SolidWP https://solidwp.com/ Protect Your WordPress Website with the Best Security Available Wed, 22 Apr 2026 13:17:57 +0000 en-US hourly 1 https://wordpress.org/?v=6.8.2 https://solidwp.com/wp-content/uploads/2025/07/cropped-solidwp-favicon-2025-150x150.png SolidWP https://solidwp.com/ 32 32 WordPress Vulnerability Report — April 22, 2026 https://solidwp.com/blog/wordpress-vulnerability-report-april-22-2026/ Wed, 22 Apr 2026 13:16:46 +0000 https://solidwp.com/?p=2553145 Since last week, 216 new vulnerabilities have emerged in the WordPress ecosystem, including 187 plugins and 29 themes. Of those, 29 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

The post WordPress Vulnerability Report — April 22, 2026 appeared first on SolidWP.

]]> In this report, 216 vulnerabilities have been publicly disclosed. Security patches for 187 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 29 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.9.4 is available, addressing 10 security issues and a template loading bug. Immediate updates are recommended for all production sites.

WordPress 7.0 Release Candidate 2 (RC2) is now ready for testing via the Beta Tester plugin, direct download, WP-CLI, or WordPress Playground. As a pre-release version, it should only be evaluated in staging or local environments.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 159 Patched / 28 Unpatched

Pz-LinkCard

Plugin:
Pz-LinkCard
Plugin Slug:
pz-linkcard
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2434
The vulnerability has not been patched. You should deactivate the plugin.

Smart Online Order for Clover

Plugin:
Smart Online Order for Clover
Plugin Slug:
clover-online-orders
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-15635
The vulnerability has not been patched. You should deactivate the plugin.

Accept Cryptocurrencies with Plisio

Plugin:
Accept Cryptocurrencies with Plisio
Plugin Slug:
plisio-payment-gateway-for-woocommerce
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-6372
The vulnerability has not been patched. You should deactivate the plugin.

Quick Interest Slider

Plugin:
Quick Interest Slider
Plugin Slug:
quick-interest-slider
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-5694
The vulnerability has not been patched. You should deactivate the plugin.

Livemesh Addons for Elementor

Plugin:
Livemesh Addons for Elementor
Plugin Slug:
addons-for-elementor
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1620
The vulnerability has not been patched. You should deactivate the plugin.

Livemesh Addons for Elementor

Plugin:
Livemesh Addons for Elementor
Plugin Slug:
addons-for-elementor
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1572
The vulnerability has not been patched. You should deactivate the plugin.

Canto

Plugin:
Canto
Plugin Slug:
canto
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-6441
The vulnerability has not been patched. You should deactivate the plugin.

CMS für Motorrad Werkstätten

Plugin:
CMS für Motorrad Werkstätten
Plugin Slug:
cms-fuer-motorrad-werkstaetten
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-6451
The vulnerability has not been patched. You should deactivate the plugin.

Coachific Shortcode

Plugin:
Coachific Shortcode
Plugin Slug:
coachific-shortcode
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4005
The vulnerability has not been patched. You should deactivate the plugin.

Custom New User Notification

Plugin:
Custom New User Notification
Plugin Slug:
custom-new-user-notification
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3551
The vulnerability has not been patched. You should deactivate the plugin.

e-shot

Plugin:
e-shot
Plugin Slug:
e-shot-form-builder
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3642
The vulnerability has not been patched. You should deactivate the plugin.

Inquiry form to posts or pages

Plugin:
Inquiry form to posts or pages
Plugin Slug:
inquiry-form-to-posts-or-pages
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-6293
The vulnerability has not been patched. You should deactivate the plugin.

Katalogportal-pdf-sync Widget

Plugin:
Katalogportal-pdf-sync Widget
Plugin Slug:
katalogportal-pdf-sync
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3649
The vulnerability has not been patched. You should deactivate the plugin.

Login as User

Plugin:
Login as User
Plugin Slug:
one-click-login-as-user
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-5617
The vulnerability has not been patched. You should deactivate the plugin.

Accessibility Suite

Plugin:
Accessibility Suite
Plugin Slug:
online-accessibility
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3773
The vulnerability has not been patched. You should deactivate the plugin.

OPEN-BRAIN

Plugin:
OPEN-BRAIN
Plugin Slug:
open-brain
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3995
The vulnerability has not been patched. You should deactivate the plugin.

OPEN-BRAIN

Plugin:
OPEN-BRAIN
Plugin Slug:
open-brain
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4091
The vulnerability has not been patched. You should deactivate the plugin.

Accessibly – WordPress Website Accessibility

Plugin:
Accessibly – WordPress Website Accessibility
Plugin Slug:
otm-accessibly
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3643
The vulnerability has not been patched. You should deactivate the plugin.

Petje.af

Plugin:
Petje.af
Plugin Slug:
petje-af
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4002
The vulnerability has not been patched. You should deactivate the plugin.

Riaxe Product Customizer

Plugin:
Riaxe Product Customizer
Plugin Slug:
riaxe-product-customizer
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-3599
The vulnerability has not been patched. You should deactivate the plugin.

Riaxe Product Customizer

Plugin:
Riaxe Product Customizer
Plugin Slug:
riaxe-product-customizer
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3595
The vulnerability has not been patched. You should deactivate the plugin.

Riaxe Product Customizer

Plugin:
Riaxe Product Customizer
Plugin Slug:
riaxe-product-customizer
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-3596
The vulnerability has not been patched. You should deactivate the plugin.

VI: Include Post By

Plugin:
VI: Include Post By
Plugin Slug:
vi-include-post-by
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-5717
The vulnerability has not been patched. You should deactivate the plugin.

Visa Acceptance Solutions

Plugin:
Visa Acceptance Solutions
Plugin Slug:
visa-acceptance-solutions
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-3461
The vulnerability has not been patched. You should deactivate the plugin.

WM JqMath

Plugin:
WM JqMath
Plugin Slug:
wm-jqmath
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3998
The vulnerability has not been patched. You should deactivate the plugin.

WP Circliful

Plugin:
WP Circliful
Plugin Slug:
wp-circliful
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3659
The vulnerability has not been patched. You should deactivate the plugin.

Power Charts

Plugin:
Power Charts
Plugin Slug:
wpgo-power-charts-lite
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4011
The vulnerability has not been patched. You should deactivate the plugin.

Advanced Custom Fields (ACF®)

Plugin:
Advanced Custom Fields (ACF®)
Plugin Slug:
advanced-custom-fields
Installations
2,000,000+
Vulnerability:
Broken Access Control
Patched in Version:
6.7.1
Severity Score:
Medium
CVE:
2026-4812
The vulnerability has been patched, so you should update to version 6.7.1.

ManageWP Worker

Plugin:
ManageWP Worker
Plugin Slug:
worker
Installations
1,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.9.32
Severity Score:
High
CVE:
2026-39463
The vulnerability has been patched, so you should update to version 4.9.32.

BackWPup – WordPress Backup & Restore Plugin

Plugin:
BackWPup – WordPress Backup & Restore Plugin
Plugin Slug:
backwpup
Installations
500,000+
Vulnerability:
Local File Inclusion
Patched in Version:
5.6.7
Severity Score:
High
CVE:
2026-6227
The vulnerability has been patched, so you should update to version 5.6.7.

Meta Box

Plugin:
Meta Box
Plugin Slug:
meta-box
Installations
500,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
5.11.2
Severity Score:
Medium
CVE:
2026-39468
The vulnerability has been patched, so you should update to version 5.11.2.

WP Shortcodes Plugin — Shortcodes Ultimate

Plugin:
WP Shortcodes Plugin — Shortcodes Ultimate
Plugin Slug:
shortcodes-ultimate
Installations
400,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.5.0
Severity Score:
Medium
CVE:
2026-3885
The vulnerability has been patched, so you should update to version 7.5.0.

Page Builder Gutenberg Blocks – CoBlocks

Plugin:
Page Builder Gutenberg Blocks – CoBlocks
Plugin Slug:
coblocks
Installations
300,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.1.17
Severity Score:
Medium
CVE:
2026-4801
The vulnerability has been patched, so you should update to version 3.1.17.

Unlimited Elements For Elementor

Plugin:
Unlimited Elements For Elementor
Plugin Slug:
unlimited-elements-for-elementor
Installations
300,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
2.0.7
Severity Score:
High
CVE:
2026-4659
The vulnerability has been patched, so you should update to version 2.0.7.

PDF Invoices & Packing Slips for WooCommerce

Plugin:
PDF Invoices & Packing Slips for WooCommerce
Plugin Slug:
woocommerce-pdf-invoices-packing-slips
Installations
300,000+
Vulnerability:
PHP Object Injection
Patched in Version:
5.9.0
Severity Score:
High
CVE:
2026-39472
The vulnerability has been patched, so you should update to version 5.9.0.

CMP – Coming Soon & Maintenance Plugin by NiteoThemes

Plugin:
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
Plugin Slug:
cmp-coming-soon-maintenance
Installations
200,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
4.1.17
Severity Score:
High
CVE:
2026-6518
The vulnerability has been patched, so you should update to version 4.1.17.

Post Duplicator

Plugin:
Post Duplicator
Plugin Slug:
post-duplicator
Installations
200,000+
Vulnerability:
PHP Object Injection
Patched in Version:
3.0.11
Severity Score:
High
CVE:
2026-39474
The vulnerability has been patched, so you should update to version 3.0.11.

JetBackup – Backup, Restore & Migrate

Plugin:
JetBackup – Backup, Restore & Migrate
Plugin Slug:
backup
Installations
100,000+
Vulnerability:
Path Traversal
Patched in Version:
3.1.20.3
Severity Score:
Medium
CVE:
2026-4853
The vulnerability has been patched, so you should update to version 3.1.20.3.

Anti-Malware Security and Brute-Force Firewall

Plugin:
Anti-Malware Security and Brute-Force Firewall
Plugin Slug:
gotmls
Installations
100,000+
Vulnerability:
PHP Object Injection
Patched in Version:
4.23.88
Severity Score:
High
CVE:
2026-39478
The vulnerability has been patched, so you should update to version 4.23.88.

