as soon as the PHP team publishes the affected and fixed versions.

The post PSA: Upcoming Critical PHP Security Release appeared first on Wordfence.

This is a second-order vulnerability. An unauthenticated attacker can place a malicious value in an ordinary WordPress comment, where it remains dormant. If an administrator later creates a Duplicator package containing that comment and uses the package to migrate the site, the standalone installer treats the stored value as a PHP object and activates it.

The consequences differ between the two editions. In Duplicator Free, the classes included with the affected installer can be combined to execute an attacker-selected operating-system command. In Duplicator Pro, a different built-in class can delete an attacker-selected file. We demonstrated that deleting wp-config.php can reopen the WordPress setup process and lead to site takeover and PHP code execution when the attacker reaches the setup process first and supplies a reachable database they control.

The Wordfence Threat Intelligence Team discovered this vulnerability with the help of Wordfence Argus, our AI-assisted security research system, during a WordPress 7.1 security assessment led and validated by Alex Thomas. With the team directing the research, Argus helped trace attacker-controlled data beyond the request that stored it and into a later administrator-driven migration, where the team identified and validated the different exploitation paths present in Duplicator Free and Duplicator Pro.

Our mission is to secure WordPress through defense in depth, which is why we invest in quality vulnerability research and work closely with plugin vendors to ensure vulnerabilities are addressed before they can be widely exploited. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element of a multi-layered approach to security.

We provided full disclosure details to the Duplicator team through our Wordfence Vulnerability Management Portal on August 31, 2026. The developer acknowledged the report on September 2, 2026, and released Duplicator 5.0.0 on September 8, 2026. On September 25, 2026, the developer informed us that version 5.0.0 contained the patch. We would like to commend the Duplicator team for addressing the vulnerable migration path.

The Wordfence Firewall’s built-in Generic Object Injection protection already provided a degree of protection against this vulnerability for all Wordfence users, including those using the free version of Wordfence. During further post-patch analysis, we identified opportunities to broaden that coverage. We therefore released an additional, vulnerability-specific firewall rule to Wordfence Premium, Wordfence Care, and Wordfence Response customers on October 15, 2026. Sites using the free version of Wordfence will receive the additional protection 30 days later, on November 14, 2026.

We urge users of both Duplicator Free and Duplicator Pro to update to version 5.0.0 or a newer version as soon as possible. Updating the plugin does not rebuild packages that already exist. An older package does not activate this vulnerability simply because it is stored, but it retains the installer supplied by the version that created it. Before using a package created with an affected release for a standard migration or import, create a fresh package with an updated version when practical. We discuss the tested restore behavior below.

Vulnerability Summary from Wordfence Intelligence

Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 – Unauthenticated PHP Object Injection

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-82814

Patch Status

Patched

Affected Software

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator]

Duplicator Pro [duplicator-pro]

Researchers

Alex Thomas

Wordfence Argus

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.

More Details >

Technical Analysis

Duplicator is a backup and migration plugin. It creates a package containing a site’s files and database, along with a standalone installer that can rebuild the site at a new location. During a standard migration, the installer updates values such as the old site URL and filesystem path so they match the destination.

Those replacements are more complicated when a database value contains PHP-serialized data. A serialized value records not only its data, but also information such as string lengths and class names. Changing a URL inside it without repairing those lengths can corrupt the value, so Duplicator’s migration engine tries to recognize and repair serialized data while it processes the database.

The vulnerability occurs because affected versions do not merely inspect a possible serialized value. The DUPX_UpdateEngine::unserializeTest() function passes the value to PHP’s native unserialize() function without restricting which classes may be created:

try {
    LogHandler::setMode(LogHandler::MODE_OFF);
    $unserialize_ret = @unserialize($data);
    LogHandler::setMode();
    return ($unserialize_ret !== false);
}

Calling unserialize() can construct objects named by the data and automatically run special methods such as __wakeup() and __destruct(). If the application includes a useful sequence of those methods, known as a gadget chain, attacker-controlled data can cause actions the developer never intended.

The migration engine scans text-like database columns and also recognizes values that are entirely base64-encoded. It decodes those values and subjects the decoded content to the same serialized-data checks. This means the attacker can store a comment that looks like encoded text while still delivering a PHP object to unserialize() during migration.

Why the payload can come from an anonymous comment

An attacker can submit a comment through WordPress’s public wp-comments-post.php endpoint without an account, cookie, or nonce. The comment body can contain the base64-encoded object. Approval is not required because a pending comment is still stored in the WordPress database and is included in the backup when an administrator builds a Duplicator package.

Nothing dangerous happens when the comment is submitted, and package creation only copies the stored value. The payload becomes active later, when an administrator uses that newly created package for a standard migration or import and the installer reaches its Update Data search-and-replace operation.

Duplicator Free: direct command execution

Duplicator Free 1.5.17 included an older version of the Requests library in its generated installer. Using Wordfence Argus, the team combined Duplicator’s DbUserMode class with Requests_Utility_FilteredIterator. When PHP reconstructs DbUserMode, its __wakeup() method iterates over attacker-controlled data. The Requests iterator then calls a callback stored in that data:

public function current() {
    $value = parent::current();
    $value = call_user_func($this->callback, $value);
    return $value;
}

Because both the callback and its argument come from the serialized comment, the attacker can select a PHP function such as system() and supply the command it should run. We confirmed direct operating-system command execution as the web-server user during a real migration. We also independently used the same chain to delete an arbitrary file.

Duplicator Pro: file deletion leading to site takeover

Duplicator Pro 4.6.10 contained a newer Requests library, so the Free-edition callback chain was not available. It did, however, include a different usable class in every generated installer: DuplicatorLibsIndexIndexList. Its destructor deletes the path stored in the object’s path property:

public function __destruct()
{
    if (is_resource($this->handle)) {
        fclose($this->handle);
    }

    if (file_exists($this->path)) {
        unlink($this->path);
    }
}

The affected migration engine allows the serialized comment to choose that path. We first validated the behavior by deleting test files. During further testing with Wordfence Argus, the team deleted wp-config.php on a disposable WordPress installation.

When WordPress cannot find wp-config.php, it exposes its normal setup process. An attacker who reaches that process first can connect the site to a database they control, create a new administrator, and use WordPress’s normal plugin installation functionality to execute PHP code. We completed this sequence and verified code execution with a proof-of-concept plugin.

This Pro path does not reveal the original site’s database or its credentials. The demonstrated takeover uses a separate database controlled by the attacker. It still gives the attacker control of WordPress running on the affected domain and filesystem.

Important Prerequisites and Boundaries

The attacker does not need an account, but the payload does not execute immediately. It must be stored before the administrator creates the package, and the administrator must later perform a standard migration or import that runs Duplicator’s database Update Data search-and-replace process.

Simply creating a backup does not trigger the vulnerability. We also did not demonstrate this chain through Duplicator’s restore or recovery modes, which do not use the same replacement engine. The validated trigger was a standard migration or import.

Comment moderation does not stop this chain because an unapproved comment is still stored and can be copied into a package. Disabling public comments removes the carrier we demonstrated, but it is not a substitute for updating because other attacker-controlled database content may also reach the vulnerable migration engine.

For the Pro file-deletion path, the target file must exist and the PHP process running the installer must be allowed to modify its containing directory. Turning deletion of wp-config.php into site takeover also requires the attacker to reach the setup process before the site owner and to provide a reachable database they control.

The Patch

The Duplicator team addressed the vulnerable migration path in version 5.0.0. The updated engine calls SnapUtil::safeUnserialize(), which asks PHP not to instantiate classes named by serialized data:

public static function safeUnserialize($data, &$value = null): bool
{
    $value = null;

    if (!is_scalar($data) && $data !== null) {
        return false;
    }

    $data = (string) $data;
    if ($data === 'b:0;') {
        // Legitimately serialized boolean false: unserialize() also returns false here.
        $value = false;
        return true;
    }

    try {
        $result = @unserialize($data, ['allowed_classes' => false]);
    } catch (Throwable $e) {
        return false;
    }

    if ($result === false) {
        return false;
    }

    $value = $result;
    return true;
}

In this disclosed migration caller, the returned value is used only to decide whether the input is valid and is then discarded. This prevents the attacker-supplied classes from being instantiated at the vulnerable point. Duplicator Free 5.0.0 also moved away from the older Requests component used by the direct command-execution chain.

We directly verified the fix in Duplicator Free 5.0.0. We also reviewed Duplicator Pro 5.0.5 and confirmed that its relevant security files are identical to the fixed Free implementation. The vendor confirmed that Duplicator Pro 5.0.0 received the same fix.

Wordfence Firewall

The Wordfence Firewall’s built-in Generic Object Injection protection already provided a degree of protection against this vulnerability for all Wordfence users. During further post-patch analysis, we identified opportunities to broaden that coverage and developed an additional, vulnerability-specific firewall rule. Wordfence Premium, Wordfence Care, and Wordfence Response customers received the additional rule on October 15, 2026. Sites using the free version of Wordfence will receive it on November 14, 2026.

The additional rule provides more targeted coverage for the exploitation chain by detecting malicious input before WordPress can store it for later processing during a Duplicator migration.

The following graphic demonstrates the exploitation sequence and the point at which the Wordfence Firewall interrupts it.

Disclosure Timeline

Conclusion

In this blog post, we detailed a high-severity Unauthenticated PHP Object Injection vulnerability in Duplicator Free through version 1.5.17 and Duplicator Pro through version 4.6.10. An unauthenticated attacker can place a malicious object in a WordPress comment and wait for an administrator to include it in a package and use that package for a standard migration.

The shared defect is unsafe deserialization during migration, but the two editions contain different paths to impact. Duplicator Free reaches direct operating-system command execution through its bundled Requests library. Duplicator Pro exposes arbitrary file deletion, which can be developed into site takeover and PHP execution under the conditions described above.

Users should update Duplicator Free and Duplicator Pro to version 5.0.0 or a newer version. They do not need to delete an older package solely because it was created with an affected release: the archive does not activate this vulnerability while it remains stored. However, it still contains its original installer, and a standard migration or import can reach that older vulnerable code. Create a fresh package with an updated version before a migration or import when practical, and remove publicly accessible standalone installer files that are no longer needed.

The Wordfence Firewall’s built-in Generic Object Injection protection provides a degree of protection against this vulnerability for all Wordfence users. Following further post-patch analysis, we developed an additional, vulnerability-specific rule to broaden that coverage. Wordfence Premium, Wordfence Care, and Wordfence Response customers received the additional rule on October 15, 2026. Sites using the free version of Wordfence will receive it on November 14, 2026.

This finding illustrates how the Wordfence Threat Intelligence Team uses Wordfence Argus to follow data across complete application workflows. The attacker’s request appears harmless when it arrives. The security impact appears only later, inside an administrator’s legitimate migration—a relationship that endpoint-by-endpoint testing can easily miss.

If you know someone who uses Duplicator on their site, we recommend sharing this advisory with them to help ensure their site remains secure.

The post Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator appeared first on Wordfence.

Public analysis by Nethemba and reports submitted directly to Wordfence have documented attackers using valid UpdraftCentral connection keys to send remote commands to connected WordPress sites. Those commands were used to upload, activate, and delete malicious plugins. Because the requests were properly signed with trusted keys, an UpdraftPlus installation that contained the earlier CVE-2026-10795 security fix could still accept them as legitimate UpdraftCentral instructions.

This does not mean that every website running UpdraftPlus was exposed. The UpdraftCentral remote-management client is included in both UpdraftPlus Free and UpdraftPlus Premium, but it does not accept UpdraftCentral commands unless a connection key exists on the site. The users most directly at risk are those whose sites were connected to TeamUpdraft’s cloud-hosted UpdraftCentral service.

The rule prevents both malicious and legitimate UpdraftCentral commands from reaching the plugin while older connection keys are being retired. The rule does not interfere with ordinary UpdraftPlus backups or backups sent to third-party storage providers.

TeamUpdraft has released UpdraftPlus 1.26.12 (Free) and UpdraftPlus 2.26.12 (Premium), which automatically disconnect UpdraftCentral connections created before the incident cutoff. We recommend updating every UpdraftPlus site to one of these versions or later.

Firewall protection cannot undo a compromise that occurred before the rule was deployed. UpdraftCentral users should still inspect every connected site and follow TeamUpdraft’s official incident guidance. TeamUpdraft says that page may be updated as its investigation continues, so it should remain the authoritative source for product-specific instructions.

Incident Summary

UpdraftCentral is a remote-management service that can manage backups, plugins, themes, users, and other WordPress functionality from a central dashboard. When a site is connected, the site and dashboard establish cryptographic keys. UpdraftPlus then accepts commands signed by the trusted dashboard key and runs them with the permissions of the WordPress user who created the connection.

Publicly analyzed attacks used the plugin.upload_plugin command to install a supplied plugin archive. Where the connected WordPress user had permission to install and activate plugins, that command provided the attacker with a path to execute malicious PHP on the site.

The defining issue in this incident is the compromise and misuse of legitimate UpdraftCentral connection keys. A request signed with an exposed key could pass the plugin’s normal authentication checks and be treated by the connected site as a trusted remote-management instruction.

Reports submitted to Wordfence describe successful malicious plugin installations on UpdraftPlus Premium 2.26.11.x and on another site known to have been running UpdraftPlus Free 1.26.10 or 1.26.11 at the time of the activity. These reports reinforce that sites with an exposed cloud UpdraftCentral connection could be affected even when they were running recent plugin versions.

TeamUpdraft says the UpdraftPlus plugin and its downloadable packages were not affected. It also says backups sent to a user’s own Google Drive, Dropbox, Amazon S3, or other third-party remote storage were not affected, and that self-hosted UpdraftCentral installations were not affected by the compromise of teamupdraft.com. However, if a site was accessed through UpdraftCentral, TeamUpdraft recommends re-authorizing its remote storage and changing any storage access keys as a precaution.

According to TeamUpdraft, the customer database contained names, email addresses, billing addresses, order histories, password hashes, and two-factor authentication settings. The company says passwords were not stored in plain text and that it does not store payment-card details because payments are handled by Stripe and PayPal. TeamUpdraft nevertheless advises every teamupdraft.com account holder to change their password, change it anywhere it was reused, and reset their TeamUpdraft two-factor authentication settings.

Who May Be Affected?

A website may be affected if all of the following are true:

• The site had UpdraftPlus Free or UpdraftPlus Premium installed and active while the affected UpdraftCentral connection key remained present.
• The site has, or had during the incident, an active connection key for TeamUpdraft’s cloud-hosted UpdraftCentral service.

Unless an effective firewall rule blocks the channel or UpdraftPlus 1.26.12 (Free) or 2.26.12 (Premium) has removed it, a site with an old key that still exists locally can continue accepting commands correctly signed with that key. Deleting the key stops future UpdraftCentral commands but does not erase activity that may already have occurred.

Installing the free UpdraftPlus plugin does not, by itself, automatically connect a site to UpdraftCentral. However, UpdraftPlus 1.26.11 presents an option to add the website to UpdraftCentral when a user connects a TeamUpdraft account, and that option is selected by default. A site can therefore have an UpdraftCentral connection even if its owner did not separately visit the UpdraftCentral dashboard or does not remember deliberately enabling remote management.

Both free and Premium users should check if they have ever connected the plugin to a TeamUpdraft account. TeamUpdraft’s official guidance says free UpdraftPlus users who do not have a teamupdraft.com account do not need to take action for this incident.

How to Check Whether a Site Has an UpdraftCentral Key

Log in directly to the site’s own WordPress dashboard. Do not perform this check through UpdraftCentral.

Navigate to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. If the page shows Manage existing keys (N) with one or more keys, the site is or was configured to accept UpdraftCentral commands and should be treated as potentially exposed.

At the database level, these connections are stored in the WordPress option named updraft_central_localkeys. After WordPress deserializes the option value, an array containing one or more key entries indicates that at least one local UpdraftCentral connection exists. An empty array does not. Do not post or send populated option contents publicly because they contain sensitive key material.

The absence of a current key does not prove that no malicious command was previously received. If a key was recently deleted, continue with the log, plugin, user, and file checks below.

What Wordfence Is Doing

Wordfence Premium, Wordfence Care, and Wordfence Response customers received a real-time firewall rule that acts as a temporary kill switch for the affected UpdraftCentral command channel. Given the severity of this incident, we also made the rule available early to Wordfence Free users, just a few hours later. The rule blocks inbound UpdraftCentral UDRPC requests on UpdraftPlus Free versions up to and including 1.26.11 and on UpdraftPlus Premium versions that predate 2.26.12.

Wordfence users should manually refresh their firewall rules now, as described at the top of this post. If your site uses UpdraftCentral, you should still delete its connection keys and complete the checks below, because the firewall rule cannot undo activity that occurred before it was deployed.

The rule is narrowly scoped to the affected cloud UpdraftCentral command channel. It does not interfere with ordinary backups, restores, or backups sent to third-party remote storage providers. It does temporarily block legitimate cloud UpdraftCentral management commands on affected versions, so a protected site may appear unavailable in UpdraftCentral until it is running UpdraftPlus 1.26.12 (Free) or 2.26.12 (Premium) or later.

TeamUpdraft has released emergency versions of UpdraftPlus, UpdraftPlus 1.26.12 (Free) and 2.26.12 (Premium), that automatically disconnect UpdraftCentral connections created before 21:00 UTC (22:00 BST) on October 18, 2026. TeamUpdraft says connections made afterward using its manual reconnection steps will not be disconnected. Update to UpdraftPlus 1.26.12 or 2.26.12 or later now, logging in to each site’s own WordPress dashboard rather than updating through UpdraftCentral, and do not treat the update as a substitute for inspecting and securing a connected site.

The firewall rule prevents future inbound commands on covered versions. It cannot remove a malicious plugin, account, scheduled task, or other persistence that may already exist.