Kubio AI Page Builder

Plugin:
Kubio AI Page Builder
Plugin Slug:
kubio
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.7.3
Severity Score:
Medium
CVE:
2026-5427
The vulnerability has been patched, so you should update to version 2.7.3.

Modula Image Gallery – Photo Grid & Video Gallery

Plugin:
Modula Image Gallery – Photo Grid & Video Gallery
Plugin Slug:
modula-best-grid-gallery
Installations
100,000+
Vulnerability:
PHP Object Injection
Patched in Version:
2.14.19
Severity Score:
High
CVE:
2026-39481
The vulnerability has been patched, so you should update to version 2.14.19.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.9.8
Severity Score:
Medium
CVE:
2026-40743
The vulnerability has been patched, so you should update to version 3.9.8.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
SQL Injection
Patched in Version:
3.9.9
Severity Score:
High
CVE:
2026-6080
The vulnerability has been patched, so you should update to version 3.9.9.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.9.9
Severity Score:
Medium
CVE:
2026-5502
The vulnerability has been patched, so you should update to version 3.9.9.

Download Monitor

Plugin:
Download Monitor
Plugin Slug:
download-monitor
Installations
90,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
5.1.10
Severity Score:
Medium
CVE:
2026-39489
The vulnerability has been patched, so you should update to version 5.1.10.

Email Encoder – Protect Email Addresses and Phone Numbers

Plugin:
Email Encoder – Protect Email Addresses and Phone Numbers
Plugin Slug:
email-encoder-bundle
Installations
90,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.4
Severity Score:
Medium
CVE:
2024-7083
The vulnerability has been patched, so you should update to version 2.3.4.

Email Encoder – Protect Email Addresses and Phone Numbers

Plugin:
Email Encoder – Protect Email Addresses and Phone Numbers
Plugin Slug:
email-encoder-bundle
Installations
90,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.5
Severity Score:
Medium
CVE:
2026-2840
The vulnerability has been patched, so you should update to version 2.4.5.

Customer Reviews for WooCommerce

Plugin:
Customer Reviews for WooCommerce
Plugin Slug:
customer-reviews-woocommerce
Installations
80,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.102.0
Severity Score:
High
CVE:
2026-3355
The vulnerability has been patched, so you should update to version 5.102.0.

Customer Reviews for WooCommerce

Plugin:
Customer Reviews for WooCommerce
Plugin Slug:
customer-reviews-woocommerce
Installations
80,000+
Vulnerability:
Broken Authentication
Patched in Version:
5.104.0
Severity Score:
Medium
CVE:
2026-4664
The vulnerability has been patched, so you should update to version 5.104.0.

Jupiter X Core

Plugin:
Jupiter X Core
Plugin Slug:
jupiterx-core
Installations
80,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.14.2
Severity Score:
High
CVE:
2026-39490
The vulnerability has been patched, so you should update to version 4.14.2.

Jupiter X Core

Plugin:
Jupiter X Core
Plugin Slug:
jupiterx-core
Installations
80,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.14.2
Severity Score:
Medium
CVE:
2026-39491
The vulnerability has been patched, so you should update to version 4.14.2.

OneSignal – Web Push Notifications

Plugin:
OneSignal – Web Push Notifications
Plugin Slug:
onesignal-free-web-push-notifications
Installations
70,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.8.1
Severity Score:
Low
CVE:
2026-3155
The vulnerability has been patched, so you should update to version 3.8.1.

Germanized for WooCommerce

Plugin:
Germanized for WooCommerce
Plugin Slug:
woocommerce-germanized
Installations
70,000+
Vulnerability:
Content Injection
Patched in Version:
3.20.6
Severity Score:
Medium
CVE:
2026-2582
The vulnerability has been patched, so you should update to version 3.20.6.

Contextual Related Posts

Plugin:
Contextual Related Posts
Plugin Slug:
contextual-related-posts
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.2.2
Severity Score:
Medium
CVE:
2026-2986
The vulnerability has been patched, so you should update to version 4.2.2.

Drag and Drop Multiple File Upload for Contact Form 7

Plugin:
Drag and Drop Multiple File Upload for Contact Form 7
Plugin Slug:
drag-and-drop-multiple-file-upload-contact-form-7
Installations
60,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.3.9.7
Severity Score:
High
CVE:
2026-5718
The vulnerability has been patched, so you should update to version 1.3.9.7.

Drag and Drop Multiple File Upload for Contact Form 7

Plugin:
Drag and Drop Multiple File Upload for Contact Form 7
Plugin Slug:
drag-and-drop-multiple-file-upload-contact-form-7
Installations
60,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
1.3.9.7
Severity Score:
High
CVE:
2026-5710
The vulnerability has been patched, so you should update to version 1.3.9.7.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Open Redirection
Patched in Version:
5.1.5
Severity Score:
Medium
CVE:
2026-6203
The vulnerability has been patched, so you should update to version 5.1.5.

Product Filter for WooCommerce by WBW

Plugin:
Product Filter for WooCommerce by WBW
Plugin Slug:
woo-product-filter
Installations
60,000+
Vulnerability:
SQL Injection
Patched in Version:
3.1.3
Severity Score:
Critical
CVE:
2026-3830
The vulnerability has been patched, so you should update to version 3.1.3.

Product Filter for WooCommerce by WBW

Plugin:
Product Filter for WooCommerce by WBW
Plugin Slug:
woo-product-filter
Installations
60,000+
Vulnerability:
SQL Injection
Patched in Version:
3.1.3
Severity Score:
Critical
CVE:
2026-39494
The vulnerability has been patched, so you should update to version 3.1.3.

Advanced Product Fields (Product Addons) for WooCommerce

Plugin:
Advanced Product Fields (Product Addons) for WooCommerce
Plugin Slug:
advanced-product-fields-for-woocommerce
Installations
50,000+
Vulnerability:
PHP Object Injection
Patched in Version:
1.6.20
Severity Score:
High
CVE:
2026-39499
The vulnerability has been patched, so you should update to version 1.6.20.

Categories Images

Plugin:
Categories Images
Plugin Slug:
categories-images
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.3.2
Severity Score:
Medium
CVE:
2026-2505
The vulnerability has been patched, so you should update to version 3.3.2.

Better Find and Replace – AI-Powered Suggestions

Plugin:
Better Find and Replace – AI-Powered Suggestions
Plugin Slug:
real-time-auto-find-and-replace
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.8.0
Severity Score:
Medium
CVE:
2026-3369
The vulnerability has been patched, so you should update to version 1.8.0.

YayMail – WooCommerce Email Customizer

Plugin:
YayMail – WooCommerce Email Customizer
Plugin Slug:
yaymail
Installations
50,000+
Vulnerability:
PHP Object Injection
Patched in Version:
4.3.4
Severity Score:
High
CVE:
2026-39498
The vulnerability has been patched, so you should update to version 4.3.4.

Website LLMs.txt

Plugin:
Website LLMs.txt
Plugin Slug:
website-llms-txt
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
8.2.7
Severity Score:
Medium
CVE:
2026-6712
The vulnerability has been patched, so you should update to version 8.2.7.

Website LLMs.txt

Plugin:
Website LLMs.txt
Plugin Slug:
website-llms-txt
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
8.2.7
Severity Score:
Medium
CVE:
2026-6711
The vulnerability has been patched, so you should update to version 8.2.7.

WP YouTube Lyte

Plugin:
WP YouTube Lyte
Plugin Slug:
wp-youtube-lyte
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.30
Severity Score:
Medium
CVE:
2026-3299
The vulnerability has been patched, so you should update to version 1.7.30.

Social Slider Feed

Plugin:
Social Slider Feed
Plugin Slug:
instagram-slider-widget
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.3
Severity Score:
High
CVE:
2026-39507
The vulnerability has been patched, so you should update to version 2.3.3.

Payment Gateway for Redsys & WooCommerce Lite

Plugin:
Payment Gateway for Redsys & WooCommerce Lite
Plugin Slug:
woo-redsys-gateway-light
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
7.0.1
Severity Score:
High
CVE:
2026-40741
The vulnerability has been patched, so you should update to version 7.0.1.

Payment Gateway for Redsys & WooCommerce Lite

Plugin:
Payment Gateway for Redsys & WooCommerce Lite
Plugin Slug:
woo-redsys-gateway-light
Installations
20,000+
Vulnerability:
Bypass Vulnerability
Patched in Version:
7.0.1
Severity Score:
High
CVE:
2026-5050
The vulnerability has been patched, so you should update to version 7.0.1.

wpForo Forum

Plugin:
wpForo Forum
Plugin Slug:
wpforo
Installations
20,000+
Vulnerability:
Directory Traversal
Patched in Version:
3.0.6
Severity Score:
High
CVE:
2026-6248
The vulnerability has been patched, so you should update to version 3.0.6.

wpForo Forum

Plugin:
wpForo Forum
Plugin Slug:
wpforo
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.0.0
Severity Score:
Medium
CVE:
2026-4666
The vulnerability has been patched, so you should update to version 3.0.0.

wpForo Forum

Plugin:
wpForo Forum
Plugin Slug:
wpforo
Installations
20,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
3.0.3
Severity Score:
High
CVE:
2026-5809
The vulnerability has been patched, so you should update to version 3.0.3.

WPZOOM Addons for Elementor – Starter Templates & Widgets

Plugin:
WPZOOM Addons for Elementor – Starter Templates & Widgets
Plugin Slug:
wpzoom-elementor-addons
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.5
Severity Score:
High
CVE:
2026-39597
The vulnerability has been patched, so you should update to version 1.3.5.

Content Blocks (Custom Post Widget)

Plugin:
Content Blocks (Custom Post Widget)
Plugin Slug:
custom-post-widget
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.4.1
Severity Score:
Medium
CVE:
2026-0894
The vulnerability has been patched, so you should update to version 3.4.1.

WP Customer Area

Plugin:
WP Customer Area
Plugin Slug:
customer-area
Installations
10,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
8.3.5
Severity Score:
High
CVE:
2026-3464
The vulnerability has been patched, so you should update to version 8.3.5.

Easy Appointments

Plugin:
Easy Appointments
Plugin Slug:
easy-appointments
Installations
10,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
3.12.22
Severity Score:
High
CVE:
2026-2262
The vulnerability has been patched, so you should update to version 3.12.22.

Easy Appointments

Plugin:
Easy Appointments
Plugin Slug:
easy-appointments
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.12.22
Severity Score:
High
CVE:
2026-39513
The vulnerability has been patched, so you should update to version 3.12.22.

EMC – Easily Embed Calendly Scheduling

Plugin:
EMC – Easily Embed Calendly Scheduling
Plugin Slug:
embed-calendly-scheduling
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.5
Severity Score:
Medium
CVE:
2026-0868
The vulnerability has been patched, so you should update to version 4.5.

WP Photo Album Plus

Plugin:
WP Photo Album Plus
Plugin Slug:
wp-photo-album-plus
Installations
10,000+
Vulnerability:
SQL Injection
Patched in Version:
9.1.08.002
Severity Score:
Critical
CVE:
2026-39511
The vulnerability has been patched, so you should update to version 9.1.08.002.

YML for Yandex Market

Plugin:
YML for Yandex Market
Plugin Slug:
yml-for-yandex-market
Installations
10,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
5.0.26
Severity Score:
High
CVE:
2025-14545
The vulnerability has been patched, so you should update to version 5.0.26.

WCAPF – Ajax Product Filter for WooCommerce

Plugin:
WCAPF – Ajax Product Filter for WooCommerce
Plugin Slug:
wc-ajax-product-filter
Installations
9,000+
Vulnerability:
SQL Injection
Patched in Version:
4.3.0
Severity Score:
Critical
CVE:
2026-3396
The vulnerability has been patched, so you should update to version 4.3.0.

EventPrime – Events Calendar, Bookings and Tickets

Plugin:
EventPrime – Events Calendar, Bookings and Tickets
Plugin Slug:
eventprime-event-calendar-management
Installations
7,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
4.3.0.1
Severity Score:
High
CVE:
2026-39518
The vulnerability has been patched, so you should update to version 4.3.0.1.

ActivityPub

Plugin:
ActivityPub
Plugin Slug:
activitypub
Installations
6,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
8.0.2
Severity Score:
High
CVE:
2026-4338
The vulnerability has been patched, so you should update to version 8.0.2.

Nexi XPay

Plugin:
Nexi XPay
Plugin Slug:
cartasi-x-pay
Installations
6,000+
Vulnerability:
Broken Access Control
Patched in Version:
8.3.2
Severity Score:
Medium
CVE:
2025-15565
The vulnerability has been patched, so you should update to version 8.3.2.

Booking Activities

Plugin:
Booking Activities
Plugin Slug:
booking-activities
Installations
4,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.17.0
Severity Score:
Medium
CVE:
2026-39525
The vulnerability has been patched, so you should update to version 1.17.0.

Notification for Telegram

Plugin:
Notification for Telegram
Plugin Slug:
notification-for-telegram
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.5.1
Severity Score:
High
CVE:
2026-40732
The vulnerability has been patched, so you should update to version 3.5.1.

Responsive Blocks – Page Builder for Blocks & Patterns

Plugin:
Responsive Blocks – Page Builder for Blocks & Patterns
Plugin Slug:
responsive-block-editor-addons
Installations
4,000+
Vulnerability:
Open Redirection
Patched in Version:
2.2.1
Severity Score:
Medium
CVE:
2026-6675
The vulnerability has been patched, so you should update to version 2.2.1.

Basic Google Maps Placemarks

Plugin:
Basic Google Maps Placemarks
Plugin Slug:
basic-google-maps-placemarks
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.10.8
Severity Score:
Medium
CVE:
2026-3581
The vulnerability has been patched, so you should update to version 1.10.8.

Events Calendar for GeoDirectory

Plugin:
Events Calendar for GeoDirectory
Plugin Slug:
events-for-geodirectory
Installations
3,000+
Vulnerability:
PHP Object Injection
Patched in Version:
2.3.26
Severity Score:
High
CVE:
2026-39532
The vulnerability has been patched, so you should update to version 2.3.26.

Image Source Control Lite – Show Image Credits and Captions

Plugin:
Image Source Control Lite – Show Image Credits and Captions
Plugin Slug:
image-source-control-isc
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.9.2
Severity Score:
Medium
CVE:
2026-4852
The vulnerability has been patched, so you should update to version 3.9.2.

SpeakOut! Email Petitions

Plugin:
SpeakOut! Email Petitions
Plugin Slug:
speakout
Installations
3,000+
Vulnerability:
SQL Injection
Patched in Version:
4.6.5.1
Severity Score:
Critical
CVE:
2026-39530
The vulnerability has been patched, so you should update to version 4.6.5.1.

WP Directory Kit

Plugin:
WP Directory Kit
Plugin Slug:
wpdirectorykit
Installations
3,000+
Vulnerability:
SQL Injection
Patched in Version:
1.5.1
Severity Score:
Critical
CVE:
2026-39531
The vulnerability has been patched, so you should update to version 1.5.1.

Prismatic

Plugin:
Prismatic
Plugin Slug:
prismatic
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.7.4
Severity Score:
High
CVE:
2026-3876
The vulnerability has been patched, so you should update to version 3.7.4.

Shipment Tracker for Woocommerce

Plugin:
Shipment Tracker for Woocommerce
Plugin Slug:
shipment-tracker-for-woocommerce
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.3.3
Severity Score:
Medium
CVE:
2026-39540
The vulnerability has been patched, so you should update to version 1.5.3.3.

MyRewards

Plugin:
MyRewards
Plugin Slug:
woorewards
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.7.4
Severity Score:
Medium
CVE:
2026-40786
The vulnerability has been patched, so you should update to version 5.7.4.

Mini Ajax Cart for WooCommerce

Plugin:
Mini Ajax Cart for WooCommerce
Plugin Slug:
mini-ajax-woo-cart
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.5
Severity Score:
Medium
CVE:
2026-6370
The vulnerability has been patched, so you should update to version 1.3.5.

WP Docs

Plugin:
WP Docs
Plugin Slug:
wp-docs
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.0
Severity Score:
Medium
CVE:
2026-3878
The vulnerability has been patched, so you should update to version 2.3.0.

InPost Gallery

Plugin:
InPost Gallery
Plugin Slug:
inpost-gallery
Installations
800+
Vulnerability:
SQL Injection
Patched in Version:
2.1.5
Severity Score:
Critical
CVE:
2026-39574
The vulnerability has been patched, so you should update to version 2.1.5.

WP Sessions Time Monitoring Full Automatic

Plugin:
WP Sessions Time Monitoring Full Automatic
Plugin Slug:
activitytime
Installations
600+
Vulnerability:
SQL Injection
Patched in Version:
1.1.5
Severity Score:
High
CVE:
2026-39581
The vulnerability has been patched, so you should update to version 1.1.5.

List View Google Calendar

Plugin:
List View Google Calendar
Plugin Slug:
list-view-google-calendar
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.4.4
Severity Score:
Medium
CVE:
2026-2396
The vulnerability has been patched, so you should update to version 7.4.4.

Webling

Plugin:
Webling
Plugin Slug:
webling
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.9.1
Severity Score:
Medium
CVE:
2026-1263
The vulnerability has been patched, so you should update to version 3.9.1.

Flipbox Addon for Elementor

Plugin:
Flipbox Addon for Elementor
Plugin Slug:
ultimate-flipbox-addon-for-elementor
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.2
Severity Score:
Medium
CVE:
2026-6048
The vulnerability has been patched, so you should update to version 2.1.2.

BuddyPress Groupblog

Plugin:
BuddyPress Groupblog
Plugin Slug:
bp-groupblog
Installations
50+
Vulnerability:
Privilege Escalation
Patched in Version:
1.9.4
Severity Score:
High
CVE:
2026-5144
The vulnerability has been patched, so you should update to version 1.9.4.

Ultra Addons for WPForms

Plugin:
Ultra Addons for WPForms
Plugin Slug:
ultra-addons-for-wpforms
Installations
40+
Vulnerability:
Broken Access Control
Patched in Version:
1.0.12
Severity Score:
Medium
CVE:
2026-39594
The vulnerability has been patched, so you should update to version 1.0.12.

Hostel

Plugin:
Hostel
Plugin Slug:
hostel
Installations
30+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.7
Severity Score:
High
CVE:
2026-1838
The vulnerability has been patched, so you should update to version 1.1.7.

HAPPY – Helpdesk Support Ticket System

Plugin:
HAPPY – Helpdesk Support Ticket System
Plugin Slug:
happy-helpdesk-support-ticket-system
Installations
10+
Vulnerability:
Broken Access Control
Patched in Version:
1.0.11
Severity Score:
Medium
CVE:
2026-39593
The vulnerability has been patched, so you should update to version 1.0.11.

Surbma | Booking.com Shortcode

Plugin:
Surbma | Booking.com Shortcode
Plugin Slug:
surbma-bookingcom-shortcode
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.1
Severity Score:
Medium
CVE:
2026-1607
The vulnerability has been patched, so you should update to version 2.1.1.

WholeSale Products Dynamic Pricing Management WooCommerce

Plugin:
WholeSale Products Dynamic Pricing Management WooCommerce
Plugin Slug:
wholesale-products-dynamic-pricing-management-woocommerce
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.0
Severity Score:
Medium
CVE:
2026-4479
The vulnerability has been patched, so you should update to version 1.3.0.

Academy LMS Pro

Plugin:
Academy LMS Pro
Plugin Slug:
academy-pro
Vulnerability:
Arbitrary File Upload
Patched in Version:
3.5.2
Severity Score:
High
CVE:
2026-39598
The vulnerability has been patched, so you should update to version 3.5.2.

Accordion and Accordion Slider

Plugin:
Accordion and Accordion Slider
Plugin Slug:
accordion-and-accordion-slider
Vulnerability:
Backdoor
Patched in Version:
1.4.6.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 1.4.6.1.

Album and Image Gallery plus Lightbox

Plugin:
Album and Image Gallery plus Lightbox
Plugin Slug:
album-and-image-gallery-plus-lightbox
Vulnerability:
Backdoor
Patched in Version:
2.1.8.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 2.1.8.1.