What UpdraftCentral Users Should Do Now

TeamUpdraft’s published guidance provides the minimum containment steps. The additional checks below are important because once malicious PHP has executed, the WordPress dashboard is not an independent source of truth. Malware can filter the Users and Plugins screens, conceal a Must-Use plugin, or grant powerful capabilities to an account whose visible role appears harmless. Complete these steps separately on every connected website:

1. Log in directly to the site’s WordPress dashboard rather than through UpdraftCentral.
2. Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete every existing connection key.
3. From a known-clean device, change the teamupdraft.com password by typing the address directly into the browser. Change the password anywhere else it was reused, and reset TeamUpdraft two-factor authentication in My Account if it was enabled. Be cautious of unexpected messages claiming to be from TeamUpdraft; the company says it will never ask for your password or connection keys.
4. Before removing suspicious files or accounts, preserve the UpdraftCentral log, web-server access logs, PHP error logs, and copies of suspicious files when practical. Record recently modified files and the current plugin and user lists. This evidence may be needed to determine what the attacker changed.
5. Update UpdraftPlus to 1.26.12 (Free) or 2.26.12 (Premium) or later. The update disconnects old UpdraftCentral connections, but it does not remove anything an attacker may already have installed, so complete the remaining checks as well.
6. Run a Wordfence scan. Use the High Sensitivity scan type when compromise is suspected, and review every result involving malware, unknown or modified files, skipped paths, suspicious options, or administrator accounts created outside the normal WordPress interface. High Sensitivity scanning can produce false positives, so investigate results before deleting or repairing files. A clean scan is useful evidence, but it does not prove by itself that the site is clean.
7. Inspect the filesystem independently through your hosting control panel, SFTP, or SSH. Do not rely only on the WordPress Plugins screen. Review wp-content/plugins, wp-content/mu-plugins, wp-content/upgrade, themes, uploads containing executable files, WordPress root files, and PHP files in wp-admin and wp-includes. Check WordPress drop-ins such as advanced-cache.php, db.php, object-cache.php, and sunrise.php when present. Compare WordPress, plugin, and theme files with known-clean copies from trusted sources, and investigate files created or modified around the incident.
8. Inspect accounts independently of the WordPress Users screen. Review the site’s user and user-metadata records through a trusted database or hosting tool, including effective capabilities, active sessions, and application passwords. On multisite installations, also review network users and super administrators. One publicly analyzed malware family could grant administrator-like capabilities to an account labeled as an Editor. A second, working variant can hide a full administrator from normal dashboard queries or authenticate the attacker as an existing administrator without creating a new account.
9. Review UpdraftCentral, web-server, and security logs for the commands and network indicators listed below. Determine whether an upload or deletion command was received, whether a plugin was written or activated, and what requests followed it.
10. If you find suspicious activity or cannot independently establish the site’s integrity, do not treat removal of a visible plugin or user as sufficient. Restore the website and database from a verified clean backup created before October 17, 2026, reinstall WordPress core, plugins, and themes from trusted sources as appropriate, and complete a full incident investigation.
11. After the site has been inspected and any required cleanup or restoration is complete, change every WordPress administrator password and end existing sessions. If the site was compromised, also rotate hosting, file-transfer, database, and application credentials that the compromised site could access.
12. Reconnect the site with a new UpdraftCentral key only after the checks and any required cleanup are complete. Sites covered by Wordfence’s temporary firewall rule may not accept UpdraftCentral commands until UpdraftPlus 1.26.12 (Free) or 2.26.12 (Premium) or later is installed. TeamUpdraft says newly created connections will not be removed by that update.

If you find any indicator of compromise, or cannot independently complete the filesystem and database checks above, we recommend contacting Wordfence for professional investigation and cleanup. Wordfence Care and Wordfence Response customers can request hands-on incident response and malware removal from our security team.

Deleting a site only from the cloud UpdraftCentral dashboard is not a substitute for deleting the key on the WordPress site itself. The local key determines whether the site will accept a signed command.

It is necessary to both change passwords and remove UpdraftCentral connection keys for connected sites.

Guidance for UpdraftVault and UpdraftClone Users

TeamUpdraft says it disconnected every site from UpdraftVault and issued new credentials. UpdraftVault backups will not resume until the service is reconnected. In the site’s WordPress dashboard, go to Settings > UpdraftPlus > Settings, select UpdraftVault under remote storage, use Already got space? > Connect, enter the TeamUpdraft account email and new password, save the settings, and run a manual backup to confirm that storage is working.

TeamUpdraft also says every UpdraftClone client key has been replaced. Users who never created a client key do not need to act. Users who shared keys with clients should retrieve the replacements from My Account > UpdraftClone > UpdraftClone Key Management and distribute the new keys. Clones using an old key will fail.

UpdraftCentral, UpdraftVault, and UpdraftClone use separate credentials, and TeamUpdraft has issued product-specific response steps for each service. Wordfence’s emergency firewall rule addresses the affected cloud UpdraftCentral command channel used in the publicly observed attacks.

Indicators of Compromise

The following indicators come from public analysis by Nethemba, corroborating reports in the WordPress.org UpdraftPlus support forum (report one, report two), and incident reports submitted directly to Wordfence. The attacker varied plugin names and other details, so these indicators should be used together. Their absence does not prove that a connected website is clean.

UpdraftCentral Logs

In Settings > UpdraftPlus > Advanced Tools > UpdraftCentral, review recent UpdraftCentral log events. Investigate entries containing:

• probe.central.updraftplus.com
• Command received: plugin.upload_plugin
• Command received: plugin.delete_plugin

A received upload command does not necessarily mean that activation succeeded, but it does mean the site received an attempt through the UpdraftCentral channel. UpdraftPlus retains only a limited number of recent Central log events, so older activity may no longer appear.

Network Indicators

Public reports and incident reports submitted to Wordfence associated the campaign with the following source addresses:

• 43.250.53.42
• 2a09:bac5:4e21:2e3c::49b:9

Observed malicious requests used the exact User-Agent WordPress/6.4; class-udrpc.php. Legitimate TeamUpdraft traffic publicly analyzed by Nethemba included a UDRPC library version and the teamupdraft.com URL in the User-Agent. Attackers can change IP addresses and headers, so blocking or searching for these values alone is not sufficient.

The working malware variant was triggered through a request to the site root containing a query-string parameter whose name consisted of 12 hexadecimal characters and whose value was a 32-character token. In some cases, a successful request may be followed by a redirect and authenticated administrator activity. Treat this as a log-hunting pattern rather than proof by itself, and correlate it with unexpected plugin installation, file creation, or administrator activity.

Malicious Plugins

One high-confidence indicator for the first publicly analyzed malware family is the description:

Small maintenance toolkit: keeps option storage tidy.

The analyzed plugins used randomized-looking names. Public examples include Load Stack 35C, Text Gantry Eb0, and style-bridge-8f5. Additional names reported directly to Wordfence include speed-press-23b, hero-bridge-6c9, site-health-6a20, db-works-7dba, cache-frame, and site-engine. Defenders should not rely on names alone. Investigate any plugin that appeared without a corresponding authorized administrator action, particularly around October 18-19, 2026.

Some analyzed samples contained a coding error that caused HTTP 500 responses and WordPress “critical error” messages naming an unfamiliar plugin. A site continuing to work normally does not rule out compromise; not every installation or activation produced the same visible failure.

Nethemba has since confirmed a second, working variant whose names and descriptions change between samples. This variant can hide an administrator from the WordPress Users screen or authenticate the attacker as the first existing administrator without creating a new account, in which case the plugin file and web-server access log may be the only remaining evidence. Stable code-level indicators in analyzed samples include a call to wp_set_auth_cookie() after hash_equals() validates a query-string value, along with pre_user_query and pre_count_users hooks used to hide a created account. This is why description-only malware signatures and dashboard-only inspections are insufficient.

Selected Malware File Hashes

The following newly confirmed SHA-256 hashes identify exact files observed in this campaign. They will not detect renamed or newly generated samples, and this is not an exhaustive list:

• opt4fix 2.9.2: 54ca7b2da87852a5d1fd7bde644027f84557db4d45fbb25cb2d135a3497d8d5c
• js-fix-757a 2.8.3: 2cdf3f2a3f10f0e12f00f2267907d44796107ab4aececdac520bba13e012b47a
• lazy-tool-3055 1.3.8: 1821a58e2a851acd1a608a77ce2f77817a0b7b6ef344b9889c8f8728e62969ec
• cache-smith 1.3.1: 43dc88fd18501be3dbd6d7f1755e77386d081dd41cef82bc514d39991ae69c49
• style-bridge-8f5 2.6.6: 0290c2baa363eac72ef2b6891bef1c9c8b4774d5b95d14f4871bde6094fdacde
• style-bridge-8f5/uninstall.php: 99a7fb44d1502938a40b3f663f4e5771b5cf741bcbaec58d7dda0b5066b5a0a5

Users and Database Options

Publicly analyzed samples attempted to create a user that appeared to have the Editor role while separately granting capabilities such as manage_options and install_plugins. Reported supporting indicators include:

• The display name Site Tools
• Usernames such as data-ops43, media-staff96, site_editor784, site.crew51, or web_desk9
• Email addresses using @example.org
• A WordPress option whose name ends in _sync_token
• An unfamiliar plugin-associated option whose name ends in _uid or _installed

The malware could vary these values, and working-variant accounts have also used addresses ending in @example.com. Review the effective capabilities of every unfamiliar user, not just the role label shown in the WordPress Users screen. The working variant may instead hide a full administrator or reuse the first existing administrator without creating a new account, so the absence of an unfamiliar database user does not rule out successful exploitation.

What to Do If You Find Evidence of Compromise

Delete the site’s UpdraftCentral connection keys first so the exposed channel cannot be used to send another command. Preserve relevant logs and suspicious files for investigation when practical, then remove unauthorized plugins and accounts.

Because a malicious plugin can execute arbitrary PHP with the web server’s permissions, deleting the visible plugin alone is not enough to establish that the site is clean. Restore the website and database from a known-clean backup created before October 17, 2026 when possible. Otherwise, have an experienced security professional inspect the WordPress files, database, administrator and application-password records, Must-Use plugins, scheduled events, server-level scheduled tasks, and other writable locations.

After cleanup, change WordPress administrator passwords, end existing sessions, and rotate WordPress security salts, hosting and file-transfer credentials, database credentials, remote backup storage authorizations and access keys, and any application or API secrets the compromised website could access. Re-enable or reset two-factor authentication where applicable. If the TeamUpdraft password and two-factor authentication reset was not completed earlier from a known-clean device, complete it now.

Wordfence Care and Wordfence Response customers can contact our incident response team for hands-on investigation and malware removal. Wordfence Care includes incident response during business hours, while Wordfence Response provides 24/7/365 availability with a one-hour response time. Learn more about Wordfence Care and Wordfence Response.

Timeline

• October 17-18, 2026: TeamUpdraft identified unauthorized access to teamupdraft.com.
• October 19, 2026: Nethemba published its analysis after detecting signed UpdraftCentral commands and malicious plugin installations on connected sites.
• October 19, 2026: Wordfence received multiple customer reports describing malicious plugins installed through the UpdraftCentral UDRPC channel on connected sites.
• October 19, 2026: TeamUpdraft published its official incident advisory, said it had closed the access route, deployed a fix for the underlying weakness, signed out accounts, rotated affected credentials and its keys with payment providers and other connected services, disconnected Vault sites, replaced Clone client keys, added monitoring, reported the incident to the UK Information Commissioner’s Office (ICO), and started preparing an emergency UpdraftPlus release.
• October 19, 2026: TeamUpdraft released UpdraftPlus 1.26.12 (Free) and 2.26.12 (Premium), which automatically disconnect UpdraftCentral connections created before 22:00 BST on October 18, 2026.
• October 19, 2026: Wordfence deployed emergency firewall protection to Wordfence Premium, Wordfence Care, and Wordfence Response customers to block inbound UpdraftCentral UDRPC commands on affected UpdraftPlus versions.
• October 19, 2026: Given the severity of the attack, Wordfence made the same firewall rule available early to Wordfence Free users, a few hours after premium customers received it.

Conclusion

TeamUpdraft disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information.

This incident affects the trust relationship between TeamUpdraft’s cloud-hosted UpdraftCentral service and connected WordPress sites. It does not affect every installation of UpdraftPlus, and it is not evidence that UpdraftPlus plugin downloads or third-party backup storage were compromised. The primary site-level risk applies where a cloud UpdraftCentral connection key existed.

If your site has or recently had such a key, log in to the site directly, remove every old key, reset the TeamUpdraft password and two-factor authentication from a known-clean device, and investigate the indicators above. If anything suspicious is present, restore from a known-clean backup created before October 17 or complete a professional cleanup and full incident response. After the site is known clean, change WordPress administrator passwords, end existing sessions, and rotate any other credentials the compromised site could access. Follow TeamUpdraft’s current guidance when reconnecting with a new key, and update UpdraftPlus to 1.26.12 (Free) or 2.26.12 (Premium) or later. Sites under Wordfence’s temporary firewall protection may not accept the new UpdraftCentral connection until that update is installed.

Wordfence Premium, Wordfence Care, and Wordfence Response customers are protected against new inbound UpdraftCentral UDRPC requests on affected versions by our emergency firewall rule, and sites running Wordfence Free can now get the same protection. Wordfence users can manually refresh their firewall rules to get it immediately. That protection is an important containment measure, but it should be combined with the vendor’s key-rotation steps and a review for activity that may have occurred before the rule was deployed.

The post PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites appeared first on Wordfence.

If an affected copy of Rank Math SEO PRO 3.0.123 was active on your website, you should treat the website as compromised. Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.

Rank Math removed the affected files and released version 3.0.124 as the clean replacement. Version 3.0.123 by itself does not prove that a website was compromised: Rank Math limits the incident to users who downloaded or updated to the affected version during the stated period.

Website owners should check when version 3.0.123 was downloaded or installed, follow the recovery guidance below, and use Rank Math’s security notice as the authoritative source for updates about this incident.

Vulnerability Summary from Wordfence Intelligence

Who Is Affected?

Your website may be affected if it downloaded or updated to Rank Math SEO PRO 3.0.123 during the following period:

• Start: October 15, 2026 at 20:02 UTC
• End: October 16, 2026 at 07:12 UTC

Rank Math provides the following guidance:

• If you installed and activated an affected copy of version 3.0.123, treat the website as compromised and complete a full recovery.
• If you installed version 3.0.123 but never activated it, delete the affected plugin files, install version 3.0.124 from your Rank Math account, and run a security scan.
• If you downloaded version 3.0.123 but never installed or activated it, Rank Math says there is no indication from this incident alone that your website was compromised.

Rank Math says it has records identifying users who downloaded an affected copy. If Rank Math notified you, follow its recovery instructions even if your website is now running a different version.

What Website Owners Should Do Now

If an affected copy was activated, Rank Math recommends restoring the website and its database from a clean backup created before October 15, 2026 at 20:02 UTC. After restoring the backup, scan the website, replace passwords and other sensitive credentials that the website could access, and then install Rank Math SEO PRO 3.0.124 directly from your Rank Math account.

If a suitable backup is not available, Rank Math advises having the website cleaned manually. This work should be performed by an experienced security professional or hosting provider if you are not comfortable working with website files, the database, and server settings.

Before removing other suspicious files, complete the following steps to prevent the malware from recreating its hidden backdoor when someone visits the website:

1. Delete the entire rank-math-pro plugin folder. Deactivating the plugin is not enough.
2. Delete any entry in the WordPress wp_options database table whose option_name is _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c.
3. Block outgoing connections to rank1cdn[.]com if your hosting provider or firewall supports it.

Once the mechanism that recreates the malware has been disabled, check the rest of the website and server for the signs listed below. Reinstall WordPress, plugins, and themes from trusted sources where appropriate.

Changing passwords is essential even if the site is restored from a backup. Rank Math recommends replacing WordPress passwords, database credentials, WordPress security keys and salts, payment and email service credentials, API keys, hosting control-panel credentials, and FTP, SFTP, or SSH credentials that may have been accessible to the website. Review two-factor authentication settings for administrator accounts as well.

What the Malware Can Do

Rank Math states that the affected plugin files contained malware that could compromise a website when the plugin was activated. The company warns that the malware can recreate a hidden backdoor when the website is visited and that the attacker may have left additional files, unauthorized administrator accounts, scheduled tasks, or server-level changes behind.

Rank Math advises site owners to assume that credentials and secrets accessible to the compromised website may have been exposed. This includes WordPress passwords, database credentials, API keys, and other stored secrets. Updating to version 3.0.124 replaces the affected Rank Math package, but it does not remove files, accounts, or scheduled tasks that the malware may already have created elsewhere.

Indicators of Compromise

The following signs come from Rank Math’s security notice. Their presence should be investigated. Their absence does not, by itself, prove that a website is clean.

Network Activity

• Outgoing connections to rank1cdn[.]com

WordPress Database

• An entry in the wp_options table named _uf6qdn2hmm
• An entry in the wp_options table named t8krdk990phb
• An entry in the wp_options table named _np5pvf754c

Administrator Accounts

• Unknown administrator usernames beginning with wpsupport_
• Unknown accounts using an email address ending in @wp-mail[.]net

Files and Server Changes

• wp-includes/class-wp-cache-util.php. Rank Math states that this is not a legitimate WordPress core file.
• PHP files in unexpected locations, including wp-content/mu-plugins/, folders belonging to other plugins, the inc/, includes/, and lib/ folders of non-default themes, and the Rank Math includes/ folder.
• Suspicious PHP code containing base64_decode with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code.
• Rules in a root or subdirectory .htaccess file that allow .cache files to run as PHP.
• .cache files containing PHP code.
• System scheduled tasks for the web server user containing the marker #ms6v46.
• Unexpected PHP files in the WordPress uploads directory.

Rank Math also recommends reviewing WordPress scheduled events, SSH authorized keys, scheduled tasks belonging to other system users, running processes, and locations outside the website directory where the web server can write files.

How to Verify the Website After Cleanup

After recovery, run a full security scan and continue watching the website for unusual behavior. Rank Math specifically recommends checking WordPress core files with:

wp core verify-checksums

Plugin files can be checked with:

wp plugin verify-checksums --all

Checksums are not available for every premium plugin, so compare those files with a clean copy downloaded directly from the developer. Monitor outgoing connections and confirm that removed files do not return. If suspicious files reappear, the cleanup is incomplete.

Download Rank Math SEO PRO 3.0.124 by navigating directly to rankmath.com and signing in to your account. Rank Math says it will not send login or download links by email, so treat unexpected messages containing those links as suspicious.