Blog Designer – Post and Widget

Plugin:
Blog Designer – Post and Widget
Plugin Slug:
blog-designer-for-post-and-widget
Vulnerability:
Backdoor
Patched in Version:
2.7.7.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 2.7.7.1.

Career Section

Plugin:
Career Section
Plugin Slug:
career-section
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.7
Severity Score:
High
CVE:
2025-14868
The vulnerability has been patched, so you should update to version 1.7.

Countdown Timer Ultimate

Plugin:
Countdown Timer Ultimate
Plugin Slug:
countdown-timer-ultimate
Vulnerability:
Backdoor
Patched in Version:
2.6.9.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 2.6.9.1.

Featured Post Creative

Plugin:
Featured Post Creative
Plugin Slug:
featured-post-creative
Vulnerability:
Backdoor
Patched in Version:
1.5.7.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 1.5.7.1.

Fusion Builder

Plugin:
Fusion Builder
Plugin Slug:
fusion-builder
Vulnerability:
Content Injection
Patched in Version:
3.15.2
Severity Score:
Medium
CVE:
2026-1509
The vulnerability has been patched, so you should update to version 3.15.2.

Fusion Builder

Plugin:
Fusion Builder
Plugin Slug:
fusion-builder
Vulnerability:
Sensitive Data Exposure
Patched in Version:
3.15.2
Severity Score:
Medium
CVE:
2026-1541
The vulnerability has been patched, so you should update to version 3.15.2.

Gravity SMTP

Plugin:
Gravity SMTP
Plugin Slug:
gravitysmtp
Vulnerability:
Broken Access Control
Patched in Version:
2.1.5
Severity Score:
High
CVE:
2026-4162
The vulnerability has been patched, so you should update to version 2.1.5.

Video gallery and Player

Plugin:
Video gallery and Player
Plugin Slug:
html5-videogallery-plus-player
Vulnerability:
Backdoor
Patched in Version:
2.8.7.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 2.8.7.1.

JetEngine

Plugin:
JetEngine
Plugin Slug:
jet-engine
Vulnerability:
SQL Injection
Patched in Version:
3.8.6.2
Severity Score:
Critical
CVE:
2026-4352
The vulnerability has been patched, so you should update to version 3.8.6.2.

Client Portal (Pro)

Plugin:
Client Portal (Pro)
Plugin Slug:
leco-client-portal
Vulnerability:
Arbitrary File Download
Patched in Version:
5.6.3
Severity Score:
Medium
CVE:
2026-40724
The vulnerability has been patched, so you should update to version 5.6.3.

Meta slider and carousel with lightbox

Plugin:
Meta slider and carousel with lightbox
Plugin Slug:
meta-slider-and-carousel-with-lightbox
Vulnerability:
Backdoor
Patched in Version:
2.0.8.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 2.0.8.1.

MetForm Pro

Plugin:
MetForm Pro
Plugin Slug:
metform-pro
Vulnerability:
Broken Access Control
Patched in Version:
3.9.8
Severity Score:
Medium
CVE:
2026-1782
The vulnerability has been patched, so you should update to version 3.9.8.

Popup Anything

Plugin:
Popup Anything
Plugin Slug:
popup-anything-on-click
Vulnerability:
Backdoor
Patched in Version:
2.9.1.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 2.9.1.1.

Portfolio and Projects

Plugin:
Portfolio and Projects
Plugin Slug:
portfolio-and-projects
Vulnerability:
Backdoor
Patched in Version:
1.5.6.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 1.5.6.1.

Post grid and filter ultimate

Plugin:
Post grid and filter ultimate
Plugin Slug:
post-grid-and-filter-ultimate
Vulnerability:
Backdoor
Patched in Version:
1.7.4.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 1.7.4.1.

WP responsive FAQ with category

Plugin:
WP responsive FAQ with category
Plugin Slug:
sp-faq
Vulnerability:
Backdoor
Patched in Version:
3.9.5.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 3.9.5.1.

WP News and Scrolling Widgets

Plugin:
WP News and Scrolling Widgets
Plugin Slug:
sp-news-and-widget
Vulnerability:
Backdoor
Patched in Version:
5.0.6.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 5.0.6.1.

WowShipping Pro

Plugin:
WowShipping Pro
Plugin Slug:
table-rate-shipping-pro
Vulnerability:
Backdoor
Patched in Version:
1.0.8
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 1.0.8.

Post Ticker Ultimate

Plugin:
Post Ticker Ultimate
Plugin Slug:
ticker-ultimate
Vulnerability:
Backdoor
Patched in Version:
1.7.6.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 1.7.6.1.

Timeline and History slider

Plugin:
Timeline and History slider
Plugin Slug:
timeline-and-history-slider
Vulnerability:
Backdoor
Patched in Version:
2.4.5.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 2.4.5.1.

User Registration Stripe

Plugin:
User Registration Stripe
Plugin Slug:
user-registration-stripe
Vulnerability:
Broken Access Control
Patched in Version:
1.3.15
Severity Score:
High
CVE:
2026-40726
The vulnerability has been patched, so you should update to version 1.3.15.

Userpro

Plugin:
Userpro
Plugin Slug:
userpro
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
5.1.11
Severity Score:
Medium
CVE:
2025-53444
The vulnerability has been patched, so you should update to version 5.1.11.

Product Pricing Table by WooBeWoo

Plugin:
Product Pricing Table by WooBeWoo
Plugin Slug:
woo-product-pricing-tables
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.1
Severity Score:
High
CVE:
2026-1852
The vulnerability has been patched, so you should update to version 1.1.1.

WooCommerce Product Filters

Plugin:
WooCommerce Product Filters
Plugin Slug:
woocommerce-product-filters
Vulnerability:
PHP Object Injection
Patched in Version:
2.0.6
Severity Score:
Critical
CVE:
2026-40725
The vulnerability has been patched, so you should update to version 2.0.6.

WP Blog and Widget

Plugin:
WP Blog and Widget
Plugin Slug:
wp-blog-and-widgets
Vulnerability:
Backdoor
Patched in Version:
2.6.6.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 2.6.6.1.

WP Featured Content and Slider

Plugin:
WP Featured Content and Slider
Plugin Slug:
wp-featured-content-and-slider
Vulnerability:
Backdoor
Patched in Version:
1.7.6.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 1.7.6.1.

WP Logo Showcase Responsive Slider and Carousel

Plugin:
WP Logo Showcase Responsive Slider and Carousel
Plugin Slug:
wp-logo-showcase-responsive-slider-slider
Vulnerability:
Backdoor
Patched in Version:
3.8.7.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 3.8.7.1.

WP Responsive Recent Post Slider/Carousel

Plugin:
WP Responsive Recent Post Slider/Carousel
Plugin Slug:
wp-responsive-recent-post-slider
Vulnerability:
Backdoor
Patched in Version:
3.7.1.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 3.7.1.1.

WP Slick Slider and Image Carousel

Plugin:
WP Slick Slider and Image Carousel
Plugin Slug:
wp-slick-slider-and-image-carousel
Vulnerability:
Backdoor
Patched in Version:
3.7.8.2
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 3.7.8.2.

Team Slider and Team Grid Showcase plus Team Carousel

Plugin:
Team Slider and Team Grid Showcase plus Team Carousel
Plugin Slug:
wp-team-showcase-and-slider
Vulnerability:
Backdoor
Patched in Version:
2.8.6.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 2.8.6.1.

Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget

Plugin:
Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget
Plugin Slug:
wp-testimonial-with-widget
Vulnerability:
Backdoor
Patched in Version:
3.5.6.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 3.5.6.1.

Trending/Popular Post Slider and Widget

Plugin:
Trending/Popular Post Slider and Widget
Plugin Slug:
wp-trending-post-slider-and-widget
Vulnerability:
Backdoor
Patched in Version:
1.8.6.1
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 1.8.6.1.

Royal Elementor Addons Pro

Plugin:
Royal Elementor Addons Pro
Plugin Slug:
wpr-addons-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.1041
Severity Score:
High
CVE:
2026-40720
The vulnerability has been patched, so you should update to version 1.7.1041.

WordPress Themes — 28 Patched / 1 Unpatched

WebStack

Theme:
WebStack
Theme Slug:
webstack
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-1555
The vulnerability has not been patched. You should switch themes.

Charity Zone

Theme:
Charity Zone
Theme Slug:
charity-zone
Downloads
112,126
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.1.2
Severity Score:
Critical
CVE:
2026-40749
The vulnerability has been patched, so you should update to version 1.1.2.

Ecommerce Zone

Theme:
Ecommerce Zone
Theme Slug:
ecommerce-zone
Downloads
89,443
Vulnerability:
Arbitrary File Upload
Patched in Version:
0.9.8
Severity Score:
Critical
CVE:
2026-40747
The vulnerability has been patched, so you should update to version 0.9.8.

Kids Gift Shop

Theme:
Kids Gift Shop
Theme Slug:
kids-gift-shop
Downloads
20,521
Vulnerability:
Arbitrary File Upload
Patched in Version:
0.5.5
Severity Score:
Critical
CVE:
2026-40748
The vulnerability has been patched, so you should update to version 0.5.5.

Kids Online Store

Theme:
Kids Online Store
Theme Slug:
kids-online-store
Downloads
53,065
Vulnerability:
Arbitrary File Upload
Patched in Version:
0.9.0
Severity Score:
Critical
CVE:
2026-40750
The vulnerability has been patched, so you should update to version 0.9.0.

Restaurant Zone

Theme:
Restaurant Zone
Theme Slug:
restaurant-zone
Downloads
80,108
Vulnerability:
Arbitrary File Upload
Patched in Version:
0.7.9
Severity Score:
Critical
CVE:
2026-40746
The vulnerability has been patched, so you should update to version 0.7.9.

Vantage

Theme:
Vantage
Theme Slug:
vantage
Downloads
3,232,270
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.20.33
Severity Score:
Medium
CVE:
2026-5070
The vulnerability has been patched, so you should update to version 1.20.33.