Timeline

• October 15, 2026 at 20:02 UTC: The affected download and update period began.
• October 16, 2026 at 07:12 UTC: The affected period ended.
• October 16, 2026: Rank Math published its security notice and directed affected users to install the clean version, 3.0.124, after completing the appropriate recovery steps.

Conclusion

Rank Math says this incident affected a limited number of users who downloaded or updated to Rank Math SEO PRO 3.0.123 during a specific period. Version 3.0.123 alone is not evidence that a website was compromised. However, any website on which an affected copy was active should be treated as compromised.

If your site may be affected, first establish when version 3.0.123 was obtained. If an affected copy was active, restore the website and database from a clean backup created before the incident whenever possible. If no suitable backup is available, follow Rank Math’s manual-cleanup steps in the stated order. In either case, replace exposed credentials and other secrets, install the clean version 3.0.124, scan the full website and server, and monitor for signs that the malware has returned.

Wordfence Care and Wordfence Response customers can contact our team for help investigating and cleaning a compromised website. Our incident response team can identify and remove malware, help determine the cause of an infection, and assist with the recovery process. Learn more about Wordfence Care and Wordfence Response.

The post PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads appeared first on Wordfence.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• WordPress Core 7.1 – 7.1.2 – Unauthenticated Stored Cross-Site Scripting via Pending Comments
• Abandoned Cart Pro for WooCommerce <= 10.8.0 – Unauthenticated SQL Injection via Guest Persistent Cart meta_value

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Total Vulnerabilities by CVSS Severity Last Week

Total Vulnerabilities by CWE Type Last Week

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Ananda Dhakal	61
João Pedro S Alcântara	42
Bonds	26
Wordfence PRISM	26
Naoki Kawahigashi	19
Tran Nguyen Bao Khanh	18
Intrudify	16
Enrico Marcolini	16
johska	15
Peter Tang	13
Karthik Ramakrishnan	12
Rafie Muhammad	10
Jamaal ahmed	8
Pablo González Pérez	7
Francisco José Ramírez Vicente	7
Iñigo Sánchez Enciso	7
Erwan LR	7
dutafi	7
nh4tvd	6
Yaswanth Reddy Sunkara	6
Raphael P. Cigana	6
neurotx	6
ParkHyunWoo	6
Asim Alshaya	6
daroo	6
V1T	5
Supakiad S. (m3ez)	5
Jakub Herman	5
JunHee CHO	5
Ryan Fabella	4
Kuba	4
Morato Antoine	4
Nguyen Ba Khanh	4
Usama Arshad	4
Aydan Arabadzha	4
Adrien Brunner	4
d.v4n_s3c	4
John Ryan Albon	4
Muni Nitish Kumar Yaddala	4
Pedro Pinho	3
crow	3
zickzick2	3
Jacek Sowiński (dzaku)	3
Claudio Marchesini	3
Dottor Marc	3
Philipp Doblhofer	3
dodoh4t	3
Deva Parekh	3
João Ramos Maciel	3
Ayukiab	3
Anthropic	3
theviper17y	3
hhhai	2
Ratchanon Chamnankit	2
Tarcísio Luchesi De Almeida Silva (Poystick)	2
Daniel Dhaniswara	2
Tai Ha (superx)	2
Erik Debye	2
vuxvinh	2
Omar Elshopky (3l5h0pky)	2
elaprendiz1927	2
0xd4rk5id3	2
Nixxies	2
b1ue0cean	2
Osman Hussein	2
sungbyeongchan	2
Rik de Kok	2
dcs	2
Tarcísio Luchesi	2
Joshua Martinelle	2
Rasyid Abdi Gantoro	2
Mohammed Abd Alrahman	2
dzeusking	2
Theo Fonseca	2
Sawyer	2
she11f	2
achmad sonif	2
Ivaylo	2
Lee chul woong	2
Wordfence Argus	2
RIA Labs	2
Artus KG	2
Stefan Löwen	2
Coopernicus	2
Maciej Komorowski	2
takito	2
Filip Kowalski	2
Webbernaut	2
Nguyen Dinh Hai (HaiND)	2
Andy Urlep	1
Olaf Schigt	1
Abdullah Kareem “cyberkareem”	1
Supakiad S.	1
Que Thanh Tuan	1
Utkarsh Choudhary	1
Nadir Şensoy	1
0xzenko	1
braintx	1
Kamil B.	1
Alexander Jurkschat	1
mamgad	1
lhking	1
Aliou Cisse (KevineCharles)	1
blast	1
benzdeus	1
Jonah Burgess (CryptoCat)	1
Ayoub MOUHATTA	1
Shikhali Jamalzade	1
Suhayb Ahmed	1
Aarush Gaur	1
ShinThink	1
Je22y	1
Quentin VILLAIN	1
KePulsary	1
Ala Bouali	1
nguyen viet tin	1
Hippolyte Quéré (Hippie) (Hippie)	1
buitu	1
Raúl Conesa	1
Sanyam Jain	1
UKO	1
luffy	1
mamgad	1
Dahmani Toumi	1
Masaya Morita	1
Seongwon Lee	1
Doston Abdullayev	1
Krugov Artyom	1
George Chen	1
Thomas Chauchefoin	1
Guntur Wahyu Ramadhan	1
Santh	1
etomixer	1
Mohamed Bassia	1
yzx001	1
Paul Serban	1
Claude Ndanda	1
Kenneth Billones	1
K. Sorrachat	1
Muni Nitish Kumar Yaddala (Stranger825)	1
wachirapong kamphapong (wachiss)	1
LevinityCyber	1
Duy Tran	1
Trithem	1
Dthangws	1
L4m	1
whatm	1
t4g0	1
Aurélien BOURDOIS	1
Md. Moniruzzaman Prodhan	1
normaandersonfrank	1
Thaer Assfour	1
Zhengyu Liu	1
Jingcheng Yang	1
Gavin Zhong	1
Boluwatife Opeyemi (tcyph3r)	1
Bhaveshkumar Parmar	1
Spy0x7	1
Sebastian Albrecht (mySebbe)	1
emiliano carrizo	1
owlmind	1
duna	1
Muhammad Yudha	1
HOMEVO Adonis Orfel	1
Oly Hossen	1
Zac Lou	1
Alex Thomas	1
Salúa Es-sair	1
Athiwat Tiprasaharn (Jitlada)	1
刀 妖	1
c4st1e	1
Md. Minaruzzaman Shovon	1
nthng	1
Tawatchai Pinsuwan	1
Kitch	1
Bao	1
T.Kalimullin	1
fcc	1
Muhammad Yudha – DJ	1
Muhammad Sobirov	1
Stefan Spasic	1
changsheng	1
sahinyes	1
Mytears	1
Timur Jurayev	1
Raj Ukani	1
Dustin Lange	1
Sarthak Saxena	1
zaim	1
awhacken	1
Teerachai Somprasong	1
hackthesoul	1
Thanh Hang	1
shark3y	1
William Honnér	1
Hiro	1
HunterSploit	1
Ayush Srivastava	1
Filip Kecman	1
Akbarov Rauf	1
20kilograma	1
Rafael Honorato	1
Jonathan Dersch	1
Taylsec	1
Muhamad Visat	1
Nguyen Kim Sang	1
Khaled Alenazi	1
uhcna	1
wackydawg	1
Brian Mungai	1
Alex Concha	1
Phat RiO | João Pedro S Alcântara	1
Enis Getmez	1
Averon Averenkov	1
Akshat Parikh	1
ieuns	1
endy	1
R3D	1
Chloe Chamberland	1
cazy	1
Pedro “TheZakMan” Araujo	1
Zenith-sec	1
Het Kalariya	1
Matthew Lapinski	1
stealthcopter	1
skyv3il	1
AmonRa	1
Yuvraj Tomar	1
Michał Wiencek	1
Vũ Quang Huy	1
Ismayil Tahmazov	1
Zein	1
myhappyhoon	1
Mike Gozdiskowski	1
jydae	1
longnv719	1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

WordPress Themes with Reported Vulnerabilities Last Week

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

3D Product configurator for WooCommerce <= 2.16.2 – Unauthenticated Remote Code Execution via ‘xpv_image’ Parameter

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-103889

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

3D Product configurator for WooCommerce [expivi]

Researcher

Osman Hussein

More Details >

Advanced IP Blocker <= 8.13.13 – Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-104732

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Advanced IP Blocker [advanced-ip-blocker]

Researcher

Wordfence PRISM

More Details >

Anton Extensions <= 1.2.2 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-104028

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Anton Extensions [4nton-extensions]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

More Details >

Bricksforge <= 3.1.8.9 – Unauthenticated Arbitrary File Upload via ‘temporaryFileUploads’ Parameter

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-85097

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Bricksforge [bricksforge]

Researcher

d.v4n_s3c

More Details >

Doctreat – Hospitals and Doctors Directory WordPress Listing Theme <= 1.7.0 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-39770

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Doctreat – Hospitals and Doctors Directory WordPress Listing Theme [doctreat]

Researcher

Jamaal ahmed

More Details >

Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.13 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-39802

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin [everest-backup]

Researcher

Muhammad Sobirov

More Details >

Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 – Unauthenticated Arbitrary File Upload via Signature Field File Upload

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-94589

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) [extensions-for-cf7]

Researcher

Osman Hussein

More Details >

Freeton WP <= 1.0.0 – Unauthenticated Privilege Escalation via Account Takeover

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-84737

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Freeton WP [freeton-wp]

Researcher

Naoki Kawahigashi

More Details >

Mindstien Quick Login <= 1.0 – Unauthenticated Privilege Escalation via Account Takeover

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-84734

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Mindstien Quick Login [mindstien-quick-login]

Researcher

Naoki Kawahigashi

More Details >

SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-42696

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

SiteVault – Backup, Restore, Migration & Cloning [sitevault-backup-restore-migration]

Researcher

Ananda Dhakal

More Details >

SMS Alert <= 4.0.0 – Unauthenticated Arbitrary Account Takeover

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-94256

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]

Researcher

Raphael P. Cigana

More Details >

Tailored Tools <= 3.0.3 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-62025

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Tailored Tools [tailored-tools]

Researcher

V1T

More Details >

Tonda Membership <= 1.0.1 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-62022

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Tonda Membership [tonda-membership]

Researcher

Tran Nguyen Bao Khanh

More Details >

Tourfic Pro <= 1.17.3 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-39774

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Tourfic Pro [tourfic-pro]

Researcher

Jamaal ahmed

More Details >

WPCOM Member <= 1.7.27 – Unauthenticated Authentication Bypass via ‘uuid’ and ‘code’ Parameters on Social-Login Callback

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-104803

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WPCOM Member [wpcom-member]

Researcher

mamgad

More Details >

Avada (Fusion) Builder <= 3.16.1 – Unauthenticated Arbitrary WordPress Action Invocation via ‘{action_hook}’ Dynamic-Data Token in Form Field

9.1

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-97670

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researchers

Chloe Chamberland

Wordfence Argus

More Details >

Blocksy Companion <= 2.1.58 – Unauthenticated Privilege Escalation to ‘role’ Parameter

9.1

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-107645

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Blocksy Companion [blocksy-companion]

Researcher

Sawyer

More Details >

PPOM <= 34.0.10 – Unauthenticated Arbitrary File Deletion via ‘ppom[fields][<data_name>][n][org]’ Parameter

9.1

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-104801

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

PPOM – Product Addons & Custom Fields for WooCommerce [woocommerce-product-addon]

Researcher

whatm

More Details >

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-105892

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]

Researcher

Dthangws

More Details >

Simple File List <= 6.3.11 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-39792

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Simple File List [simple-file-list]

Researcher

Philipp Doblhofer

More Details >

Super Forms <= 6.3.316 – Unauthenticated Arbitrary Directory Deletion via ‘data[…][files][][subdir]’ Parameter

9.1

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-17609

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

d.v4n_s3c

More Details >

ACPT (Premium) <= 2.0.66 – Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-105701

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

ACPT (Premium) [advanced-custom-post-type]

Researcher

d.v4n_s3c

More Details >

Appointment Booking Plugin <= 5.7.3 – Authenticated (Custom+) Privilege Escalation to ‘settings[default_wp_role_for_customer]’ Parameter

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-104766

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

Wordfence PRISM

More Details >

CodeBard Help Desk <= 1.1.2 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-62024

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

CodeBard Help Desk [codebard-help-desk]

Researcher

JunHee CHO

More Details >

Content Visibility for Divi Builder <= 5.03 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-39725

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Content Visibility for Divi Builder [content-visibility-for-divi-builder]

Researcher

ParkHyunWoo

More Details >

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 – Authenticated (Contributor+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-62129

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms]

Researcher

Peter Tang

More Details >

Crowdfundly <= 2.2.2 – Authenticated (Crowdfundly Manager+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-85126

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Crowdfundly [crowdfundly]

Researcher

Enrico Marcolini

More Details >

FooSales <= 1.43.0 – Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-77183

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

FooSales – Point of Sale (POS) for WooCommerce [foosales]

Researcher

Supakiad S. (m3ez)

More Details >

FV Player 8 <= 8.1.7 – Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-83526

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

FV Player 8 [fv-player]

Researcher

Supakiad S. (m3ez)

More Details >

Groundhogg <= 4.9 – Authenticated (Custom+) Privilege Escalation to ‘user’ Parameter

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-104725

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

Wordfence PRISM

More Details >

LifterLMS <= 10.2.1 – Authenticated (Custom+) PHP Object Injection via ‘custom’ Lesson Data

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-104723

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes [lifterlms]

Researcher

Wordfence PRISM

More Details >

Super Forms <= 6.3.316 – Authenticated (Subscriber+) Arbitrary File Upload via ‘extensions’ Form Element Attribute

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-17196

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

d.v4n_s3c

More Details >

Taskbot <= 6.6 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-39757

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Taskbot [taskbot]

Researcher

Jamaal ahmed

More Details >

Veeqo for WooCommerce <= 2.2.8 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-93550

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Veeqo for WooCommerce [veeqo-for-woocommerce]

Researcher

Naoki Kawahigashi

More Details >

Workreap Core <= 3.4.5 – Authenticated (Employer / Sales Representative+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-39759

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Workreap Core [workreap_core]

Researcher

Jamaal ahmed

More Details >

WP Duplicate – WordPress Migration Plugin <= 1.1.11 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-39755

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WP Duplicate – WordPress Migration Plugin [local-sync]

Researcher

Aurélien BOURDOIS

More Details >

Aalto – Architecture and Interior Design WordPress Theme <= 1.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-42777

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Aalto – Architecture and Interior Design WordPress Theme [aalto]

Researcher

João Pedro S Alcântara

More Details >

Advanced Form Integration <= 2.9.0 – Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-104797

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Advanced Form Integration — Connect Forms to 300+ Apps [advanced-form-integration]

Researcher

wachirapong kamphapong (wachiss)

More Details >

AFFI – Affiliate Marketing for WooCommerce <= 1.0.10 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-104398

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

AFFI – Affiliate Marketing for WooCommerce [affi-affiliate-marketing-for-woo]

Researcher

V1T

More Details >

Alliance | Intranet & Extranet BuddyPress WordPress Theme <= 3.11 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78529

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Alliance | Intranet & Extranet BuddyPress WordPress Theme [alliance]

Researcher

Bonds

More Details >

Ambient <= 1.7 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66566

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Ambient – Modern Interior Design and Decoration WordPress Theme [ambient]

Researcher

Tran Nguyen Bao Khanh

More Details >

Anesta – Intranet, Extranet, Community and BuddyPress WordPress Theme <= 1.5.3 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66567

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Anesta – Intranet, Extranet, Community and BuddyPress WordPress Theme [anesta]

Researcher

João Pedro S Alcântara

More Details >

Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62092

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) [armania]

Researcher

João Pedro S Alcântara

More Details >

Asia Garden <= 1.3.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62125

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

asia-garden [asia-garden]

Researcher

johska

More Details >

Avala <= 1.1.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62077

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Avala – Wedding & Event WordPress Theme [avala]

Researcher

João Pedro S Alcântara

More Details >

Backhoe <= 2.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62075

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Backhoe – Construction Equipment Rentals WordPress Theme [backhoe]

Researcher

João Pedro S Alcântara

More Details >

Balance <= 1.12.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93945

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Balance [balance]

Researcher

Bonds

More Details >

Biolife – Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62096

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Biolife – Organic Food WordPress Theme ( RTL Supported ) [biolife]

Researcher

João Pedro S Alcântara

More Details >

Booklovers – Publishing House, Bookshop & BookStore WordPress Theme + RTL <= 2.13.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62045

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Booklovers – Publishing House, Bookshop & BookStore WordPress Theme + RTL [booklovers]

Researcher

João Pedro S Alcântara

More Details >

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.4.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-42718

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools [woocommerce-jetpack]

Researcher

John Ryan Albon

More Details >

Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62099

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) [kute-boutique]

Researcher

João Pedro S Alcântara

More Details >

Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-81797

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Buzz Stone | Magazine & Viral Blog WordPress Theme [buzzstone]

Researcher

daroo

More Details >

Camelia | Floral Studio Florist WordPress Theme <= 1.2.15 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93944

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Camelia | Floral Studio Florist WordPress Theme [camelia]

Researcher

Bonds

More Details >

Cardea <= 2.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62065

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Cardea – Portfolio One Page WordPress Theme [cardea-wp]

Researcher

João Pedro S Alcântara

More Details >

CleanSkin <= 1.5.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-42724

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor [cleanskin]

Researcher

Tran Nguyen Bao Khanh

More Details >

CleanSkin <= 1.5.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-42723

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor [cleanskin]

Researcher

João Pedro S Alcântara

More Details >

Convex – Architecture & Interior Design WordPress Theme <= 1.16.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93943

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Convex – Architecture & Interior Design WordPress Theme [convex]

Researcher

Bonds

More Details >

DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.27 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62032

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

DirectoryPress – Business Directory And Classified Ad Listing [directorypress]

Researcher

0xzenko

More Details >

Drone Media | Aerial Photography & Videography Theme <= 2.2.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66482

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Drone Media | Aerial Photography & Videography Theme [drone-media]

Researcher

João Pedro S Alcântara

More Details >

Duka Market – Multipurpose eCommerce Template <= 1.3.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-48194

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Duka Market – Multipurpose eCommerce Template [dukamarket]

Researcher

João Pedro S Alcântara

More Details >

Dwell – Building, Construction & Renovation Theme <= 1.16.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93942

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Dwell – Building, Construction & Renovation Theme [dwell]

Researcher

Bonds

More Details >

Edema | Wellness & Spa WordPress Theme <= 1.2.2.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93941

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Edema | Wellness & Spa WordPress Theme [edema]

Researcher

Bonds

More Details >

Education Center <= 3.6.12 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66483

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Education Center | LMS & Online Courses WordPress Theme [education]

Researcher

Bonds

More Details >

Equadio <= 1.1.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62087

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Equadio [equadio]

Researcher

johska

More Details >

Fabius – One Page Resume WordPress Theme <= 1.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62069

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Fabius – One Page Resume WordPress Theme [fabius-wp]

Researcher

João Pedro S Alcântara

More Details >

FC United <= 1.1.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66565

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

FC United | Football, Soccer & Sports WordPress Theme + Events & Shop [fcunited]

Researcher

João Pedro S Alcântara

More Details >

Flipmart – MegaOne Multipurpose WordPress Theme <= 2.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62070

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Flipmart – MegaOne Multipurpose WordPress Theme [flipmart]

Researcher

João Pedro S Alcântara

More Details >

FoodBakery <= 4.6 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78530

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

FoodBakery | Food Delivery Single & Multiple Restaurant Template [foodbakery]

Researcher

Tran Nguyen Bao Khanh

More Details >

GeoDirectory <= 2.8.187 – Unauthenticated Local File Inclusion via ‘design_type’ Parameter

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-104899

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

Wordfence PRISM

More Details >

Greeny – Electric Car Dealership WordPress Theme <= 2.10.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93940

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Greeny – Electric Car Dealership WordPress Theme [greeny]

Researcher

Bonds

More Details >

Groundhogg <= 4.8.3 – Unauthenticated Privilege Escalation to Support User Identity Confusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-92975

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

Wordfence PRISM

More Details >

Gutentype | 100% Gutenberg Blog Theme + Elementor <= 2.1.12 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62046

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Gutentype | 100% Gutenberg Blog Theme + Elementor [gutentype]

Researcher

João Pedro S Alcântara

More Details >

Hogwords | School, University Education WordPress Theme <= 1.2.7 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93938

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Hogwords | School, University Education WordPress Theme [hogwords]

Researcher

Bonds

More Details >

Hygia – Cleaning Services WordPress Theme <= 1.21.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93937

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Hygia – Cleaning Services WordPress Theme [hygia]

Researcher

Bonds

More Details >

Invetex <= 2.18 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62123

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Invetex [invetex]

Researcher

johska

More Details >

iPharm – Online Pharmacy Woocommerce Elementor Template Kit <= 1.2.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93936

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

iPharm – Online Pharmacy Woocommerce Elementor Template Kit [ipharm]

Researcher

Bonds

More Details >

Jacqueline | Spa & Massage Salon Beauty Theme <= 2.22 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78531

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

jacqueline [jacqueline]

Researcher

Bonds

More Details >

Job Postings <= 2.8.2 – Authenticated (Contributor+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-39752

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Job Postings [job-postings]

Researcher

hhhai

More Details >

Juno <= 2.25 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62086

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Juno | Kids Toys & Games Store WordPress Theme [junotoys]

Researcher

johska

More Details >

Kalles <= 1.1.7.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62076

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Kalles – Clean, Versatile, Responsive Shopify Theme – RTL support [kalles]

Researcher

João Pedro S Alcântara

More Details >

Kaven <= 1.2 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62067

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Kaven – Business One Page WordPress Theme [kaven-wp]

Researcher

João Pedro S Alcântara

More Details >

Kicker – Blog Magazine Theme <= 2.2.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66569

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Kicker – Blog Magazine Theme [kicker]

Researcher

João Pedro S Alcântara

More Details >

Kids Care <= 3.2.4 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-42704

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

kidscare [kidscare]

Researcher

Tran Nguyen Bao Khanh

More Details >

KuteShop <= 4.2.9 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62115

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

kuteshop [kuteshop]

Researcher

João Pedro S Alcântara

More Details >

Law Office <= 3.20 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62120

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Law Office [law-office]

Researcher

johska

More Details >

Let’s Play | Hockey School & Winter Sports WordPress Theme <= 1.1.15 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93935

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Let’s Play | Hockey School & Winter Sports WordPress Theme [playhockey]

Researcher

Bonds

More Details >

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-105436

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child]

Researcher

Rafie Muhammad

More Details >

N7 <= 2.21 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62124

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

N7 [n7-golf-club]

Researcher

johska

More Details >

Original <= 1.9.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66568

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Original [original]

Researcher

Bonds

More Details >

Ozeum | Art Gallery and Museum Theme <= 1.3.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62074

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Ozeum | Art Gallery and Museum Theme [ozeum]

Researcher

João Pedro S Alcântara

More Details >

Partiso | Political Party & Candidate Elementor Template Kit <= 1.1.13 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93934

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Partiso | Political Party & Candidate Elementor Template Kit [partiso]

Researcher

Bonds

More Details >

payever – WooCommerce Gateway <= 4.8.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-42716

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

payever – WooCommerce Gateway [payever-woocommerce-gateway]

Researcher

Lee chul woong

More Details >

PeepSo <= 9.0.5.4 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-40805

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

peepso [peepso]

Researcher

Ayoub MOUHATTA

More Details >

Photolia | Photo Company & Supply Store WordPress Theme <= 1.0.3 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78535

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Photolia | Photo Company & Supply Store WordPress Theme [photolia]

Researcher

daroo

More Details >

Presto Player Pro <= 3.0.1 – Authenticated (Author+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66481

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Presto Player Pro [presto-player-pro]

Researcher

0xd4rk5id3

More Details >

Qwery – Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT <= 3.6.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78533

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Qwery – Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT [qwery]

Researcher

João Pedro S Alcântara

More Details >

Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme <= 1.2.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93933

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme [rosalinda]

Researcher

Bonds

More Details >

ShiftCV – Blog Resume Portfolio WordPress Theme <= 3.0.14 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66564

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

ShiftCV – Blog Resume Portfolio WordPress Theme [shift-cv]

Researcher

Bonds

More Details >

Smart Casa | Home Automation & House Technologies WordPress Theme <= 1.0.12 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93932

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Smart Casa | Home Automation & House Technologies WordPress Theme [smart-casa]

Researcher

Bonds

More Details >

Smash – Tennis WordPress Theme <= 1.12.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93931

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Smash – Tennis WordPress Theme [smash]

Researcher

Bonds

More Details >

Splendour <= 1.23 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62050

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Splendour [splendour]

Researcher

johska

More Details >

Stargaze <= 1.10 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62051

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Stargaze [stargaze]

Researcher

johska

More Details >

String Locator <= 2.6.7 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-97188

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

String locator [string-locator]

Researcher

Raphael P. Cigana

More Details >

Tantra | Yoga Studio and Fitness Club WordPress Theme <= 2.9.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93930

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Tantra | Yoga Studio and Fitness Club WordPress Theme [tantra]

Researcher

Bonds

More Details >

TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62094

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) [techone]

Researcher

João Pedro S Alcântara

More Details >

Teoro <= 1.1 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62068

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Teoro – One Page WordPress Theme [teoro-wp]

Researcher

João Pedro S Alcântara

More Details >

The GDPR Framework By Data443 <= 2.5.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-39797

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

The GDPR Framework By Data443 [gdpr-framework]

Researcher

LevinityCyber

More Details >

The Voux <= 6.9.5 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-94067

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

The Voux – A Multipurpose News & Magazine WordPress Theme [thevoux-wp]

Researcher

Tran Nguyen Bao Khanh

More Details >

Tipsy <= 1.6 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62052

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

tipsy [tipsy]

Researcher

johska

More Details >

TouchUp < 1.4 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62020

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

TouchUp – Cosmetic and Plastic Surgery WordPress Theme [touchup]

Researcher

Tran Nguyen Bao Khanh

More Details >

Travesia | Travel Agency and Tour Booking WordPress Theme <= 1.1.16 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93929

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Travesia | Travel Agency and Tour Booking WordPress Theme [travesia]

Researcher

Bonds

More Details >

Uminex – Multipurpose WooCommerce Theme <= 1.0.9 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-48193

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Uminex – Multipurpose WooCommerce Theme [uminex]

Researcher

João Pedro S Alcântara

More Details >

Veto <= 1.6.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-93927

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Veto – Politics, Campaign & Candidate WordPress Theme [veto]

Researcher

Bonds

More Details >

Volos <= 1.2 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62066

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Volos – One Page Resume WordPress Theme [volos-wp]

Researcher

João Pedro S Alcântara

More Details >

Werkstatt – Creative Portfolio WordPress Theme <= 4.8.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-94062

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Werkstatt – Creative Portfolio WordPress Theme [werkstatt]

Researcher

João Pedro S Alcântara

More Details >

Windsor – Apartment Complex Single Property WordPress Theme <= 2.10 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66563

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Windsor – Apartment Complex Single Property WordPress Theme [windsor]

Researcher

Bonds

More Details >

Wine House | Winery & Restaurant WordPress Theme <= 3.20 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62053

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Wine House | Winery & Restaurant WordPress Theme [wine-house]

Researcher

johska

More Details >

WineShop – Food & Wine Store WordPress Theme <= 3.20 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62090

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

WineShop – Food & Wine Store WordPress Theme [wineshop]

Researcher

johska

More Details >

WP File Download <= 6.3.9 – Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via ‘task’ Parameter to Multiple Functions

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-94538

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WP File Download [wp-file-download]

Researcher

t4g0

More Details >

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 – Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-104759

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]

Researcher

Wordfence PRISM

More Details >

Yacht Rental – Boat Services WordPress Theme <= 2.6 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-62054

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Yacht Rental – Boat Services WordPress Theme [yacht-rental]

Researcher

johska

More Details >

Angio <= 1.1.1 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-62021

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Angio – Creative Music Theme [angio]

Researcher

Tran Nguyen Bao Khanh

More Details >

Appointment Booking Plugin <= 5.7.2 – Unauthenticated SQL Injection via ‘booking[service_id]’ Parameter

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-96662

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

zickzick2

More Details >

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.8 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-42417

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup [armember]

Researcher

Rafie Muhammad

More Details >

ASPL Product Quotation <= 1.1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89287

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

ASPL Product Quotation [aspl-product-quotation]

Researcher

João Ramos Maciel

More Details >

Booknetic <= 4.8.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-39746

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Booknetic [booknetic]

Researcher

Bonds

More Details >

ColorFolio <= 1.3 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-94065

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

colorit [colorit]

Researcher

Tran Nguyen Bao Khanh

More Details >

Datalist it <= 0.0.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89285

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Datalist it [datalistit]

Researcher

Enrico Marcolini

More Details >

Directory Listings WordPress plugin – uListing <= 2.2.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-62031

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Directory Listings WordPress plugin – uListing [ulisting]

Researcher

endy

More Details >

Divi Plus <= 2.4.0 – Unauthenticated Arbitrary File Read via ‘svg_image’ Parameter

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-91136

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Divi Plus [divi-plus]

Researcher

ShinThink

More Details >

Dynamic User Directory <= 2.4 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-42719

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Dynamic User Directory [dynamic-user-directory]

Researcher

Hiro

More Details >

Gmedia Photo Gallery <= 1.25.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-39785

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Gmedia Photo Gallery [grand-media]

Researcher

Coopernicus

More Details >

Llavero.io <= 0.1.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89213

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Llavero.io [llavero-io]

Researcher

RIA Labs

More Details >

Loja Automática <= 1.0.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89297

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Loja Automática [loja-automatica]

Researcher

Naoki Kawahigashi

More Details >

LTL Freight Quotes – Old Dominion Edition 4.2.11 – 4.2.18 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-87781

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

LTL Freight Quotes – ODFL Edition [ltl-freight-quotes-odfl-edition]

Researcher

achmad sonif

More Details >

Mobile Builder <= 1.4.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-103695

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Mobile builder [mobile-builder]

Researcher

Raphael P. Cigana

More Details >

Music Store <= 1.4.7 – Unauthenticated Arbitrary File Read via ‘f’ Parameter

7.5

CVSS Rating
7.5 (High)

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Music Store – WordPress eCommerce [music-store]

Researcher

Quentin VILLAIN

More Details >

Neo | Barber Shop WordPress <= 3.5 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-94064

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Neo | Barber Shop WordPress Theme [neocut]

Researcher

Tran Nguyen Bao Khanh

More Details >

Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-41555

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Newsletter Subscription Form – User Subscriptions Form, Capture Email [newsletter-subscription-form]

Researcher

dzeusking

More Details >

Paymendo Bank Transfer <= 1.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89304

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]

Researcher

Enrico Marcolini

More Details >

Porto Theme – Functionality <= 3.9.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-42415

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Porto Theme – Functionality [porto-functionality]

Researcher

Rafie Muhammad

More Details >

Post Voting System <= 1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89302

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Post Voting System [post-voting-system]

Researcher

Naoki Kawahigashi

More Details >

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-104392

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

Ananda Dhakal

More Details >

Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.19 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-39764

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events [radius-booking]

Researcher

Pedro “TheZakMan” Araujo

More Details >

RecordBrowser <= 1.1.7 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89232

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Recordbrowser [recordbrowser]

Researcher

Theo Fonseca

More Details >

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 – Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via ‘files[tmp_name]’ Parameter

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89301

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]

Researcher

Supakiad S. (m3ez)

More Details >

SendPress Newsletters <= 1.26.1.20 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-39795

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

SendPress Newsletters [sendpress]

Researcher

Aydan Arabadzha

More Details >

Site Setup Wizard <= 1.5.8 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89195

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Site Setup Wizard [site-setup-wizard]

Researcher

João Ramos Maciel

More Details >

Slider by 10Web – Responsive Image Slider <= 1.2.62 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-105885

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Slider by 10Web – Responsive Image Slider [slider-wd]

Researcher

Ananda Dhakal

More Details >

Social Web Suite <= 4.1.12 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-88930

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]

Researcher

Naoki Kawahigashi

More Details >

Tainacan <= 1.3.0 – Authenticated (Custom Role+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-94676

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Tainacan [tainacan]

Researcher

Ananda Dhakal

More Details >

Tcard WP <= 1.8.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-81420

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Tcard WP [tcard-wp]

Researcher

Theo Fonseca

More Details >

Testimonials by BestWebSoft 1.0.5 – 1.0.8 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89235

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Testimonials by BestWebSoft [bws-testimonials]

Researcher

Enrico Marcolini

More Details >

Tickera – Sell Tickets & Manage Events <= 3.6.0.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-105889

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]

Researcher

Rasyid Abdi Gantoro

More Details >

Travel Booking WordPress Theme <= 3.2.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-93947

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Travel Booking WordPress Theme [traveler]

Researcher

Rafie Muhammad

More Details >

Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 – Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-82627

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator]

Researcher

0xd4rk5id3

More Details >

Verify API <= 1.0.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89299

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

WP Verify API [wp-verify-api]

Researcher

RIA Labs

More Details >

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 – Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via ’email’ Parameter

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-93746

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce]

Researcher

Brian Mungai

More Details >

WP Rocket < 3.23.5 – Unauthenticated Denial of Service

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-97076

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WP Rocket [wp-rocket]

Researcher

sahinyes

More Details >

WP-Partner <= 1.2.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89234

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

WP-Partner [wp-partner]

Researcher

Raúl Conesa

More Details >

WpCues Basic Quiz <= 1.6.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-89214

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

WpCues Basic Quiz [wpcues-basic-quiz]

Researcher

João Ramos Maciel

More Details >

AI Content Generator Marketing <= 1.0.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-85118

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

AI Content Generator Marketing [ai-content-generator-marketing]

Researcher

Enrico Marcolini

More Details >

Doctreat Core <= 1.7.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-39773

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Doctreat Core [doctreat_core]

Researcher

Jamaal ahmed

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-96341

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

elaprendiz1927

More Details >

Frontend Dashboard 3.0.0 – 3.0.4 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-103692

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Frontend Dashboard [frontend-dashboard]

Researcher

Ryan Fabella

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-104405

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Filip Kowalski

More Details >

Meta Box AIO <= 3.7.1 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-39761

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Meta Box AIO [meta-box-aio]

Researcher

wackydawg

More Details >

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-106610

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]

Researcher

Aliou Cisse (KevineCharles)

More Details >

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.7 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-105070

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]

Researcher

Nixxies

More Details >

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-95594

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]

Researcher

Peter Tang

More Details >

SMS Alert 3.9.6 – 4.0.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-94257

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]

Researcher

Raphael P. Cigana

More Details >

Taskbot <= 6.6 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-39753

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Taskbot [taskbot]

Researcher

Jamaal ahmed

More Details >

Ultimate Multisite <= 2.16.0 – Unauthenticated Arbitrary Account Takeover

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-103646

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform [ultimate-multisite]

Researcher

Erwan LR

More Details >

10Web Booster <= 2.34.8 – Unauthenticated Stored Cross-Site Scripting via Comment Author Name

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-107742

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]

Researcher

daroo

More Details >

aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder <= 2.16.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-40804

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder [ablocks]

Researcher

Akbarov Rauf

More Details >

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-105318

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]

Researcher

Peter Tang

More Details >

Additional Order Filters for WooCommerce <= 1.24 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39800

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Additional Order Filters for WooCommerce [additional-order-filters-for-woocommerce]

Researcher

Tawatchai Pinsuwan

More Details >

Adwised Web Push Notification <= 2.5.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-87762

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Adwised Web Push Notification [adwised]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

More Details >

Ansar Import – One Click Starter Sites – for WordPress Themes <= 2.1.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39778

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Ansar Import – One Click Starter Sites – for WordPress Themes [ansar-import]

Researcher

K. Sorrachat

More Details >

ARforms <= 7.1.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39766

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

ARforms [arforms]

Researcher

Jamaal ahmed

More Details >

AWP Classifieds <= 4.4.8 – Authenticated (Administrator+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2025-15700

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

AWP Classifieds [another-wordpress-classifieds-plugin]

Researcher

Khaled Alenazi

More Details >

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-62116

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]

Researcher

hhhai

More Details >

Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-62034

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]

Researcher

Nguyen Ba Khanh

More Details >

Blog, Posts and Category Filter for Elementor <= 2.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-40806