Webenvo

Theme:
Webenvo
Theme Slug:
webenvo
Downloads
10,224
Vulnerability:
Arbitrary File Upload
Patched in Version:
0.0.7
Severity Score:
Critical
CVE:
2026-39589
The vulnerability has been patched, so you should update to version 0.0.7.

Ashtanga

Theme:
Ashtanga
Theme Slug:
ashtanga
Vulnerability:
PHP Object Injection
Patched in Version:
1.3
Severity Score:
High
CVE:
2026-40751
The vulnerability has been patched, so you should update to version 1.3.

Atomlab

Theme:
Atomlab
Theme Slug:
atomlab
Vulnerability:
Local File Inclusion
Patched in Version:
2.4.6
Severity Score:
High
CVE:
2026-39590
The vulnerability has been patched, so you should update to version 2.4.6.

Behold

Theme:
Behold
Theme Slug:
behold
Vulnerability:
PHP Object Injection
Patched in Version:
1.6
Severity Score:
High
CVE:
2026-40760
The vulnerability has been patched, so you should update to version 1.6.

ChapterOne

Theme:
ChapterOne
Theme Slug:
chapterone
Vulnerability:
Local File Inclusion
Patched in Version:
1.8
Severity Score:
High
CVE:
2026-40731
The vulnerability has been patched, so you should update to version 1.8.

Château

Theme:
Château
Theme Slug:
chateau
Vulnerability:
PHP Object Injection
Patched in Version:
1.3
Severity Score:
High
CVE:
2026-40757
The vulnerability has been patched, so you should update to version 1.3.

EasyMeals

Theme:
EasyMeals
Theme Slug:
easymeals
Vulnerability:
PHP Object Injection
Patched in Version:
1.6
Severity Score:
High
CVE:
2026-40753
The vulnerability has been patched, so you should update to version 1.6.

Eldon

Theme:
Eldon
Theme Slug:
eldon
Vulnerability:
PHP Object Injection
Patched in Version:
1.5
Severity Score:
High
CVE:
2026-40738
The vulnerability has been patched, so you should update to version 1.5.

Eleganzo

Theme:
Eleganzo
Theme Slug:
eleganzo
Vulnerability:
Path Traversal
Patched in Version:
1.3
Severity Score:
Medium
CVE:
2025-15470
The vulnerability has been patched, so you should update to version 1.3.

Elementra

Theme:
Elementra
Theme Slug:
elementra
Vulnerability:
PHP Object Injection
Patched in Version:
1.1.0
Severity Score:
Critical
CVE:
2026-39529
The vulnerability has been patched, so you should update to version 1.1.0.

Esmée

Theme:
Esmée
Theme Slug:
esme
Vulnerability:
PHP Object Injection
Patched in Version:
1.5
Severity Score:
High
CVE:
2026-40759
The vulnerability has been patched, so you should update to version 1.5.

Laurits

Theme:
Laurits
Theme Slug:
laurits
Vulnerability:
PHP Object Injection
Patched in Version:
1.6
Severity Score:
High
CVE:
2026-40736
The vulnerability has been patched, so you should update to version 1.6.

Léonie

Theme:
Léonie
Theme Slug:
lonie
Vulnerability:
PHP Object Injection
Patched in Version:
1.3
Severity Score:
High
CVE:
2026-40758
The vulnerability has been patched, so you should update to version 1.3.

LuxeDrive

Theme:
LuxeDrive
Theme Slug:
luxedrive
Vulnerability:
PHP Object Injection
Patched in Version:
1.5
Severity Score:
High
CVE:
2026-40739
The vulnerability has been patched, so you should update to version 1.5.

MagOne

Theme:
MagOne
Theme Slug:
magone
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
9.1
Severity Score:
High
CVE:
2026-39548
The vulnerability has been patched, so you should update to version 9.1.

Manufaktur Solutions

Theme:
Manufaktur Solutions
Theme Slug:
manufaktursolutions
Vulnerability:
PHP Object Injection
Patched in Version:
1.2
Severity Score:
High
CVE:
2026-40752
The vulnerability has been patched, so you should update to version 1.2.

Reina

Theme:
Reina
Theme Slug:
reina
Vulnerability:
PHP Object Injection
Patched in Version:
2.2
Severity Score:
High
CVE:
2026-40735
The vulnerability has been patched, so you should update to version 2.2.

Roisin

Theme:
Roisin
Theme Slug:
roisin
Vulnerability:
PHP Object Injection
Patched in Version:
1.5
Severity Score:
High
CVE:
2026-40754
The vulnerability has been patched, so you should update to version 1.5.

ShiftUp

Theme:
ShiftUp
Theme Slug:
shiftup
Vulnerability:
PHP Object Injection
Patched in Version:
1.4
Severity Score:
High
CVE:
2026-40733
The vulnerability has been patched, so you should update to version 1.4.

TechLink

Theme:
TechLink
Theme Slug:
techlink
Vulnerability:
PHP Object Injection
Patched in Version:
1.4
Severity Score:
High
CVE:
2026-40755
The vulnerability has been patched, so you should update to version 1.4.

Valeska

Theme:
Valeska
Theme Slug:
valeska
Vulnerability:
PHP Object Injection
Patched in Version:
1.3
Severity Score:
High
CVE:
2026-40761
The vulnerability has been patched, so you should update to version 1.3.

Zoya

Theme:
Zoya
Theme Slug:
zoya
Vulnerability:
PHP Object Injection
Patched in Version:
1.5
Severity Score:
High
CVE:
2026-40756
The vulnerability has been patched, so you should update to version 1.5.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — April 22, 2026 appeared first on SolidWP.

]]> WordPress Vulnerability Report — April 15, 2026 https://solidwp.com/blog/wordpress-vulnerability-report-april-15-2026/ Wed, 15 Apr 2026 13:23:50 +0000 https://solidwp.com/?p=2553131 Since last week, 185 new vulnerabilities have emerged in the WordPress ecosystem, including 161 plugins and 24 themes. Of those, 16 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

The post WordPress Vulnerability Report — April 15, 2026 appeared first on SolidWP.

]]> In this report, 185 vulnerabilities have been publicly disclosed. Security patches for 169 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 16 plugin vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.9.4 is available, addressing 10 security issues and a template loading bug. Immediate updates are recommended for all production sites.

WordPress 7.0 Release Candidate 2 (RC2) is now ready for testing via the Beta Tester plugin, direct download, WP-CLI, or WordPress Playground. As a pre-release version, it should only be evaluated in staging or local environments.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 145 Patched / 16 Unpatched

AM LottiePlayer

Plugin:
AM LottiePlayer
Plugin Slug:
am-lottieplayer
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-1794
The vulnerability has not been patched. You should deactivate the plugin.

Attendance Manager

Plugin:
Attendance Manager
Plugin Slug:
attendance-manager
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3781
The vulnerability has not been patched. You should deactivate the plugin.

Columns by BestWebSoft

Plugin:
Columns by BestWebSoft
Plugin Slug:
columns-bws
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3618
The vulnerability has not been patched. You should deactivate the plugin.

DSGVO Google Web Fonts GDPR

Plugin:
DSGVO Google Web Fonts GDPR
Plugin Slug:
dsgvo-google-web-fonts-gdpr
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-3535
The vulnerability has not been patched. You should deactivate the plugin.

Gerador de Certificados – DevApps

Plugin:
Gerador de Certificados – DevApps
Plugin Slug:
gerador-de-certificados-devapps
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-4808
The vulnerability has not been patched. You should deactivate the plugin.

Inquiry form to posts or pages

Plugin:
Inquiry form to posts or pages
Plugin Slug:
inquiry-form-to-posts-or-pages
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-5169
The vulnerability has not been patched. You should deactivate the plugin.

Pinterest Site Verification plugin using Meta Tag

Plugin:
Pinterest Site Verification plugin using Meta Tag
Plugin Slug:
pinterest-site-verification
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3142
The vulnerability has not been patched. You should deactivate the plugin.

pz-frontend-manager

Plugin:
pz-frontend-manager
Plugin Slug:
pz-frontend-manager
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3477
The vulnerability has not been patched. You should deactivate the plugin.

Quran Translations

Plugin:
Quran Translations
Plugin Slug:
quran-translations-by-edc
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4141
The vulnerability has not been patched. You should deactivate the plugin.

Riaxe Product Customizer

Plugin:
Riaxe Product Customizer
Plugin Slug:
riaxe-product-customizer
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3594
The vulnerability has not been patched. You should deactivate the plugin.

Sports Club Management

Plugin:
Sports Club Management
Plugin Slug:
sports-club-management
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4871
The vulnerability has not been patched. You should deactivate the plugin.

Wavr

Plugin:
Wavr
Plugin Slug:
wavr
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-5506
The vulnerability has not been patched. You should deactivate the plugin.

Whole Enquiry Cart for WooCommerce

Plugin:
Whole Enquiry Cart for WooCommerce
Plugin Slug:
whole-cart-enquiry
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2838
The vulnerability has not been patched. You should deactivate the plugin.

IDPay Payment Gateway for Woocommerce

Plugin:
IDPay Payment Gateway for Woocommerce
Plugin Slug:
woo-idpay-gateway
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-34891
The vulnerability has not been patched. You should deactivate the plugin.

WowPress

Plugin:
WowPress
Plugin Slug:
wowpress
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-5508
The vulnerability has not been patched. You should deactivate the plugin.

WP Blockade

Plugin:
WP Blockade
Plugin Slug:
wp-blockade
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3480
The vulnerability has not been patched. You should deactivate the plugin.

ManageWP Worker

Plugin:
ManageWP Worker
Plugin Slug:
worker
Installations
1,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.9.32
Severity Score:
High
CVE:
2026-39463
The vulnerability has been patched, so you should update to version 4.9.32.

Smart Slider 3

Plugin:
Smart Slider 3
Plugin Slug:
smart-slider-3
Installations
800,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.5.1.34
Severity Score:
Medium
CVE:
2026-4065
The vulnerability has been patched, so you should update to version 3.5.1.34.

BackWPup – WordPress Backup & Restore Plugin

Plugin:
BackWPup – WordPress Backup & Restore Plugin
Plugin Slug:
backwpup
Installations
500,000+
Vulnerability:
Local File Inclusion
Patched in Version:
5.6.7
Severity Score:
High
CVE:
2026-6227
The vulnerability has been patched, so you should update to version 5.6.7.

Meta Box

Plugin:
Meta Box
Plugin Slug:
meta-box
Installations
500,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
5.11.2
Severity Score:
Medium
CVE:
2026-39468
The vulnerability has been patched, so you should update to version 5.11.2.

Ocean Extra

Plugin:
Ocean Extra
Plugin Slug:
ocean-extra
Installations
500,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.5.4
Severity Score:
Medium
CVE:
2026-34903
The vulnerability has been patched, so you should update to version 2.5.4.

YITH WooCommerce Wishlist

Plugin:
YITH WooCommerce Wishlist
Plugin Slug:
yith-woocommerce-wishlist
Installations
500,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
4.13.0
Severity Score:
Medium
CVE:
2026-4432
The vulnerability has been patched, so you should update to version 4.13.0.

Page Builder: Pagelayer – Drag and Drop website builder

Plugin:
Page Builder: Pagelayer – Drag and Drop website builder
Plugin Slug:
pagelayer
Installations
400,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.9
Severity Score:
Medium
CVE:
2026-2509
The vulnerability has been patched, so you should update to version 2.0.9.

MW WP Form

Plugin:
MW WP Form
Plugin Slug:
mw-wp-form
Installations
200,000+
Vulnerability:
Directory Traversal
Patched in Version:
5.1.2
Severity Score:
High
CVE:
2026-5436
The vulnerability has been patched, so you should update to version 5.1.2.

Post Duplicator

Plugin:
Post Duplicator
Plugin Slug:
post-duplicator
Installations
200,000+
Vulnerability:
PHP Object Injection
Patched in Version:
3.0.11
Severity Score:
High
CVE:
2026-39474
The vulnerability has been patched, so you should update to version 3.0.11.

Aruba HiSpeed Cache

Plugin:
Aruba HiSpeed Cache
Plugin Slug:
aruba-hispeed-cache
Installations
100,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
3.0.5
Severity Score:
Medium
CVE:
2026-1924
The vulnerability has been patched, so you should update to version 3.0.5.

Element Pack – Widgets, Templates & Addons for Elementor

Plugin:
Element Pack – Widgets, Templates & Addons for Elementor
Plugin Slug:
bdthemes-element-pack-lite
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
8.5.0
Severity Score:
Medium
CVE:
2026-4655
The vulnerability has been patched, so you should update to version 8.5.0.

Prime Slider – Addons for Elementor

Plugin:
Prime Slider – Addons for Elementor
Plugin Slug:
bdthemes-prime-slider-lite
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.1.11
Severity Score:
Medium
CVE:
2026-4341
The vulnerability has been patched, so you should update to version 4.1.11.

Beaver Builder Page Builder – Drag and Drop Website Builder

Plugin:
Beaver Builder Page Builder – Drag and Drop Website Builder
Plugin Slug:
beaver-builder-lite-version
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.10.1.2
Severity Score:
Medium
CVE:
2026-2481
The vulnerability has been patched, so you should update to version 2.10.1.2.

Download Manager

Plugin:
Download Manager
Plugin Slug:
download-manager
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.3.52
Severity Score:
Medium
CVE:
2026-4057
The vulnerability has been patched, so you should update to version 3.3.52.

Download Manager

Plugin:
Download Manager
Plugin Slug:
download-manager
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.3.53
Severity Score:
Medium
CVE:
2026-5357
The vulnerability has been patched, so you should update to version 3.3.53.

MainWP Child Reports

Plugin:
MainWP Child Reports
Plugin Slug:
mainwp-child-reports
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.3
Severity Score:
Medium
CVE:
2026-4299
The vulnerability has been patched, so you should update to version 2.3.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
3.9.8
Severity Score:
Medium
CVE:
2026-3371
The vulnerability has been patched, so you should update to version 3.9.8.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.9.8
Severity Score:
Medium
CVE:
2026-3358
The vulnerability has been patched, so you should update to version 3.9.8.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.9.8
Severity Score:
High
CVE:
2026-3360
The vulnerability has been patched, so you should update to version 3.9.8.

Booking for Appointments and Events Calendar – Amelia

Plugin:
Booking for Appointments and Events Calendar – Amelia
Plugin Slug:
ameliabooking
Installations
90,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
2.2
Severity Score:
High
CVE:
2026-5465
The vulnerability has been patched, so you should update to version 2.2.

Download Monitor

Plugin:
Download Monitor
Plugin Slug:
download-monitor
Installations
90,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
5.1.11
Severity Score:
Medium
CVE:
2026-4401
The vulnerability has been patched, so you should update to version 5.1.11.

Strong Testimonials

Plugin:
Strong Testimonials
Plugin Slug:
strong-testimonials
Installations
90,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.22
Severity Score:
Medium
CVE:
2026-3239
The vulnerability has been patched, so you should update to version 3.2.22.

Customer Reviews for WooCommerce

Plugin:
Customer Reviews for WooCommerce
Plugin Slug:
customer-reviews-woocommerce
Installations
80,000+
Vulnerability:
Broken Authentication
Patched in Version:
5.104.0
Severity Score:
Medium
CVE:
2026-4664
The vulnerability has been patched, so you should update to version 5.104.0.

Jupiter X Core

Plugin:
Jupiter X Core
Plugin Slug:
jupiterx-core
Installations
80,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.14.2
Severity Score:
Medium
CVE:
2026-39491
The vulnerability has been patched, so you should update to version 4.14.2.

List category posts

Plugin:
List category posts
Plugin Slug:
list-category-posts
Installations
80,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.95.0
Severity Score:
Medium
CVE:
2026-3005
The vulnerability has been patched, so you should update to version 0.95.0.

Advanced Contact form 7 DB

Plugin:
Advanced Contact form 7 DB
Plugin Slug:
advanced-cf7-db
Installations
70,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.1.0
Severity Score:
Medium
CVE:
2026-0811
The vulnerability has been patched, so you should update to version 2.1.0.

Advanced Contact form 7 DB

Plugin:
Advanced Contact form 7 DB
Plugin Slug:
advanced-cf7-db
Installations
70,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.1.0
Severity Score:
Medium
CVE:
2026-0814
The vulnerability has been patched, so you should update to version 2.1.0.

Online Scheduling and Appointment Booking System – Bookly

Plugin:
Online Scheduling and Appointment Booking System – Bookly
Plugin Slug:
bookly-responsive-appointment-booking-tool
Installations
70,000+
Vulnerability:
Content Injection
Patched in Version:
27.1
Severity Score:
Medium
CVE:
2026-2519
The vulnerability has been patched, so you should update to version 27.1.

Greenshift – animation and page builder blocks

Plugin:
Greenshift – animation and page builder blocks
Plugin Slug:
greenshift-animation-and-page-builder-blocks
Installations
70,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
12.9.0
Severity Score:
Medium
CVE:
2026-4895
The vulnerability has been patched, so you should update to version 12.9.0.

Media Library Assistant

Plugin:
Media Library Assistant
Plugin Slug:
media-library-assistant
Installations
70,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.35
Severity Score:
Medium
CVE:
2026-34897
The vulnerability has been patched, so you should update to version 3.35.

Media Library Assistant

Plugin:
Media Library Assistant
Plugin Slug:
media-library-assistant
Installations
70,000+
Vulnerability:
SQL Injection
Patched in Version:
3.35
Severity Score:
High
CVE:
2026-34885
The vulnerability has been patched, so you should update to version 3.35.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Open Redirection
Patched in Version:
5.1.5
Severity Score:
Medium
CVE:
2026-6203
The vulnerability has been patched, so you should update to version 5.1.5.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
SQL Injection
Patched in Version:
5.1.3
Severity Score:
High
CVE:
2026-1865
The vulnerability has been patched, so you should update to version 5.1.3.

Product Filter for WooCommerce by WBW

Plugin:
Product Filter for WooCommerce by WBW
Plugin Slug:
woo-product-filter
Installations
60,000+
Vulnerability:
SQL Injection
Patched in Version:
3.1.3
Severity Score:
Critical
CVE:
2026-39494
The vulnerability has been patched, so you should update to version 3.1.3.

Blog2Social: Social Media Auto Post & Scheduler

Plugin:
Blog2Social: Social Media Auto Post & Scheduler
Plugin Slug:
blog2social
Installations
50,000+
Vulnerability:
Broken Authentication
Patched in Version:
8.8.4
Severity Score:
Medium
CVE:
2026-4330
The vulnerability has been patched, so you should update to version 8.8.4.

Robo Gallery – Photo & Image Slider

Plugin:
Robo Gallery – Photo & Image Slider
Plugin Slug:
robo-gallery
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.1.4
Severity Score:
Medium
CVE:
2026-4300
The vulnerability has been patched, so you should update to version 5.1.4.

LightPress Lightbox

Plugin:
LightPress Lightbox
Plugin Slug:
wp-jquery-lightbox
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.5
Severity Score:
Medium
CVE:
2026-4379
The vulnerability has been patched, so you should update to version 2.3.5.

Link Whisper Free

Plugin:
Link Whisper Free
Plugin Slug:
link-whisper
Installations
30,000+
Vulnerability:
Settings Change
Patched in Version:
0.9.1
Severity Score:
Medium
CVE:
2026-1900
The vulnerability has been patched, so you should update to version 0.9.1.

PowerPress Podcasting plugin by Blubrry

Plugin:
PowerPress Podcasting plugin by Blubrry
Plugin Slug:
powerpress
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
11.15.16
Severity Score:
Medium
CVE:
2026-2988
The vulnerability has been patched, so you should update to version 11.15.16.

Ultimate FAQ Accordion Plugin

Plugin:
Ultimate FAQ Accordion Plugin
Plugin Slug:
ultimate-faqs
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.8
Severity Score:
Medium
CVE:
2026-4336
The vulnerability has been patched, so you should update to version 2.4.8.