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Blog, Posts and Category Filter for Elementor [blog-posts-and-category-for-elementor]

Researcher

JunHee CHO

More Details >

BuddyPress Instant Chat <= 1.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-87764

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

BuddyPress Instant Chat [bp-instant-chat]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

More Details >

Builderius – Landing Page Builder + Dynamic Templates <= 1.4-beta – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-27350

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Builderius – Landing Page Builder + Dynamic Templates [builderius]

Researcher

Athiwat Tiprasaharn (Jitlada)

More Details >

CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-40807

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

CF7 Views – Complete Entry Management for Contact Form 7 [cf7-views]

Researcher

JunHee CHO

More Details >

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-104394

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) [charitable]

Researcher

neurotx

More Details >

click5 CRM add-on to Contact Form 7 <= 1.0.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-84261

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]

Researcher

Erwan LR

More Details >

click5 CRM add-on to Gravity Forms <= 1.0.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-84260

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]

Researcher

Erwan LR

More Details >

click5 CRM add-on to Ninja Forms <= 1.0.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-84258

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]

Researcher

Erwan LR

More Details >

click5 CRM add-on to WPForms <= 1.0.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-84259

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

click5 CRM add-on to WPForms [wpf-add-on-by-click5]

Researcher

Erwan LR

More Details >

Coder 4.0 – 4.5.1 – Authenticated (Editor+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-104677

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WP Coder – Insert & Manage Code Snippets [wp-coder]

Researcher

Ayush Srivastava

More Details >

Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress <= 1.7.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39745

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress [contact-form-to-db]

Researcher

dodoh4t

More Details >

Database for CF7 <= 1.2.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39731

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Database for CF7 [database-for-cf7]

Researcher

ParkHyunWoo

More Details >

Document Embedder – let visitors read files without downloading <= 2.4.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-62037

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Document Embedder – let visitors read files without downloading [document-emberdder]

Researcher

daroo

More Details >

Document Gallery <= 5.1.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39781

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Document Gallery [document-gallery]

Researcher

duna

More Details >

Easy Digital Downloads <= 3.6.9 – Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-14335

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researchers

skyv3il

AmonRa

More Details >

Educavo – Education WordPress Theme <= 3.4.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78534

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Educavo – Education WordPress Theme [educavo]

Researcher

dutafi

More Details >

Envira Gallery <= 1.16.1 – Authenticated (Admin+) Arbitrary Plugin Installation

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-104680

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

Karthik Ramakrishnan

More Details >

Fastcache by Host.it <= 1.7.4 – Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via ‘cache_cookie_exclude’ Setting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-104021

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Fastcache by Host.it [fastcache-by-host-it]

Researcher

Wordfence PRISM

More Details >

Fluent Forms Pro Add On Pack <= 6.2.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-94675

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Fluent Forms Pro Add On Pack [fluentformpro]

Researcher

Tarcísio Luchesi

More Details >

Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42709

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Food Menu – Restaurant Menu & Online Ordering for WooCommerce [tlp-food-menu]

Researcher

John Ryan Albon

More Details >

Form Block <= 1.8.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-104814

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Form Block [form-block]

Researcher

V1T

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-102388

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

b1ue0cean

More Details >

FunnelKit <= 3.16.0.5 – Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-100147

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

FunnelKit – Funnel Builder Plugin for WooCommerce Checkout [funnel-builder]

Researcher

crow

More Details >

FV Player 8 <= 8.1.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42699

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

FV Player 8 [fv-player]

Researcher

Ananda Dhakal

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-104672

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

jydae

More Details >

GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI < 2.34.14 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-103309

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI [gptranslate]

Researcher

Guntur Wahyu Ramadhan

More Details >

HivePress <= 1.7.31 – Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-107657

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]

Researcher

Adrien Brunner

More Details >

HootBoard <= 3.1.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-86798

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

HootBoard – Bulletin Board For Your Organization & Team Communication [hootboard]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

More Details >

Hotel Booking <= 3.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39784

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Hotel Booking [nd-booking]

Researcher

Coopernicus

More Details >

HTTP Requests Manager <= 1.3.11 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39724

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

HTTP Requests Manager [http-requests-manager]

Researcher

dodoh4t

More Details >

Instapage Plugin <= 3.7.2 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39728

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Instapage Plugin [instapage]

Researcher

ParkHyunWoo

More Details >

Jannah – Newspaper Magazine News BuddyPress AMP <= 7.6.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42693

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Jannah – Newspaper Magazine News BuddyPress AMP [jannah]

Researcher

Rafie Muhammad

More Details >

Jotform – AI Chatbot <= 3.8.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-40803

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Jotform – AI Chatbot [jotform-ai-chatbot]

Researcher

daroo

More Details >

KeyWord Collector <= 1.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-88905

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

KeyWord Collector [keyword-collector]

Researcher

Enrico Marcolini

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 – Unauthenticated Stored Cross-Site Scripting via Registration Metadata

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-102173

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

Hippolyte Quéré (Hippie) (Hippie)

More Details >

LazyLoad Plugin <= 2.4.0 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-100196

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

LazyLoad Plugin – Lazy Load Images, Videos, and Iframes [rocket-lazy-load]

Researcher

theviper17y

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-104670

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

daroo

More Details >

LMS <= 8.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78532

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

LMS – Education WordPress Theme [lms]

Researcher

Tran Nguyen Bao Khanh

More Details >

LTL Freight Quotes – Old Dominion Edition <= 4.2.18 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-87780

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

LTL Freight Quotes – ODFL Edition [ltl-freight-quotes-odfl-edition]

Researcher

achmad sonif

More Details >

Mapster WP Maps <= 2.0.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39720

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Mapster WP Maps [mapster-wp-maps]

Researcher

Ananda Dhakal

More Details >

Midtrans-WooCommerce <= 2.32.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39758

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Midtrans-WooCommerce [midtrans-woocommerce]

Researcher

ParkHyunWoo

More Details >

Molongui Authorship <= 5.2.12 – Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-101920

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress [molongui-authorship]

Researcher

crow

More Details >

Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 – Unauthenticated Stored Cross-Site Scripting via ‘content’ Parameter

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-81929

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Ocean eComm Treasure Box [ocean-ecommerce]

Ocean Pro Demos [ocean-pro-demos]

Researchers

Alex Thomas

Wordfence Argus

More Details >

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 – Unauthenticated Stored Cross-Site Scripting via ‘s’ Search Parameter in comments-atom Feed

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-89417

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. [host-webfonts-local]

Researcher

uhcna

More Details >

Online Scheduling and Appointment Booking System <= 28.2 – Authenticated (Custom+) PHP Object Injection via ‘value’ Parameter

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-12626

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

Muni Nitish Kumar Yaddala (Stranger825)

More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.47 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42715

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

neurotx

More Details >

Photo Reviews for WooCommerce <= 1.2.30 – Unauthenticated Stored DOM-Based Cross-Site Scripting via ‘wcpr_image_upload_id’ Parameter

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-100161

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Photo Reviews for WooCommerce [woo-photo-reviews]

Researcher

Adrien Brunner

More Details >

picu – Online Photo Proofing Gallery <= 3.10.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-104395

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

picu – Online Photo Proofing Gallery [picu]

Researcher

Intrudify

More Details >

Piotnet Forms <= 1.0.30 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-96227

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Piotnet Forms [piotnetforms]

Researcher

Claude Ndanda

More Details >

Podlove Podcast Publisher <= 4.5.6 – Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-93775

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]

Researcher

Ivaylo

More Details >

Post Grid Gutenberg Blocks <= 5.1.0 – Unauthenticated Stored Cross-Site Scripting via display_name User Field

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-96840

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Post Grid Gutenberg Blocks – PostX [ultimate-post]

Researcher

Jacek Sowiński (dzaku)

More Details >

Post SMTP <= 4.0.1 – Unauthenticated Stored DOM-Based Cross-Site Scripting via ‘user_email’ Parameter (Multisite Registration → Failed Email Log)

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-75962

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App [post-smtp]

Researcher

Adrien Brunner

More Details >

Prenotazioni <= 1.7.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-103305

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Prenotazioni [prenotazioni]

Researchers

Enrico Marcolini

Claudio Marchesini

Dottor Marc

More Details >

Presto Player <= 4.5.1 – Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-96682

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Presto Player [presto-player]

Researcher

20kilograma

More Details >

Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39726

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Product Designer for WooCommerce WordPress | Lumise [lumise]

Researcher

dutafi

More Details >

Qode Music <= 2.1.8.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42631

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Qode Music [qode-music]

Researcher

Rafie Muhammad

More Details >

Qode Real Estate <= 1.1.7.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42632

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Qode Real Estate [qode-real-estate]

Researcher

Rafie Muhammad

More Details >

Quiz and Survey Master (QSM) <= 11.2.6 – Unauthenticated Stored DOM-Based Cross-Site Scripting via ‘qsm_hidden_questions’ Parameter

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-96558

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

Kuba

More Details >

Rank Math SEO <= 1.0.279 – Authenticated (Administrator+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-104752

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

Karthik Ramakrishnan

More Details >

Real Estate Manager <= 7.3 – Unauthenticated Stored Cross-Site Scripting via ‘first_name’ Parameter

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-96667

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Real Estate Manager – Property Listing and Agent Management [real-estate-manager]

Researcher

Morato Antoine

More Details >

Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39760

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]

Researcher

João Pedro S Alcântara

More Details >

Slider by 10Web – Responsive Image Slider <= 1.2.63 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42711

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Slider by 10Web – Responsive Image Slider [slider-wd]

Researcher

neurotx

More Details >

SmugMug Embed <= 3.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-88826

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

SmugMug Embed [smugmug-embed]

Researcher

Enrico Marcolini

More Details >

Social Rocket – Social Sharing Plugin <= 1.3.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42418

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Social Rocket – Social Sharing Plugin [social-rocket]

Researcher

Zein

More Details >

Social Share Icons & Social Share Buttons <= 3.7.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42697

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Social Share Icons & Social Share Buttons [ultimate-social-media-plus]

Researcher

William Honnér

More Details >

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.0.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39750

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]

Researcher

Pedro Pinho

More Details >

StreamCast – bring live radio to your site with a sleek player <= 2.4.5 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-62030

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

StreamCast – bring live radio to your site with a sleek player [streamcast]

Researcher

Asim Alshaya

More Details >

Tabs Responsive – With WooCommerce Product Tabs Extension <= 2.5 – Authenticated (Editor+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39776

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]

Researcher

Ananda Dhakal

More Details >

Team Section Block – Showcase Team Members with Layout Options <= 2.0.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-62027

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Team Section Block – Showcase Team Members with Layout Options [team-section]

Researcher

Asim Alshaya

More Details >

Topcontent <= 1.2.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-88903

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Topcontent [topcontent]

Researcher

Naoki Kawahigashi

More Details >

Tutor LMS – eLearning and online course solution <= 4.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42702

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

Intrudify

More Details >

Video Background Block – Add Stunning Video Backgrounds to Any Section <= 2.0.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42634

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Video Background Block – Add Stunning Video Backgrounds to Any Section [video-background-block]

Researcher

John Ryan Albon

More Details >

VikBooking Hotel Booking Engine & PMS <= 1.8.15 – Unauthenticated Stored Cross-Site Scripting via ‘attachments[name]’ Parameter

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-95684

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

zickzick2

More Details >

VikRentCar Car Rental Management System <= 1.4.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39790

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

VikRentCar Car Rental Management System [vikrentcar]

Researcher

dutafi

More Details >

Web Vitals Tracking <= 5.4.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-87760

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Web Vitals Tracking [web-vitals-tracking]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

More Details >

WooCommerce Simple Auctions <= 3.0.10 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42635

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WooCommerce Simple Auctions [woocommerce-simple-auctions]

Researcher

Nguyen Ba Khanh

More Details >

WordPress Core 7.1 – 7.1.2 – Unauthenticated Stored Cross-Site Scripting via Pending Comments

7.2

CVSS Rating
7.2 (High)

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

WordPress [wordpress]

Researcher

Thomas Chauchefoin

More Details >

WP Associate Post R2 <= 5.0.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-105870

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WP Associate Post R2 [wp-associate-post-r2]

Researcher

Ananda Dhakal

More Details >

WP File Download <= 6.3.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39799

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

WP File Download [wp-file-download]

Researcher

dutafi

More Details >

WP Mailster <= 1.9.0.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-105061

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WP Mailster [wp-mailster]

Researcher

L4m

More Details >

WP Meteor Website Speed Optimization Addon <= 3.4.18 – Unauthenticated Stored Cross-Site Scripting via Comment Author Name

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-96572

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WP Meteor Website Speed Optimization Addon [wp-meteor]

Researcher

theviper17y

More Details >

WP Photo Album Plus <= 9.3.03.002 – Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-96278

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

nh4tvd

More Details >

WPAdverts – Classifieds Plugin <= 2.3.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-97263

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

WPAdverts – Classifieds Plugin [wpadverts]

Researcher

neurotx

More Details >

WPAdverts <= 2.3.4 – Unauthenticated Stored Cross-Site Scripting via ‘adverts_location’ Parameter

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-100178

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WPAdverts – Classifieds Plugin [wpadverts]

Researcher

Morato Antoine

More Details >

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-42636

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

Nguyen Kim Sang

More Details >

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 – Unauthenticated Stored Cross-Site Scripting via ‘id_token’ Parameter (iss / unique_name JWT claims)

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-96765

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]

Researcher

Sebastian Albrecht (mySebbe)

More Details >

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-39780

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress [youzify]

Researcher

etomixer

More Details >

Online Scheduling and Appointment Booking System <= 28.4 – Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via ‘id’ and ‘wp_user_id’ Parameters via Query String / JSON Body

6.8

CVSS Rating
6.8 (Medium)

CVE-ID

CVE-2026-104898

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

Wordfence PRISM

More Details >

Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension

6.8

CVSS Rating
6.8 (Medium)

CVE-ID

CVE-2025-14123

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Redux Framework [redux-framework]

Researcher

shark3y

More Details >

Product Configurator for WooCommerce <= 1.7.5 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-105872

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Product Configurator for WooCommerce [product-configurator-for-woocommerce]

Researcher

Ananda Dhakal

More Details >

Super Video player – Fully Customizable Video Player with Playlist <= 1.8.14 – Authenticated (Editor+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-62044

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Super Video player – Fully Customizable Video Player with Playlist [super-video-player]

Researcher

johska

More Details >

WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-62130

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]

Researcher

Ananda Dhakal

More Details >

YITH WooCommerce Affiliates <= 3.31.0 – Authenticated (Shop Manager+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-106606

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

YITH WooCommerce Affiliates [yith-woocommerce-affiliates]

Researcher

Ananda Dhakal

More Details >

Academy LMS <= 4.0.3 – Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-104915

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]

Researcher

Wordfence PRISM

More Details >

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-62117

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]

Researcher

she11f

More Details >

Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-62098

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) [kute-boutique]

Researcher

João Pedro S Alcântara

More Details >

BuddyBoss Platform <= 3.1.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-39771

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

BuddyBoss Platform [buddyboss-platform]

Researcher

dutafi

More Details >

ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) <= 1.5.3 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-40800

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) [elex-bulk-edit-products-prices-attributes-for-woocommerce-basic]

Researcher

Aydan Arabadzha

More Details >

Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-42633

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]

Researcher

neurotx

More Details >

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 – Authenticated (Custom Role+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-104408

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

Ayukiab

More Details >

Image Optimizer, Resizer and CDN – Sirv <= 8.2.5 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-104389

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Image Optimizer, Resizer and CDN – Sirv [sirv]

Researcher

Peter Tang

More Details >

Kirki <= 6.3.1 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-84220

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

Karthik Ramakrishnan

More Details >

ListingPro Plugin <= 2.9.12 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-42414

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

ListingPro Plugin [listingpro-plugin]

Researcher

Rafie Muhammad

More Details >

Name Directory <= 1.34.2 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-104397

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Name Directory [name-directory]

Researcher

changsheng

More Details >

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-105317

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

Deva Parekh

More Details >

Paymendo Bank Transfer <= 1.1 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-89305

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]

Researcher

Erwan LR

More Details >

Piotnet Addons For Elementor <= 7.1.71 – Authenticated (Contributor+) Arbitrary File Read

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-39754

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Piotnet Addons For Elementor [piotnet-addons-for-elementor]

Researcher

dutafi

More Details >

Qode Tours <= 3.1.3.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-42712

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Qode Tours [qode-tours]

Researcher

Rafie Muhammad

More Details >

SiteOrigin Widgets Bundle <= 1.74.3 – Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode ‘value’ JSON Instance (design.colors LESS Variable)

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-97348

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

SiteOrigin Widgets Bundle [so-widgets-bundle]

Researcher

Wordfence PRISM

More Details >

Slider by 10Web – Responsive Image Slider <= 1.2.63 – Authenticated (Author+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-42710

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Slider by 10Web – Responsive Image Slider [slider-wd]

Researcher

Ananda Dhakal

More Details >

Thanko Thank You Page Customizer for WooCommerce <= 1.2.3 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-103071

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Thanko Thank You Page Customizer for WooCommerce [woo-thank-you-page-customizer]

Researcher

cazy

More Details >

uDesign | Multipurpose WordPress Theme <= 4.15.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-42416

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

uDesign | Multipurpose WordPress Theme [u-design-core]

Researcher

Rafie Muhammad

More Details >

Vitepos – Point of Sale (POS) for WooCommerce <= 3.6.1 – Authenticated (Custom Role+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-105076

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]

Researcher

Peter Tang

More Details >

W3 Total Cache <= 2.10.5 – Authenticated (Author+) Path Traversal

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-107321

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

W3 Total Cache [w3-total-cache]

Researcher

Karthik Ramakrishnan

More Details >

Woffice CRM <= 5.4.35 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-39747

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Woffice CRM [woffice]

Researcher

Bonds

More Details >

WP Booking System <= 2.1.0.1 – Authenticated (Subscriber+) SQL Injection via ‘current_month’ Parameter

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-107712

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WP Booking System – Booking Calendar [wp-booking-system]

Researcher

Spy0x7

More Details >

WP Directory Kit <= 1.5.9 – Authenticated (Subscriber+) SQL Injection via ‘display_name’ Profile Field (Second-Order)