Visitor Traffic Real Time Statistics

Plugin:
Visitor Traffic Real Time Statistics
Plugin Slug:
visitors-traffic-real-time-statistics
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
8.5
Severity Score:
High
CVE:
2026-2936
The vulnerability has been patched, so you should update to version 8.5.

AddFunc Head & Footer Code

Plugin:
AddFunc Head & Footer Code
Plugin Slug:
addfunc-head-footer-code
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4
Severity Score:
Medium
CVE:
2026-2305
The vulnerability has been patched, so you should update to version 2.4.

WP Visitor Statistics (Real Time Traffic)

Plugin:
WP Visitor Statistics (Real Time Traffic)
Plugin Slug:
wp-stats-manager
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
8.5
Severity Score:
Medium
CVE:
2026-4303
The vulnerability has been patched, so you should update to version 8.5.

wpForo Forum

Plugin:
wpForo Forum
Plugin Slug:
wpforo
Installations
20,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
3.0.3
Severity Score:
High
CVE:
2026-5809
The vulnerability has been patched, so you should update to version 3.0.3.

wpForo Forum

Plugin:
wpForo Forum
Plugin Slug:
wpforo
Installations
20,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
2.4.17
Severity Score:
High
CVE:
2026-3666
The vulnerability has been patched, so you should update to version 2.4.17.

Easy Appointments

Plugin:
Easy Appointments
Plugin Slug:
easy-appointments
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.12.22
Severity Score:
High
CVE:
2026-39513
The vulnerability has been patched, so you should update to version 3.12.22.

OSM – OpenStreetMap

Plugin:
OSM – OpenStreetMap
Plugin Slug:
osm
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.1.16
Severity Score:
Medium
CVE:
2026-4429
The vulnerability has been patched, so you should update to version 6.1.16.

Widgets for Social Photo Feed

Plugin:
Widgets for Social Photo Feed
Plugin Slug:
social-photo-feed-widget
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.8.0
Severity Score:
High
CVE:
2026-5425
The vulnerability has been patched, so you should update to version 1.8.0.

Under Construction, Coming Soon & Maintenance Mode

Plugin:
Under Construction, Coming Soon & Maintenance Mode
Plugin Slug:
under-construction-maintenance-mode
Installations
10,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.1.2
Severity Score:
High
CVE:
2026-34896
The vulnerability has been patched, so you should update to version 2.1.2.

Product Table and List Builder for WooCommerce Lite

Plugin:
Product Table and List Builder for WooCommerce Lite
Plugin Slug:
wc-product-table-lite
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.6.4
Severity Score:
High
CVE:
2026-34902
The vulnerability has been patched, so you should update to version 4.6.4.

WP Photo Album Plus

Plugin:
WP Photo Album Plus
Plugin Slug:
wp-photo-album-plus
Installations
10,000+
Vulnerability:
SQL Injection
Patched in Version:
9.1.08.002
Severity Score:
Critical
CVE:
2026-39511
The vulnerability has been patched, so you should update to version 9.1.08.002.

YML for Yandex Market

Plugin:
YML for Yandex Market
Plugin Slug:
yml-for-yandex-market
Installations
10,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
5.0.26
Severity Score:
High
CVE:
2025-14545
The vulnerability has been patched, so you should update to version 5.0.26.

WCAPF – Ajax Product Filter for WooCommerce

Plugin:
WCAPF – Ajax Product Filter for WooCommerce
Plugin Slug:
wc-ajax-product-filter
Installations
9,000+
Vulnerability:
SQL Injection
Patched in Version:
4.3.0
Severity Score:
Critical
CVE:
2026-3396
The vulnerability has been patched, so you should update to version 4.3.0.

Awesome Support – WordPress HelpDesk & Support Plugin

Plugin:
Awesome Support – WordPress HelpDesk & Support Plugin
Plugin Slug:
awesome-support
Installations
7,000+
Vulnerability:
Broken Authentication
Patched in Version:
6.3.8
Severity Score:
Medium
CVE:
2026-4654
The vulnerability has been patched, so you should update to version 6.3.8.

ActivityPub

Plugin:
ActivityPub
Plugin Slug:
activitypub
Installations
6,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
8.0.2
Severity Score:
High
CVE:
2026-4338
The vulnerability has been patched, so you should update to version 8.0.2.

Booking Activities

Plugin:
Booking Activities
Plugin Slug:
booking-activities
Installations
4,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.17.0
Severity Score:
Medium
CVE:
2026-39525
The vulnerability has been patched, so you should update to version 1.17.0.

AWP Classifieds

Plugin:
AWP Classifieds
Plugin Slug:
another-wordpress-classifieds-plugin
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4.5
Severity Score:
High
CVE:
2026-39533
The vulnerability has been patched, so you should update to version 4.4.5.

MStore API – Create Native Android & iOS Apps On The Cloud

Plugin:
MStore API – Create Native Android & iOS Apps On The Cloud
Plugin Slug:
mstore-api
Installations
3,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
4.18.4
Severity Score:
Medium
CVE:
2026-3568
The vulnerability has been patched, so you should update to version 4.18.4.

SpeakOut! Email Petitions

Plugin:
SpeakOut! Email Petitions
Plugin Slug:
speakout
Installations
3,000+
Vulnerability:
SQL Injection
Patched in Version:
4.6.5.1
Severity Score:
Critical
CVE:
2026-39530
The vulnerability has been patched, so you should update to version 4.6.5.1.

WP Directory Kit

Plugin:
WP Directory Kit
Plugin Slug:
wpdirectorykit
Installations
3,000+
Vulnerability:
SQL Injection
Patched in Version:
1.5.1
Severity Score:
Critical
CVE:
2026-39531
The vulnerability has been patched, so you should update to version 1.5.1.

WP Directory Kit

Plugin:
WP Directory Kit
Plugin Slug:
wpdirectorykit
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.5.1
Severity Score:
High
CVE:
2026-39534
The vulnerability has been patched, so you should update to version 1.5.1.

Extensions for Leaflet Map

Plugin:
Extensions for Leaflet Map
Plugin Slug:
extensions-leaflet-map
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.15
Severity Score:
Medium
CVE:
2026-5451
The vulnerability has been patched, so you should update to version 4.15.

Timetics – Appointment Booking & Scheduling

Plugin:
Timetics – Appointment Booking & Scheduling
Plugin Slug:
timetics
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.0.54
Severity Score:
High
CVE:
2026-39432
The vulnerability has been patched, so you should update to version 1.0.54.

Event Tickets Manager for WooCommerce

Plugin:
Event Tickets Manager for WooCommerce
Plugin Slug:
event-tickets-manager-for-woocommerce
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.5.4
Severity Score:
High
CVE:
2026-34898
The vulnerability has been patched, so you should update to version 1.5.4.

iControlWP

Plugin:
iControlWP
Plugin Slug:
worpit-admin-dashboard-plugin
Installations
1,000+
Vulnerability:
Privilege Escalation
Patched in Version:
5.5.4
Severity Score:
Critical
CVE:
2026-34901
The vulnerability has been patched, so you should update to version 5.5.4.

SQL Chart Builder

Plugin:
SQL Chart Builder
Plugin Slug:
sql-chart-builder
Installations
600+
Vulnerability:
SQL Injection
Patched in Version:
2.3.8
Severity Score:
Critical
CVE:
2026-4079
The vulnerability has been patched, so you should update to version 2.3.8.

Webling

Plugin:
Webling
Plugin Slug:
webling
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.9.1
Severity Score:
Medium
CVE:
2026-1263
The vulnerability has been patched, so you should update to version 3.9.1.

Datalogics Ecommerce Delivery – Datalogics

Plugin:
Datalogics Ecommerce Delivery – Datalogics
Plugin Slug:
datalogics
Installations
400+
Vulnerability:
Privilege Escalation
Patched in Version:
2.6.63
Severity Score:
Critical
CVE:
2026-39583
The vulnerability has been patched, so you should update to version 2.6.63.

Post Blocks & Tools

Plugin:
Post Blocks & Tools
Plugin Slug:
bnm-blocks
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.1
Severity Score:
Medium
CVE:
2026-5711
The vulnerability has been patched, so you should update to version 1.3.1.

TableOn – WordPress Posts Table Filterable 

Plugin:
TableOn – WordPress Posts Table Filterable 
Plugin Slug:
posts-table-filterable
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.5
Severity Score:
Medium
CVE:
2026-3513
The vulnerability has been patched, so you should update to version 1.0.5.

WP BASE Booking of Appointments, Services and Events

Plugin:
WP BASE Booking of Appointments, Services and Events
Plugin Slug:
wp-base-booking-of-appointments-services-and-events
Installations
200+
Vulnerability:
Privilege Escalation
Patched in Version:
6.0.0
Severity Score:
High
CVE:
2026-39587
The vulnerability has been patched, so you should update to version 6.0.0.

Text to Speech – TTSWP

Plugin:
Text to Speech – TTSWP
Plugin Slug:
text-to-speech-tts
Installations
100+
Vulnerability:
Bypass Vulnerability
Patched in Version:
1.9.9
Severity Score:
High
CVE:
2026-1233
The vulnerability has been patched, so you should update to version 1.9.9.

LTL Freight Quotes – Worldwide Express Edition

Plugin:
LTL Freight Quotes – Worldwide Express Edition
Plugin Slug:
ltl-freight-quotes-worldwide-express-edition
Installations
90+
Vulnerability:
Broken Access Control
Patched in Version:
5.2.2
Severity Score:
Medium
CVE:
2026-34899
The vulnerability has been patched, so you should update to version 5.2.2.

Ziggeo

Plugin:
Ziggeo
Plugin Slug:
ziggeo
Installations
80+
Vulnerability:
Broken Access Control
Patched in Version:
3.1.2
Severity Score:
Medium
CVE:
2026-4124
The vulnerability has been patched, so you should update to version 3.1.2.

BuddyPress Groupblog

Plugin:
BuddyPress Groupblog
Plugin Slug:
bp-groupblog
Installations
50+
Vulnerability:
Privilege Escalation
Patched in Version:
1.9.4
Severity Score:
High
CVE:
2026-5144
The vulnerability has been patched, so you should update to version 1.9.4.