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-96653

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

Tarcísio Luchesi De Almeida Silva (Poystick)

More Details >

WP Post Author 4.0.0 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-108125

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]

Researcher

Joshua Martinelle

More Details >

WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-25434

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden [wp2leads]

Researcher

johska

More Details >

WPBase Cache <= 5.5.6 – Authenticated (Subscriber+) Denial of Service

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-39767

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WPBase Cache [wpbase-cache]

Researcher

dodoh4t

More Details >

Advanced Classifieds & Directory Pro <= 3.4.4 – Authenticated (Custom+) Stored Cross-Site Scripting via ‘phone’ Parameter

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-93883

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Advanced Classifieds & Directory Pro [advanced-classifieds-and-directory-pro]

Researcher

Ivaylo

More Details >

Adwised Web Push Notification <= 2.5.7 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-87761

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Adwised Web Push Notification [adwised]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

More Details >

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘author_facebook’ User Profile Field

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-97340

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Avada | Website Builder For WordPress & WooCommerce [Avada]

Researcher

Muhamad Visat

More Details >

bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104400

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

bBlocks – Essential Gutenberg Blocks & Patterns Collection [b-blocks]

Researcher

V1T

More Details >

Brizy <= 2.8.18 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘brizy-compiled-sections’ Post Meta

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14882

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Brizy – Page Builder [brizy]

Researcher

Webbernaut

More Details >

Church Admin <= 5.1.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ’email’ Parameter

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-94421

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Church Admin [church-admin]

Researcher

刀 妖

More Details >

Data Tables Generator by Supsystic <= 1.12.03 – Authenticated (Contributor+) Stored Cross-Site Scripting via Table ‘id’ HTML Attribute

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14877

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Data Tables Generator by Supsystic [data-tables-generator-by-supsystic]

Researcher

Webbernaut

More Details >

Data Tables Generator by Supsystic <= 1.15.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell ‘data’ Value via updateRows Action

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-96648

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Data Tables Generator by Supsystic [data-tables-generator-by-supsystic]

Researcher

braintx

More Details >

Download Manager <= 3.3.58 – Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-9696

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Download Manager [download-manager]

Researcher

theviper17y

More Details >

Download Manager <= 3.3.71 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘regurl’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-102401

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Download Manager [download-manager]

Researcher

Wordfence PRISM

More Details >

eCommerce Product Catalog <= 3.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105056

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

eCommerce Product Catalog [ecommerce-product-catalog]

Researcher

Ananda Dhakal

More Details >

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105873

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Researcher

Intrudify

More Details >

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105871

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Researcher

nh4tvd

More Details >

Email Marketing for WordPress and WooCommerce <= 1.0.10 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘data’ Parameter to /updateOptions REST Endpoint

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-97396

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Email Marketing for WordPress and WooCommerce – Retainful [retainful]

Researcher

Trithem

More Details >

Embed Any Document <= 2.7.13 – Authenticated (Contributor+) Stored Cross-Site Scripting via ’embeddoc’ Shortcode

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-18558

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files [embed-any-document]

Researcher

Deva Parekh

More Details >

Envira Gallery <= 1.16.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104652

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

John Ryan Albon

More Details >

Envira Gallery <= 1.16.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104653

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

Karthik Ramakrishnan

More Details >

Front End PM <= 11.4.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-39788

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Front End PM [front-end-pm]

Researcher

Ananda Dhakal

More Details >

Frontend Admin by DynamiApps <= 3.28.36 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-6243

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Frontend Admin by DynamiApps [acf-frontend-form-element]

Researcher

Muhammad Yudha – DJ

More Details >

FV Flowplayer Video Player <= 7.5.54.7212 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-42695

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

FV Flowplayer Video Player [fv-wordpress-flowplayer]

Researcher

Supakiad S.

More Details >

FV Flowplayer Video Player <= 7.5.54.7212 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-97630

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

FV Flowplayer Video Player [fv-wordpress-flowplayer]

Researcher

Thaer Assfour

More Details >

Gallery PhotoBlocks <= 1.3.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-107323

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Gallery PhotoBlocks [photoblocks-grid-gallery]

Researcher

Andy Urlep

More Details >

GamiPress <= 7.9.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘video_id’ Parameter

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14379

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]

Researcher

Supakiad S. (m3ez)

More Details >

GeoDirectory <= 2.8.188 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104993

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

Tai Ha (superx)

More Details >

Getwid <= 3.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘data-image-points’

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-91862

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Getwid – Gutenberg Blocks [getwid]

Researcher

nthng

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104404

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Intrudify

More Details >

GiveWP <= 4.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-97643

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Wordfence PRISM

More Details >

Graphene <= 2.9.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-17025

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Graphene [graphene]

Researcher

stealthcopter

More Details >

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104393

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]

Researcher

Intrudify

More Details >

HivePress <= 1.7.31 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-103520

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

HivePress – Business Directory, Listings & Classified Ads Plugin [hivepress]

Researcher

zickzick2

More Details >

HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player <= 2.8.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-62039

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player [html5-audio-player]

Researcher

Ananda Dhakal

More Details >

Image Photo Gallery Final Tiles Grid <= 3.6.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104409

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]

Researcher

Nguyen Ba Khanh

More Details >

Image Photo Gallery Final Tiles Grid <= 3.6.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104646

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]

Researcher

Karthik Ramakrishnan

More Details >

Image Slider <= 1.1.130 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-42700

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Image Slider [image-slider-widget]

Researcher

Ananda Dhakal

More Details >

JetBlocks for Elementor <= 1.5.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-62049

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

JetBlocks for Elementor [jet-blocks]

Researcher

nh4tvd

More Details >

JetElements <= 2.9.2.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105879

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

JetElements [jet-elements]

Researcher

nh4tvd

More Details >

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.12 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105890

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

Intrudify

More Details >

Kadence Blocks <= 3.7.12 – Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104762

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

Wordfence PRISM

More Details >

LazyLoad Plugin – Lazy Load Images, Videos, and Iframes <= 2.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105884

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

LazyLoad Plugin – Lazy Load Images, Videos, and Iframes [rocket-lazy-load]

Researcher

Intrudify

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 – Authenticated (Instructor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105397

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

HunterSploit

More Details >

Logo Showcase – Logo Slider, Carousel & Sponsors Gallery <= 4.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105060

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Logo Showcase – Logo Slider, Carousel & Sponsors Gallery [logo-showcase]

Researcher

Ananda Dhakal

More Details >

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.52 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105079

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

Deva Parekh

More Details >

Media Library Assistant <= 3.41 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-97294

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

yzx001

More Details >

Motors <= 1.4.123 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘stm_f_s’ Parameter

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-96563

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

Kamil B.

More Details >

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104673

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]

Researcher

Ananda Dhakal

More Details >

MP3 Audio Player <= 5.14.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16776

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]

Researcher

Wordfence PRISM

More Details >

Name Directory <= 1.34.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104396

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Name Directory [name-directory]

Researcher

Masaya Morita

More Details >

PeproDev Ultimate Profile Solutions <= 8.2.36 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘button’ Attribute

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-4791

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

PeproDev Ultimate Profile Solutions [peprodev-ups]

Researcher

zaim

More Details >

Post Snippets <= 4.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12980

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Post Snippets – Custom WordPress Code Snippets Customizer [post-snippets]

Researcher

Philipp Doblhofer

More Details >

PowerPress 11.13.12 – 11.17.9 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-97354

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

Raj Ukani

More Details >

Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.109 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-103084

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]

Researcher

nh4tvd

More Details >

Premium Packages <= 7.2.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘checkout[billing][phone]’ Parameter

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-103478

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

Wordfence PRISM

More Details >

Presto Player <= 4.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-102914

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Presto Player [presto-player]

Researcher

Intrudify

More Details >

Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105875

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite]

Researcher

Intrudify

More Details >

QR Redirector <= 2.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105069

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

QR Redirector [qr-redirector]

Researcher

Ananda Dhakal

More Details >

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104391

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

Intrudify

More Details >

Robo Gallery – Photo & Image Slider <= 5.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105887

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

Ananda Dhakal

More Details >

Robo Gallery <= 5.2.5 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-81155

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

Yaswanth Reddy Sunkara

More Details >

Robo Gallery <= 5.2.5 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-81153

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

Kenneth Billones

More Details >

Robo Gallery <= 5.2.5 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-81154

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

Yaswanth Reddy Sunkara

More Details >

Robo Gallery <= 5.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-81156

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Robo Gallery – Photo & Image Slider [robo-gallery]

Researcher

Yaswanth Reddy Sunkara

More Details >

RSS Aggregator by Feedzy <= 5.2.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-104735

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds]

Researcher

Wordfence PRISM

More Details >

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-103070

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]

Researcher

Intrudify

More Details >

Simple Membership <= 4.8.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-103427

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

Maciej Komorowski

More Details >

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-102393

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg [astra-sites]

Researcher

fcc

More Details >

SureDash <= 1.12.1 – Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image ‘alt’ Attribute in Community Post Content

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-102774

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

SureDash – Community, Courses & Member Dashboard [suredash]

Researcher

Jacek Sowiński (dzaku)

More Details >

Table Field Add-on for ACF and SCF <= 1.3.35 – Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-78068

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]

Researcher

Omar Elshopky (3l5h0pky)

More Details >

Table Field Add-on for ACF and SCF <= 1.4.1-RC2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-96743

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]

Researcher

Kuba

More Details >

Team <= 6.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘ttp_filter_taxonomy’ Post Meta via [tlpteam] Shortcode

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-102402

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Team – Team Members Showcase Plugin [tlp-team]

Researcher

Wordfence PRISM

More Details >

User Frontend <= 4.3.12 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘wpuf_payment_method’ Parameter

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-96574

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

Tarcísio Luchesi De Almeida Silva (Poystick)

More Details >

WC Fields Factory <= 4.1.12 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-39727

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WC Fields Factory [wc-fields-factory]

Researcher

ParkHyunWoo

More Details >

WordPress Core 4.7.0 – 7.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed

6.4

CVSS Rating
6.4 (Medium)

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researchers

Zhengyu Liu

Jingcheng Yang

Gavin Zhong

More Details >

WP Plugin Info Card <= 6.3.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-62127

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

WP Plugin Info Card [wp-plugin-info-card]

Researcher

V1T

More Details >

WP Store Locator <= 3.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105078

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

WP Store Locator [wp-store-locator]

Researcher

Intrudify

More Details >

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-62029

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

nh4tvd

More Details >

Zotpress <= 7.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-27420

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Zotpress [zotpress]

Researcher

Muhammad Yudha

More Details >

AI Copilot – Content Generator <= 1.5.9 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-39801

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

AI Copilot – Content Generator [ai-copilot-content-generator]

Researcher

hackthesoul

More Details >

FooSales <= 1.43.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-93548

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

FooSales – Point of Sale (POS) for WooCommerce [foosales]

Researcher

Naoki Kawahigashi

More Details >

JobZilla – Job Board WordPress Theme <= 2.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-39775

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

JobZilla – Job Board WordPress Theme [jobzilla]

Researcher

Jamaal ahmed

More Details >

Koinonia Link 1.1.2 – 1.1.4 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-87782

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Koinonia Link [koinonia-link]

Researcher

Ryan Fabella

More Details >

Mobile builder <= 1.4.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-103694

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Mobile builder [mobile-builder]

Researcher

Raphael P. Cigana

More Details >

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 – Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-93509

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

Stefan Löwen

More Details >

Wallet System for WooCommerce 2.0.0 – 2.7.10 – Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-93509

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

Stefan Löwen

More Details >

WP User Profiles <= 2.7.3 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-105058

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WP User Profiles [wp-user-profiles]

Researcher

nguyen viet tin

More Details >

Ambed <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-62064

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Ambed – Wallpapers & Painting Services WordPress Theme [ambed]

Researcher

Tran Nguyen Bao Khanh

More Details >

Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-62091

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) [armania]

Researcher

João Pedro S Alcântara

More Details >

Aurora Heatmap <= 1.7.2 – Unauthenticated Stored Cross-Site Scripting via ‘url’ Parameter

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-94154

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Aurora Heatmap [aurora-heatmap]

Researcher

lhking

More Details >

Biolife – Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-62095

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Biolife – Organic Food WordPress Theme ( RTL Supported ) [biolife]

Researcher

João Pedro S Alcântara

More Details >

Download Manager <= 3.3.57 – Unauthenticated DOM-Based Reflected Cross-Site Scripting via ‘REFERRER’ Parameter

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-12054

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Download Manager [download-manager]

Researcher

Yuvraj Tomar

More Details >

Education Center <= 3.6.12 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-94063

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Education Center | LMS & Online Courses WordPress Theme [education]

Researcher

João Pedro S Alcântara

More Details >

EduMall – Professional LMS Education Center WordPress Theme <= 4.5.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-39748

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

EduMall – Professional LMS Education Center WordPress Theme [edumall]

Researcher

dutafi

More Details >

Favicon Rotator <= 1.2.11 – Reflected Cross-Site Scripting via ‘fvrt_’ prefix

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-5725

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Favicon Rotator [favicon-rotator]

Researcher

Kitch

More Details >

Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 – Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-87869

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Filter Everything — WordPress & WooCommerce Filters [filter-everything]

Researcher

Omar Elshopky (3l5h0pky)

More Details >

Form Maker by 10Web <= 1.15.48 – Reflected Cross-Site Scripting via ‘inputs’ Parameter Array Key

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-103998

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]

Researcher

Kuba

More Details >

Gloria Admin Panel <= 1.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-94158

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Gloria Admin Panel [gloria-admin-panel]

Researcher

João Pedro S Alcântara

More Details >

If-So Dynamic Content 1.4.4 – 1.10.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-87971

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so]

Researcher

Utkarsh Choudhary

More Details >

Kids Planet – Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-57742

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Kids Planet – Children Kindergarten and Playgroup WordPress Theme [kidsplanet]

Researcher

João Pedro S Alcântara

More Details >

KuteShop <= 4.2.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-62100

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

kuteshop [kuteshop]

Researcher

João Pedro S Alcântara

More Details >

Magee Shortcodes <= 2.1.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-105316

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Magee Shortcodes [magee-shortcodes]

Researchers

Enrico Marcolini

Claudio Marchesini

Dottor Marc

More Details >

Martfury – Marketplace Mobile App Figma Template <= 3.3.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-57806

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Martfury – Marketplace Mobile App Figma Template [martfury]

Researcher

João Pedro S Alcântara

More Details >

Ogency <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-94059

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Ogency – Web Design Agency WordPress Theme [ogency]

Researcher

Tran Nguyen Bao Khanh

More Details >

Payment Plugins for Stripe WooCommerce <= 4.0.17 – Reflected DOM-Based Cross-Site Scripting via ‘#response’ URL Fragment

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-89100

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Payment Plugins for Stripe WooCommerce [woo-stripe-payment]

Researcher

Adrien Brunner

More Details >

Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission <= 7.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-62082

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission [pin-wp]

Researcher

João Pedro S Alcântara

More Details >

Subscribe to Comments <= 2.3.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-91829

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Subscribe to Comments [subscribe-to-comments]

Researcher

Het Kalariya

More Details >

TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-62093

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) [techone]

Researcher

João Pedro S Alcântara

More Details >

ThemeStek Extras for LabtechCO Theme <= 8.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-94160

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

ThemeStek Extras for LabtechCO Theme [themestek-labtechco-extras]

Researcher

João Pedro S Alcântara

More Details >

Treck <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-94058

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Treck – Immigration and Visa Consulting WordPress Theme [treck]

Researcher

Tran Nguyen Bao Khanh

More Details >

Voldor <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-94060

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Voldor – Welding & Metal Work WordPress Theme [voldor]

Researcher

Tran Nguyen Bao Khanh

More Details >

Whistle – Sports Club <= 4.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-94061

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Whistle – Sports Clothing & Fitness Equipment [whistle-sports-club]

Researcher

João Pedro S Alcântara

More Details >

WPAdverts – Classifieds Plugin <= 2.3.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-97264

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

WPAdverts – Classifieds Plugin [wpadverts]

Researcher

neurotx

More Details >

WPLMS Learning Management System for WordPress, WordPress LMS <= 4.972 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-39722

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WPLMS Learning Management System for WordPress, WordPress LMS [wplms]

Researcher

João Pedro S Alcântara

More Details >

Zeinet <= 1.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-93951

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Zeinet – Internet Provider & Satellite TV [zeinet]

Researcher

Tran Nguyen Bao Khanh

More Details >

Kirki <= 6.3.1 – Authenticated (Editor+) Server-Side Request Forgery

5.5

CVSS Rating
5.5 (Medium)

CVE-ID

CVE-2026-84224

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

Mohammed Abd Alrahman

More Details >

Academy LMS <= 4.0.3 – Authenticated (Custom+) Privilege Escalation to add_child REST endpoint

5.4

CVSS Rating
5.4 (Medium)

CVE-ID

CVE-2026-104022

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]

Researcher

Wordfence PRISM

More Details >

Anti-Spam by CleanTalk <= 6.88 – Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex

5.4

CVSS Rating
5.4 (Medium)

CVE-ID

CVE-2026-103424

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Spam Protection for Forms & Comments. Anti-Spam by CleanTalk [cleantalk-spam-protect]

Researcher

Maciej Komorowski

More Details >

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

5.4

CVSS Rating
5.4 (Medium)

CVE-ID

CVE-2026-17538

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

owlmind

More Details >

Fluent Forms <= 6.2.5 – Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification

5.4

CVSS Rating
5.4 (Medium)

CVE-ID

CVE-2026-15178

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

Nadir Şensoy

More Details >

Hello Plus <= 1.7.7 – Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site

5.4

CVSS Rating
5.4 (Medium)

CVE-ID

CVE-2026-5727

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Hello Plus [hello-plus]

Researcher

normaandersonfrank

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘display_name’

5.4

CVSS Rating
5.4 (Medium)

CVE-ID

CVE-2026-102291

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

Jacek Sowiński (dzaku)

More Details >

Simple Newsletter Plugin <= 4.3.10 – Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot

5.4

CVSS Rating
5.4 (Medium)

CVE-ID

CVE-2026-103482

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Noptin – Newsletter, New Post Notifications & Email Automation [newsletter-optin-box]

Researcher

crow

More Details >

10WebSocial <= 1.4.35 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39787

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

10WebSocial [wd-instagram-feed]

Researcher

Ananda Dhakal

More Details >

Accept PayPal Payments using Contact Form 7 <= 4.0.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105989

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]

Researcher

Daniel Dhaniswara

More Details >

Accept PayPal Payments Using Contact Form 7 <= 4.0.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105990

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]

Researchers

Enrico Marcolini

Claudio Marchesini

Dottor Marc

More Details >

Advanced Google reCAPTCHA <= 5.40 – Unauthenticated Login Protection Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-100518

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Advanced Google reCAPTCHA [advanced-google-recaptcha]

Researcher

Asim Alshaya

More Details >

Advanced Posts Listing – Show Post List Easily <= 1.0.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39796

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Advanced Posts Listing – Show Post List Easily [advanced-posts-listing]

Researcher

Mohamed Bassia

More Details >

Airwallex Online Payments Gateway <= 1.35.0 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103517

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Airwallex Online Payments Gateway [airwallex-online-payments-gateway]

Researcher

Pedro Pinho

More Details >

Appointment Booking Calendar <= 1.6.11.11 – Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-6723

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

awhacken

More Details >

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.7.3 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105198

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

Vũ Quang Huy

More Details >

Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.7 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39756

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Appointment Bookings for Zoom GoogleMeet and more – Wappointment [wappointment]

Researcher

Md. Minaruzzaman Shovon

More Details >

Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39762

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Autoship Cloud for WooCommerce Subscription Products [autoship-cloud]

Researcher

Averon Averenkov

More Details >

BackWPup – WordPress Backup & Restore Plugin < 5.7.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-86826

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

BackWPup – WordPress Backup & Restore Plugin [backwpup]

Researcher

Philipp Doblhofer

More Details >

BackWPup – WordPress Backup & Restore Plugin 3.3 – 5.7.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-86827

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

BackWPup – WordPress Backup & Restore Plugin [backwpup]

Researcher

Duy Tran

More Details >

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-62118

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]

Researcher

she11f

More Details >

Bayarcash WooCommerce <= 4.4.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-106609

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Bayarcash WooCommerce [bayarcash-wc]

Researcher

Nguyen Ba Khanh

More Details >

Booking Calendar < 11.8 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105193

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Booking Calendar [booking]

Researcher

Olaf Schigt

More Details >

Booking Calendar <= 11.4.3 – Unauthenticated Sensitive Information Exposure in ‘WPBC_FLEXTIMELINE_NAV’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18496

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Booking Calendar [booking]

Researcher

Jonah Burgess (CryptoCat)

More Details >

Booking Package <= 1.7.29 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105995

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Booking Package [booking-package]

Researcher

Md. Moniruzzaman Prodhan

More Details >

Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms <= 5.2.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39772

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms [captcha-bws]

Researcher

Ananda Dhakal

More Details >

click5 CRM add-on to Contact Form 7 <= 1.0.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-84254

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]

Researcher

Enrico Marcolini

More Details >

click5 CRM add-on to Gravity Forms <= 1.0.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-84253

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]

Researcher

Enrico Marcolini

More Details >

click5 CRM add-on to Ninja Forms <= 1.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-84251

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]

Researcher

Enrico Marcolini

More Details >

click5 CRM add-on to WPForms <= 1.0.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-84252

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

click5 CRM add-on to WPForms [wpf-add-on-by-click5]

Researcher

Enrico Marcolini

More Details >

Contest Gallery <= 33.0.0 – Unauthenticated Unauthorized Account Activation

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-107120

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

Akshat Parikh

More Details >

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-62128

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators [creatorlms]

Researcher

Peter Tang

More Details >

CURCY – Multi Currency for WooCommerce <= 2.2.17 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-97071

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

CURCY – Multi Currency for WooCommerce [woo-multi-currency]

Researcher

dcs

More Details >

CV Builder – Professional Resume Builder SaaS <= 1.3.1 – Missing Authorization to Unauthenticated PNG File Upload

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-3717

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WP CV Builder [cv-builder]

Researcher

Teerachai Somprasong

More Details >

DK <= 3.2.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-42706

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

DK [dk]

Researcher

Tran Nguyen Bao Khanh

More Details >

DTX – Dynamic Text Extension for Contact Form 7 <= 5.0.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-62043

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

DTX – Dynamic Text Extension for Contact Form 7 [contact-form-7-dynamic-text-extension]

Researcher

Asim Alshaya

More Details >

E-cab Taxi Booking Manager for Woocommerce <= 2.1.1 – Missing Authroization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103351

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]

Researcher

Peter Tang

More Details >

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-42638

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

Ananda Dhakal

More Details >

Easy Digital Downloads <= 3.7.0 – Unauthenticated Unauthorized Account Creation

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105190

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

Rik de Kok

More Details >

Edwiser Bridge – WordPress Moodle Integration <= 4.3.4 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39729

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Edwiser Bridge – WordPress Moodle Integration [edwiser-bridge]

Researcher

Jakub Herman

More Details >

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-62038

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]

Researcher

Jakub Herman

More Details >

Event Tickets and Registration <= 5.30.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105893

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

Matthew Lapinski

More Details >

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-97300

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

Ratchanon Chamnankit

More Details >

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103684

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

Peter Tang

More Details >

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105073

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

Peter Tang

More Details >

Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105068

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]

Researcher

Ananda Dhakal

More Details >

FireBox <= 3.1.13 – Authenticated (Author+) SQL Injection via FireBox Form Display Condition

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-104724

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment [firebox]

Researcher

Wordfence PRISM

More Details >

Fluent Affiliate Pro <= 1.6.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39789

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Fluent Affiliate Pro [fluent-affiliate-pro]

Researcher

Ananda Dhakal

More Details >

Fluent Booking Pro < 2.5.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105072

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Fluent Booking Pro [fluent-booking-pro]

Researcher

Ananda Dhakal

More Details >

Fluent Forms Pro Add On Pack <= 6.2.13 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-94669

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Fluent Forms Pro Add On Pack [fluentformpro]

Researcher

Tarcísio Luchesi

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65459

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

Ananda Dhakal

More Details >

Fundiin <= 3.4.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-81649

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Fundiin cho WooCommerce [fundiin]

Researcher(s): Unknown

More Details >

Geliver Akıllı Kargo Pazaryeri 3.0.0 – 3.1.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103378

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Geliver Akıllı Kargo Pazaryeri [geliver-akilli-kargo-pazaryeri]

Researcher

Naoki Kawahigashi

More Details >

GIFT4U – Gift Cards All in One for Woo <= 1.1.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103357

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

GIFT4U – Gift Cards All in One for Woo [gift4u-gift-cards-all-in-one-for-woo]

Researcher

dcs

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-106600

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Enis Getmez

More Details >

Grand News <= 3.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-42705

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

grandnews [grandnews]

Researcher

Tran Nguyen Bao Khanh

More Details >

Graphina – Charts and Graphs For Elementor <= 3.1.12 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39769

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]

Researcher

Ananda Dhakal

More Details >

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-104385

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

Ayukiab

More Details >

HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.14 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-106603

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

HollerBox — Fast & Effective Popups & Lead-Generation [holler-box]

Researcher

benzdeus

More Details >

Insurify <= 1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-86717

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Insurify – Order & Shipping Protection [insurify]

Researcher

Naoki Kawahigashi

More Details >

Insurify <= 1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-85121

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Insurify – Order & Shipping Protection [insurify]

Researcher

Enrico Marcolini

More Details >

Integration for Epos Now and WooCommerce 4.6.0 – 4.11.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103323

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Integration for Epos Now and WooCommerce [woo-epos-now-integration]

Researcher

Raphael P. Cigana

More Details >

Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-106601

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Jetpack – WP Security, Backup, Speed, & Growth [jetpack]

Researcher

Ananda Dhakal

More Details >

Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-106602

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Jetpack – WP Security, Backup, Speed, & Growth [jetpack]

Researcher

Ananda Dhakal

More Details >

Kit (formerly ConvertKit) for WooCommerce <= 2.2.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105421

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Kit (formerly ConvertKit) for WooCommerce [convertkit-for-woocommerce]

Researcher

Peter Tang

More Details >

Livees Checkout 6.8 – 7.0.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-86851

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Livees Checkout [livees-checkout]

Researcher

Naoki Kawahigashi

More Details >

Login Lockdown & Protection <= 2.17 – Unauthenticated Login Lockout Protection Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-97308

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Login Lockdown & Protection [login-lockdown]

Researcher

Ananda Dhakal

More Details >

Magee Shortcodes <= 2.1.1 – Unauthenticated Mail Relay

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105322

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Magee Shortcodes [magee-shortcodes]

Researcher

Erwan LR

More Details >

Mailjet Email Marketing <= 6.2.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39791

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Mailjet Email Marketing [mailjet-for-wordpress]

Researcher

Ananda Dhakal

More Details >

Modula Image Gallery – Photo Grid & Video Gallery <= 3.0.11 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105876

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]

Researcher

Peter Tang

More Details >

Morning for WooCommerce <= 2.4.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39723

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Morning for WooCommerce [wc-gateway-greeninvoice]

Researcher

ParkHyunWoo

More Details >

Motors – Car Dealer, Rental & Listing WordPress theme <= 1.4.108 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-93950

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Motors – Car Dealer, Rental & Listing WordPress theme [motors]

Researcher

Jonathan Dersch

More Details >

Motors – Car Dealership & Classified Listings Plugin <= 1.4.124 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-104399

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

Ananda Dhakal

More Details >

Museder RestoreOne <= 2.7.276 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-41561

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Museder RestoreOne [museder-restoreone]

Researcher

Ananda Dhakal

More Details >

Nexi XPay Build 7.0.0 – 7.6.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-82211

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Nexi XPay Build [nexi-xpay-build]

Researcher

Naoki Kawahigashi

More Details >

Nexi XPay Build 7.2.2 – 7.6.2 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-82212

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Nexi XPay Build [nexi-xpay-build]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

More Details >

Norvis Backup <= 1.1.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-41562

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Norvis Backup [norvis-backup]

Researcher

Ananda Dhakal

More Details >

Online Scheduling and Appointment Booking System <= 28.4 – Unauthenticated Sensitive Information Exposure in ‘phone’ Parameter to bookly_render_details

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103365

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

R3D

More Details >

Order Export & Order Import for WooCommerce <= 2.7.8 – Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-94375

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Order Export & Order Import for WooCommerce [order-import-export-for-woocommerce]

Researcher

Boluwatife Opeyemi (tcyph3r)

More Details >

Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 – Unauthenticated Arbitrary Order Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-107420

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway [cryptocurrency-payments-using-metamask-for-woocommerce]

Researcher

luffy

More Details >

PayPlug for WooCommerce (Official) <= 3.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39751

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

PayPlug for WooCommerce (Official) [payplug]

Researcher

Jakub Herman

More Details >

PayPlug for WooCommerce (Official) <= 3.1.0 – Missing Authorization to Unauthenticated Settings Change

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-42637

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

PayPlug for WooCommerce (Official) [payplug]

Researcher

Filip Kecman

More Details >

picu – Online Photo Proofing Gallery <= 3.10.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-104406

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

picu – Online Photo Proofing Gallery [picu]

Researcher

Intrudify

More Details >

Posts Password Batch Manager <= 1.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-89283

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

WP Posts Password Batch Manager [wp-posts-password-batch-manager]

Researcher

Naoki Kawahigashi

More Details >

PowerPress Podcasting plugin by Blubrry <= 11.17.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-104387

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

b1ue0cean

More Details >

PowerPress Podcasting plugin by Blubrry <= 11.17.9 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-104388

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

Peter Tang

More Details >

Quick quotes <= 1.0.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-86706

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Quick quotes – WPSHARE247 [quick-quotes-wpshare247]

Researcher

Naoki Kawahigashi

More Details >

Restrict User Access – Ultimate Membership & Content Protection <= 2.8.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-62040

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Restrict User Access – Ultimate Membership & Content Protection [restrict-user-access]

Researcher

Salúa Es-sair

More Details >

SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-41559

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

SafeSnap – Verified WordPress Backup & Restore [safesnap]

Researcher

Ananda Dhakal

More Details >

Scripts n Styles <= 3.5.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-62042

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Scripts n Styles [scripts-n-styles]

Researcher

Que Thanh Tuan

More Details >

Sell Downloads <= 1.2.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-94590

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Sell Downloads [sell-downloads]

Researcher

c4st1e

More Details >

SendPress <= 1.26.1.20 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-92990

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

SendPress Newsletters [sendpress]

Researcher

Usama Arshad

More Details >

Shipping for Nova Poshta 1.18.7 – 1.19.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-87846

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Shipping for Nova Poshta [nova-poshta-ttn]

Researcher

emiliano carrizo

More Details >

Sitemovr <= 1.0.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-41563

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Sitemovr [sitemovr]

Researcher

Ananda Dhakal

More Details >

SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105071

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

SiteVault – Backup, Restore, Migration & Cloning [sitevault-backup-restore-migration]

Researcher

Ananda Dhakal

More Details >

SKU Error Fixer for WooCommerce <= 1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-86850

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

SKU Error Fixer for WooCommerce [sku-error-fixer-for-woocommerce]

Researcher

Naoki Kawahigashi

More Details >

Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-42413

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Snapshotify – All-in-One Backup & Restore & Migrate [snapshotify]

Researcher

Ananda Dhakal

More Details >

Social Web Suite <= 4.1.12 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-88931

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]

Researcher

Naoki Kawahigashi

More Details >

Super Payments <= 1.43.0 – Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Forgery

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103329

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Super Payments – WooCommerce Payment Gateway [super-payments]

Researcher

Naoki Kawahigashi

More Details >

Swish Migrate and Backup <= 1.4.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-42419

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Swish Migrate and Backup [swish-migrate-and-backup]

Researcher

Ananda Dhakal

More Details >

The7 — Website and eCommerce Builder for WordPress <= 14.2.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66588

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

The7 — Website and eCommerce Builder for WordPress [dt-the7]

Researcher

Bonds

More Details >

Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping < 1.2.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-94275

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping [track-orders-for-woocommerce]

Researcher

Pedro Pinho

More Details >

TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 – Missing Authorization to Unauthenticated Settings Update

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39798

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

Abdullah Kareem “cyberkareem”

More Details >

TutorStarter <= 4.0.3 – Unauthenticated Unauthorized User Account Creation

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-104671

Patch Status

Patched

Published
Oct 6, 2026

Affected Software

TutorStarter [tutorstarter]

Researcher

Alexander Jurkschat

More Details >

UnitechPay <= 1.0.6.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-87841

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

UnitechPay – Wave & Orange Money Payments [unitechpay-paiements-mobile-money]

Researcher

Timur Jurayev

More Details >

WCFM – Multivendor Marketplace REST API for WooCommerce <= 1.6.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-39794

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WCFM – Multivendor Marketplace REST API for WooCommerce [wcfm-marketplace-rest-api]

Researcher

Lee chul woong

More Details >

Web Plura Backup & Restore – Local Backups, Restore & Recovery <= 0.2.25 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-42630

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Web Plura Backup & Restore – Local Backups, Restore & Recovery [web-plura-backup-restore-manager]

Researcher

Ananda Dhakal

More Details >

WeddingCity Lite <= 1.0.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-106029

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

WeddingCity Lite – Wedding Directory and Listing [weddingcity-lite]

Researcher

Naoki Kawahigashi

More Details >

WooCommerce Bookings <= 3.10.0 – Unauthenticated Denial of Service

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-14854

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WooCommerce Bookings [woocommerce-bookings]

Researcher

Mike Gozdiskowski

More Details >

WordPress Core 4.7.0 – 7.1.2 – Unauthenticated Sensitive Information Exposure via Comment Feeds

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66666

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

Ananda Dhakal

More Details >

WP Rentals – Booking Accommodation WordPress Theme <= 3.14.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-27434

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

WP Rentals – Booking Accommodation WordPress Theme [wprentals]

Researcher

João Pedro S Alcântara

More Details >

WP Rocket < 3.23.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-97075

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WP Rocket [wp-rocket]

Researcher

T.Kalimullin

More Details >

WP Rollback – Rollback Plugins and Themes <= 3.1.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66435

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

WP Rollback – Rollback Plugins and Themes [wp-rollback]

Researcher

Ananda Dhakal

More Details >

WPCafe <= 3.0.20 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-86816

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]

Researcher

Usama Arshad

More Details >

WXD Backup Lite <= 1.0.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-41560

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WXD Backup Lite [wxd-backup-lite]

Researcher

Ananda Dhakal

More Details >

XServer Migrator <= 1.6.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-102387

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

XServer Migrator [xserver-migrator]

Researcher

Ismayil Tahmazov

More Details >

YITH WooCommerce Product Add-Ons <= 4.34.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66480

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

YITH WooCommerce Product Add-Ons [yith-woocommerce-product-add-ons]

Researcher

Phat RiO | João Pedro S Alcântara

More Details >

YITH WooCommerce Product Bundles <= 2.29.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105878

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

YITH WooCommerce Product Bundles [yith-woocommerce-product-bundles]

Researcher

sungbyeongchan

More Details >

Zero Spam for WordPress <= 5.7.11 – Unauthenticated Spam Protection Bypass on Login

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105057

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Zero Spam for WordPress [zero-spam]

Researcher

Peter Tang

More Details >

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-42721

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]

Researcher

Ananda Dhakal

More Details >

Animated Number Counters <= 3.0 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-104667

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Animated Number Counters [animated-number-counters]

Researcher

Seongwon Lee

More Details >

BackWPup – WordPress Backup & Restore Plugin < 5.7.7 – Authenticated (Administrator+) Path Traversal

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-86828

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

BackWPup – WordPress Backup & Restore Plugin [backwpup]

Researcher

Bhaveshkumar Parmar

More Details >

Code Snippets <= 3.9.0 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-106097

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Code Snippets [code-snippets]

Researcher

Sarthak Saxena

More Details >

Dynamic User Directory <= 2.4 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-42720

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Dynamic User Directory [dynamic-user-directory]

Researcher

Ananda Dhakal

More Details >

Frontend Admin by DynamiApps <= 3.29.13 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-42722

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Frontend Admin by DynamiApps [acf-frontend-form-element]

Researcher

Ananda Dhakal

More Details >

Leyka <= 3.32.3 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-42717

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Leyka [leyka]

Researcher

Ananda Dhakal

More Details >

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 – Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via ‘ix[file]’ Parameter

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-104722

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Listdom: AI-powered Business Directory with Classifieds Ads Listings [listdom]

Researcher

Wordfence PRISM

More Details >

MPG <= 4.2.2 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-104953

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]

Researcher

ieuns

More Details >

Pix por Piggly (para Woocommerce) <= 2.1.2 – Authenticated (Shop Manager+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-42714

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Pix por Piggly (para Woocommerce) [pix-por-piggly]

Researcher

Ananda Dhakal

More Details >

Post Export Import with Media <= 1.17.1 – Authenticated (Administrator+) Path Traversal to Arbitrary File Read via ‘file_path’ Parameter in media_metadata.json

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-104763

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Post Export Import with Media [post-export-import-with-media]

Researcher

Wordfence PRISM

More Details >

Post title marquee scroll <= 9.9 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-42713

Patch Status

Unpatched

Published
Oct 7, 2026

Affected Software

Post title marquee scroll [post-title-marquee-scroll]

Researcher

Ananda Dhakal

More Details >

Rank Math SEO <= 1.0.279 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-104753

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

Karthik Ramakrishnan

More Details >

Smart Popup by Supsystic <= 1.13.2 – Authenticated (Administrator+) SQL Injection via ‘sidx’ Parameter

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-104023

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Smart Popup by Supsystic [popup-by-supsystic]

Researcher

Wordfence PRISM

More Details >

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 4.0.0 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-42708

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]

Researcher

Ananda Dhakal

More Details >

WP Post Author <= 4.0.0 – Authenticated (Admin+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-108124

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]

Researcher

Joshua Martinelle

More Details >

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.2 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-45440

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]

Researcher

Ananda Dhakal

More Details >

WordPress Core 6.5.0 – 7.1.2 – Authenticated (Author+) Second-Order SQL Injection via WXR Export

4.8

CVSS Rating
4.8 (Medium)

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

Anthropic

More Details >

Fluent Forms <= 6.2.14 – Reflected Cross-Site Scripting via ‘{get.*}’ Editor SmartCode Parameter

4.7

CVSS Rating
4.7 (Medium)

CVE-ID

CVE-2026-101324

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

Santh

More Details >

Import and export users and customers <= 2.5.5 – Authenticated (Editor+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)

CVE-ID

CVE-2026-104757

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

Ananda Dhakal

More Details >

JetFormBuilder <= 3.6.6 – Reflected DOM-Based Cross-Site Scripting via ‘query_var’ Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

4.7

CVSS Rating
4.7 (Medium)

CVE-ID

CVE-2026-103912

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

Zenith-sec

More Details >

PDF Invoices & Packing Slips for WooCommerce – Challan <= 3.7.88 – Authenticated (Shop Manager+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)

CVE-ID

CVE-2026-39765

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

PDF Invoices & Packing Slips for WooCommerce – Challan [webappick-pdf-invoice-for-woocommerce]

Researcher

Ananda Dhakal

More Details >

WooCommerce 9.8.0 – 11.1.2 – Authenticated (Shop Manager+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)

CVE-ID

CVE-2026-106608

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

WooCommerce [woocommerce]

Researcher

Ananda Dhakal

More Details >

WPForms <= 2.0.2.1 – Reflected Cross-Site Scripting via ‘query_var’ Smart Tag in iframe srcdoc Attribute

4.7

CVSS Rating
4.7 (Medium)

CVE-ID

CVE-2026-101921

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite]

Researcher

UKO

More Details >

Job Openings <= 3.0.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2025-15703

Patch Status

Patched

Published
Oct 10, 2026

Affected Software

HireZoot – Job Listings, Career Page & Recruitment Tool [wp-job-openings]

Researcher

Krugov Artyom

More Details >

Rank Math SEO <= 1.0.279 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-104754

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

Karthik Ramakrishnan

More Details >

Responsive Lightbox & Gallery <= 2.7.9 – Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content ‘title’ Attribute

4.4

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-103897

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Responsive Lightbox & Gallery [responsive-lightbox]

Researcher

Jakub Herman

More Details >

Academy LMS <= 3.0.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104050

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]

Researcher

Morato Antoine

More Details >

Academy LMS <= 3.0.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104049

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]

Researcher

Morato Antoine

More Details >

ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-103685

Patch Status

Patched

Published
Oct 10, 2026

Affected Software

ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce [woo-alidropship]

Researcher

Je22y

More Details >

All Bootstrap Blocks <= 1.3.31 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-62036

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

All Bootstrap Blocks [all-bootstrap-blocks]

Researcher

Bao

More Details >

App for Cloudflare® <= 1.10.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-39749

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

App for Cloudflare® [app-for-cf]

Researcher

takito

More Details >

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 – Authenticated (Custom Role+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105197

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

Muni Nitish Kumar Yaddala

More Details >

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.9 – Authenticated (Custom Role+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105196

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

Artus KG

More Details >

Appointment Booking Plugin <= 5.7.2 – Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via ‘params[presets][order_item_id]’ Parameter

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-91050

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

Supakiad S. (m3ez)

More Details >

Asgaros Forum <= 3.4.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-39779

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Asgaros Forum [asgaros-forum]

Researcher

buitu

More Details >

AutomatorWP <= 5.8.4 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104728

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI [automatorwp]

Researcher

Wordfence PRISM

More Details >

AutoPoly – AI Translation For Polylang <= 1.6.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-107419

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

AutoPoly – AI Translation For Polylang [automatic-translations-for-polylang]

Researcher

myhappyhoon

More Details >

Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-62028

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]

Researcher

Asim Alshaya

More Details >

Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104390

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Booktics – Appointment Booking Calendar for Service Businesses [booktics]

Researcher

Oly Hossen

More Details >

Comment Cleaner 6.1 – 7.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-107791

Patch Status

Patched

Published
Oct 10, 2026

Affected Software

WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments [delete-all-comments-of-website]

Researcher

Thanh Hang

More Details >

CP Media Player <= 1.3.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104678

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

CP Media Player – Audio Player and Video Player [audio-and-video-player]

Researcher

Ryan Fabella

More Details >

Dashboard Notes <= 1.0.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-62026

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Dashboard Notes [dashboard-notes]

Researcher

JunHee CHO

More Details >

Database Addon For WPForms ( wpforms entries ) – WPFormsDB < 1.1.1 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105260

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Database Addon For WPForms ( wpforms entries ) – WPFormsDB [database-for-wpforms]

Researcher

Rik de Kok

More Details >

Directory Listings WordPress plugin – uListing <= 2.2.0 – Missing Authorization to Settings Update

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-62033

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Directory Listings WordPress plugin – uListing [ulisting]

Researcher

Jakub Herman

More Details >

Disable Users <= 1.0.5 – Disabled Account Authorization Bypass

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-88827

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Disable Users [disable-users]

Researcher

Naoki Kawahigashi

More Details >

Dokan <= 5.1.0 – Authenticated (Vendor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-107694

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

Karthik Ramakrishnan

More Details >

Download Manager <= 3.3.71 – Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in ‘first_name’ Profile Field Token Injection into Suspension Email

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-103964

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Download Manager [download-manager]

Researcher

Sawyer

More Details >

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.7.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105194

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

Muni Nitish Kumar Yaddala

More Details >

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.16.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104079

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

Paul Serban

More Details >

Envira Gallery <= 1.16.1 – Authenticated (Author+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104681

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

Karthik Ramakrishnan

More Details >

Envira Gallery <= 1.16.1 – Authenticated (Author+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104684

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

Muni Nitish Kumar Yaddala

More Details >

Envira Gallery <= 1.16.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104682

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

Karthik Ramakrishnan

More Details >

Event Tickets and Registration <= 5.30.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104675

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

Intrudify

More Details >

Event Tickets and Registration <= 5.30.0.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105891

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

dzeusking

More Details >

Event Tickets and Registration <= 5.30.0.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105888

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

Erik Debye

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-106611

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

HOMEVO Adonis Orfel

More Details >

Frontend Dashboard <= 2.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-103681

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Frontend Dashboard [frontend-dashboard]

Researcher

Daniel Dhaniswara

More Details >

GDPR Data Request Form 1.5 – 1.7.1 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-85348

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

GDPR Data Request Form [gdpr-data-request-form]

Researcher

Shikhali Jamalzade

More Details >

Grocery Shopping Store <= 1.3.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-93949

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Grocery Shopping Store [grocery-shopping-store]

Researcher

Nguyen Dinh Hai (HaiND)

More Details >

Hotel Booking <= 3.8 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-84167

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Hotel Booking [nd-booking]

Researcher

Yaswanth Reddy Sunkara

More Details >

Hotel Booking <= 3.8 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-84166

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Hotel Booking [nd-booking]

Researcher

Yaswanth Reddy Sunkara

More Details >

Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-103075

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]

Researcher

Dustin Lange

More Details >

Image Photo Gallery Final Tiles Grid < 3.6.14 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104645

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]

Researcher

Ala Bouali

More Details >

Jetpack VideoPress <= 3.6 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-40808

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Jetpack VideoPress [jetpack-videopress]

Researcher

Ananda Dhakal

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-103078

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

KePulsary

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-103079

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

Rasyid Abdi Gantoro

More Details >

Memberful – Membership Plugin <= 1.81.2 – Authenticated (Contributor+) Protected Post Content Disclosure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104401

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Memberful – Membership Plugin [memberful-wp]

Researcher

sungbyeongchan

More Details >

MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.9 – Authenticated (Subscriber+) Payment Bypass

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-107434

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet [paid-membership]

Researcher

JunHee CHO

More Details >

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.19 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-108695

Patch Status

Unpatched

Published
Oct 10, 2026

Affected Software

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]

Researcher

George Chen

More Details >

Optimole 4.0.0 – 4.2.14 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-96530

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

Karthik Ramakrishnan

More Details >

Polylang <= 3.8.7 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-39783

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Polylang [polylang]

Researcher

Ananda Dhakal

More Details >

Portfolio Filter Gallery <= 2.2.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105976

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Portfolio Filter Gallery – Photo Gallery [portfolio-filter-gallery]

Researcher

Artus KG

More Details >

Portfolio Filter Gallery 2.0.2 – 2.2.0 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105977

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Portfolio Filter Gallery – Photo Gallery [portfolio-filter-gallery]

Researcher

blast

More Details >

PowerPress Podcasting plugin by Blubrry <= 11.17.9 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104407

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

Intrudify

More Details >

Pubjet <= 5.4.8 – Missing Authorization to Authenticated (Subscriber+) Settings Update

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-40802

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Pubjet | پاب‌جت [pubjet]

Researcher

Aydan Arabadzha

More Details >

QA Assistants – Driven by data <= 5.3.0.0 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105877

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

QA Assistants – Driven by data [qa-heatmap-analytics]

Researcher

Ananda Dhakal

More Details >

SendPress Newsletters <= 1.26.1.20 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-92989

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

SendPress Newsletters [sendpress]

Researcher

Enrico Marcolini

More Details >

Simple JWT Login – Allows you to use JWT on REST endpoints. 4.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-39793

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

Simple JWT Login – Allows you to use JWT on REST endpoints. [simple-jwt-login]

Researcher

Taylsec

More Details >

Simple User Registration <= 6.9 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-94235

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

MemberHero – Simple User Registration & Login [wp-registration]

Researcher

Yaswanth Reddy Sunkara

More Details >

Squadeno <= 1.11.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-107507

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Squadeno – Club Sports Manager [squadeno-club-sports-manager]

Researcher

Doston Abdullayev

More Details >

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-39721

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg [astra-sites]

Researcher

elaprendiz1927

More Details >

Th Shop Mania <= 1.9.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105883

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Th Shop Mania [th-shop-mania]

Researcher

Nguyen Dinh Hai (HaiND)

More Details >

Tutor LMS – eLearning and online course solution <= 4.1.2 – Authenticated (Subscriber+) Race Condition

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-42698

Patch Status

Unpatched

Published
Oct 8, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

Ananda Dhakal

More Details >

Tutor LMS 4.0.5 – 4.1.0 – Authenticated (Instructor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-85571

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

vuxvinh

More Details >

Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets <= 4.5.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105886

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets [ultimate-post-kit]

Researcher

Intrudify

More Details >

Unlimited Elements for Elementor <= 2.0.22 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105064

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Unlimited Elements for Elementor [unlimited-elements-for-elementor]

Researcher

Ayukiab

More Details >

Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration <= 3.1.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-62035

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration [upcasted-s3-offload]

Researcher

Dahmani Toumi

More Details >

User Private Files <= 2.1.8 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-97331

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

User Private Files – Secure File Sharing and Client Portal Plugin [user-private-files]

Researcher

Usama Arshad

More Details >

Video Conferencing with Zoom <= 4.6.10 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-103335

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Video Conferencing with Zoom [video-conferencing-with-zoom-api]

Researcher

Ananda Dhakal

More Details >

VillaTheme Core <= 1.0.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-103072

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

VillaTheme Core [villatheme-core]

Researcher

Erik Debye

More Details >

Visual Composer Website Builder <= 45.16.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-106596

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Visual Composer Website Builder [visualcomposer]

Researcher

Aarush Gaur

More Details >

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-94245

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

Stefan Spasic

More Details >

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-94246

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

Mytears

More Details >

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-94244

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

Sanyam Jain

More Details >

Wise Chat <= 3.4.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-39730

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Wise Chat [wise-chat]

Researcher

takito

More Details >

Wordable – Export Google Docs to WordPress <= 8.2.10 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-40801

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

Wordable – Export Google Docs to WordPress [wordable]

Researcher

Aydan Arabadzha

More Details >

WordPress Core 4.7.0 – 7.1.2 – Authenticated (Author+) Unauthorized Sticky Post Modification via REST API

4.3

CVSS Rating
4.3 (Medium)

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

Anthropic

More Details >

WordPress Core 4.7.0 – 7.1.2 – Authenticated (Contributor+) Denial of Service via Block Editor URL Details

4.3

CVSS Rating
4.3 (Medium)

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

Anthropic

More Details >

WP 2FA – Two-factor authentication for WordPress <= 4.1.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-62142

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

WP 2FA – Two-factor authentication for WordPress [wp-2fa]

Researcher

Filip Kowalski

More Details >

WP Admin Audit <= 1.2.17 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105062

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WP Admin Audit [wp-admin-audit]

Researcher

Nixxies

More Details >

WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments <= 7.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105059

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments [delete-all-comments-of-website]

Researcher

mamgad

More Details >

WP Dummy Content Generator <= 4.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-39763

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WP Dummy Content Generator [wp-dummy-content-generator]

Researcher

longnv719

More Details >

WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-62041

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce [wp-event-manager]

Researcher

Tai Ha (superx)

More Details >

WP Mailster <= 1.9.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105055

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WP Mailster [wp-mailster]

Researcher

Ratchanon Chamnankit

More Details >

WP Synchro – The Ultimate WordPress Migration Tool <= 1.16.1 – 2-Factor Authentication Bypass

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-41558

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WP Synchro – The Ultimate WordPress Migration Tool [wpsynchro]

Researcher

Ananda Dhakal

More Details >

WP-Invoice <= 4.3.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-97183

Patch Status

Unpatched

Published
Oct 9, 2026

Affected Software

WP-Invoice – Web Invoice and Billing [wp-invoice]

Researcher

Usama Arshad

More Details >

WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-25433

Patch Status

Unpatched

Published
Oct 5, 2026

Affected Software

WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden [wp2leads]

Researcher

johska

More Details >

WPComplete <= 2.9.5.6 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66479

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

WPComplete [wpcomplete]

Researcher

Asim Alshaya

More Details >

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-102915

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]

Researcher

Michał Wiencek

More Details >

wpsection <= 1.5.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-40777

Patch Status

Unpatched

Published
Oct 6, 2026

Affected Software

wpsection [wpsection]

Researcher

Suhayb Ahmed

More Details >

WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress <= 9.1.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104386

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]

Researcher

Zac Lou

More Details >

Yaad Sarig Payment Gateway For WC <= 2.2.12 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104651

Patch Status

Patched

Published
Oct 5, 2026

Affected Software

Yaad Sarig Payment Gateway For WC [yaad-sarig-payment-gateway-for-wc]

Researcher

Ryan Fabella

More Details >

SpeedyCache <= 1.4.2 – Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check

3.7

CVSS Rating
3.7 (Low)

CVE-ID

CVE-2026-104006

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

SpeedyCache – Cache, Optimization, Performance [speedycache]

Researcher

Kuba

More Details >

WordPress Core 4.7.0 – 7.1.2 – Conditional Action Hook Injection via Unregistered Post Status or Post Type

3.3

CVSS Rating
3.3 (Low)

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

WordPress [wordpress]

Researcher

Alex Concha

More Details >

AI Puffer <= 2.4.89 – Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint

3.1

CVSS Rating
3.1 (Low)

CVE-ID

CVE-2026-104741

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

AI Puffer – MCP, AI Chatbot & Content Automation [gpt3-ai-content-generator]

Researcher

Wordfence PRISM

More Details >

AI Puffer <= 2.4.89 – Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action

3.1

CVSS Rating
3.1 (Low)

CVE-ID

CVE-2026-104742

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

AI Puffer – MCP, AI Chatbot & Content Automation [gpt3-ai-content-generator]

Researcher

Wordfence PRISM

More Details >

Simple Membership <= 4.8.2 – Information Exposure

3.1

CVSS Rating
3.1 (Low)

CVE-ID

CVE-2026-88785

Patch Status

Patched

Published
Oct 9, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

Rafael Honorato

More Details >

Booking Calendar 10.15 – 11.8.2 – Authenticated (Editor+) Information Exposure

2.7

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-105195

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

Booking Calendar [booking]

Researcher

vuxvinh

More Details >

Code Snippets <= 3.9.0 – Missing Authorization

2.7

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-106095

Patch Status

Patched

Published
Oct 7, 2026

Affected Software

Code Snippets [code-snippets]

Researcher

Mohammed Abd Alrahman

More Details >

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery 3.6.4 – 4.0.0 – Authenticated (Administrator+) Information Exposure

2.7

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-94258

Patch Status

Patched

Published
Oct 8, 2026

Affected Software

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery [sms-alert]

Researcher

Muni Nitish Kumar Yaddala

More Details >