Advanced Members for ACF

Plugin:
Advanced Members for ACF
Plugin Slug:
advanced-members
Installations
30+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.2.6
Severity Score:
High
CVE:
2026-3243
The vulnerability has been patched, so you should update to version 1.2.6.

PrivateContent Free

Plugin:
PrivateContent Free
Plugin Slug:
privatecontent-free
Installations
20+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.0
Severity Score:
Medium
CVE:
2026-4025
The vulnerability has been patched, so you should update to version 1.3.0.

ProSolution WP Client

Plugin:
ProSolution WP Client
Plugin Slug:
prosolution-wp-client
Installations
20+
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.0.0
Severity Score:
Critical
CVE:
2026-2942
The vulnerability has been patched, so you should update to version 2.0.0.

Experto Dashboard for WooCommerce

Plugin:
Experto Dashboard for WooCommerce
Plugin Slug:
experto-custom-dashboard
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.5
Severity Score:
Medium
CVE:
2026-3574
The vulnerability has been patched, so you should update to version 1.0.5.

Investi

Plugin:
Investi
Plugin Slug:
investi
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.27
Severity Score:
Medium
CVE:
2026-3600
The vulnerability has been patched, so you should update to version 1.0.27.

LTL Freight Quotes – R+L Carriers Edition

Plugin:
LTL Freight Quotes – R+L Carriers Edition
Plugin Slug:
ltl-freight-quotes-rl-edition
Installations
10+
Vulnerability:
Broken Access Control
Patched in Version:
3.3.14
Severity Score:
Medium
CVE:
2026-3646
The vulnerability has been patched, so you should update to version 3.3.14.

Magic Conversation For Gravity Forms

Plugin:
Magic Conversation For Gravity Forms
Plugin Slug:
magic-conversation-for-gravity-forms
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.98
Severity Score:
Medium
CVE:
2026-1396
The vulnerability has been patched, so you should update to version 3.0.98.

Surbma | Booking.com Shortcode

Plugin:
Surbma | Booking.com Shortcode
Plugin Slug:
surbma-bookingcom-shortcode
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.1
Severity Score:
Medium
CVE:
2026-1607
The vulnerability has been patched, so you should update to version 2.1.1.

WholeSale Products Dynamic Pricing Management WooCommerce

Plugin:
WholeSale Products Dynamic Pricing Management WooCommerce
Plugin Slug:
wholesale-products-dynamic-pricing-management-woocommerce
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.0
Severity Score:
Medium
CVE:
2026-4479
The vulnerability has been patched, so you should update to version 1.3.0.

WPAMS

Plugin:
WPAMS
Plugin Slug:
apartment-management
Vulnerability:
Arbitrary Content Deletion
Patched in Version:
49.5.3
Severity Score:
Medium
CVE:
2026-39433
The vulnerability has been patched, so you should update to version 49.5.3.

Blocksy Companion Pro

Plugin:
Blocksy Companion Pro
Plugin Slug:
blocksy-companion-pro
Vulnerability:
SQL Injection
Patched in Version:
2.1.29
Severity Score:
Critical
CVE:
2026-39596
The vulnerability has been patched, so you should update to version 2.1.29.

Bricksforge

Plugin:
Bricksforge
Plugin Slug:
bricksforge
Vulnerability:
Sensitive Data Exposure
Patched in Version:
3.1.8.5
Severity Score:
High
CVE:
2026-34888
The vulnerability has been patched, so you should update to version 3.1.8.5.

Gravity Forms

Plugin:
Gravity Forms
Plugin Slug:
gravityforms
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.9.31
Severity Score:
High
CVE:
2026-4394
The vulnerability has been patched, so you should update to version 2.9.31.

Gravity Forms

Plugin:
Gravity Forms
Plugin Slug:
gravityforms
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.9.31
Severity Score:
High
CVE:
2026-4406
The vulnerability has been patched, so you should update to version 2.9.31.

Gravity SMTP

Plugin:
Gravity SMTP
Plugin Slug:
gravitysmtp
Vulnerability:
Broken Access Control
Patched in Version:
2.1.5
Severity Score:
High
CVE:
2026-4162
The vulnerability has been patched, so you should update to version 2.1.5.

Integrio Core

Plugin:
Integrio Core
Plugin Slug:
integrio-core
Vulnerability:
Local File Inclusion
Patched in Version:
1.2.8
Severity Score:
High
CVE:
2026-34894
The vulnerability has been patched, so you should update to version 1.2.8.

Listeo Core

Plugin:
Listeo Core
Plugin Slug:
listeo-core
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.0.28
Severity Score:
Medium
CVE:
2025-14938
The vulnerability has been patched, so you should update to version 2.0.28.

Mikado Core

Plugin:
Mikado Core
Plugin Slug:
mikado-core
Vulnerability:
Local File Inclusion
Patched in Version:
1.7.2
Severity Score:
High
CVE:
2026-39537
The vulnerability has been patched, so you should update to version 1.7.2.

Smart Slider 3 PRO

Plugin:
Smart Slider 3 PRO
Plugin Slug:
nextend-smart-slider3-pro
Vulnerability:
Backdoor
Patched in Version:
3.5.1.36
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 3.5.1.36.

Ninja Forms File Uploads Extension

Plugin:
Ninja Forms File Uploads Extension
Plugin Slug:
ninja-forms-uploads
Vulnerability:
Arbitrary File Upload
Patched in Version:
3.3.27
Severity Score:
Critical
CVE:
2026-0740
The vulnerability has been patched, so you should update to version 3.3.27.

pdfl.io

Plugin:
pdfl.io
Plugin Slug:
pdfl-io
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.6
Severity Score:
Medium
CVE:
2026-4073
The vulnerability has been patched, so you should update to version 1.0.6.

Perfmatters

Plugin:
Perfmatters
Plugin Slug:
perfmatters
Vulnerability:
Directory Traversal
Patched in Version:
2.6.0
Severity Score:
High
CVE:
2026-4351
The vulnerability has been patched, so you should update to version 2.6.0.

Quick Playground

Plugin:
Quick Playground
Plugin Slug:
quick-playground
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.3.2
Severity Score:
Critical
CVE:
2026-1830
The vulnerability has been patched, so you should update to version 1.3.2.

Softlab Core

Plugin:
Softlab Core
Plugin Slug:
softlab-core
Vulnerability:
Local File Inclusion
Patched in Version:
1.2.11
Severity Score:
High
CVE:
2026-34895
The vulnerability has been patched, so you should update to version 1.2.11.

Solene Core

Plugin:
Solene Core
Plugin Slug:
solene-core
Vulnerability:
Local File Inclusion
Patched in Version:
2.3.4
Severity Score:
High
CVE:
2026-39523
The vulnerability has been patched, so you should update to version 2.3.4.

Thegov Core

Plugin:
Thegov Core
Plugin Slug:
thegov-core
Vulnerability:
Local File Inclusion
Patched in Version:
2.0.23
Severity Score:
High
CVE:
2026-34893
The vulnerability has been patched, so you should update to version 2.0.23.

Users manager – PN

Plugin:
Users manager – PN
Plugin Slug:
userspn
Vulnerability:
Privilege Escalation
Patched in Version:
1.1.20
Severity Score:
Critical
CVE:
2026-4003
The vulnerability has been patched, so you should update to version 1.1.20.

MultiLoca

Plugin:
MultiLoca
Plugin Slug:
woocommerce-multi-locations-inventory-management
Vulnerability:
Privilege Escalation
Patched in Version:
4.2.16
Severity Score:
High
CVE:
2026-39546
The vulnerability has been patched, so you should update to version 4.2.16.

WordPress Themes — 24 Patched / 0 Unpatched

Alloggio – Hotel Booking

Theme:
Alloggio – Hotel Booking
Theme Slug:
alloggio
Vulnerability:
PHP Object Injection
Patched in Version:
2.1.3
Severity Score:
High
CVE:
2026-39539
The vulnerability has been patched, so you should update to version 2.1.3.

Aperitif

Theme:
Aperitif
Theme Slug:
aperitif
Vulnerability:
PHP Object Injection
Patched in Version:
1.6.1
Severity Score:
High
CVE:
2026-39550
The vulnerability has been patched, so you should update to version 1.6.1.

Aperitif

Theme:
Aperitif
Theme Slug:
aperitif
Vulnerability:
Local File Inclusion
Patched in Version:
1.6
Severity Score:
High
CVE:
2026-39549
The vulnerability has been patched, so you should update to version 1.6.

Askka

Theme:
Askka
Theme Slug:
askka
Vulnerability:
PHP Object Injection
Patched in Version:
1.4
Severity Score:
High
CVE:
2026-39555
The vulnerability has been patched, so you should update to version 1.4.

Blueprint

Theme:
Blueprint
Theme Slug:
blueprint
Vulnerability:
Local File Inclusion
Patched in Version:
1.1.5
Severity Score:
High
CVE:
2026-39552
The vulnerability has been patched, so you should update to version 1.1.5.

Fidalgo

Theme:
Fidalgo
Theme Slug:
fidalgo
Vulnerability:
PHP Object Injection
Patched in Version:
1.3
Severity Score:
High
CVE:
2026-39554
The vulnerability has been patched, so you should update to version 1.3.

Getaway

Theme:
Getaway
Theme Slug:
getaway
Vulnerability:
Local File Inclusion
Patched in Version:
1.8
Severity Score:
High
CVE:
2026-39547
The vulnerability has been patched, so you should update to version 1.8.

Hiroshi

Theme:
Hiroshi
Theme Slug:
hiroshi
Vulnerability:
PHP Object Injection
Patched in Version:
1.6
Severity Score:
High
CVE:
2026-39560
The vulnerability has been patched, so you should update to version 1.6.

Konsept

Theme:
Konsept
Theme Slug:
konsept
Vulnerability:
PHP Object Injection
Patched in Version:
2.0
Severity Score:
High
CVE:
2026-39556
The vulnerability has been patched, so you should update to version 2.0.

Malmö

Theme:
Malmö
Theme Slug:
malmo
Vulnerability:
Local File Inclusion
Patched in Version:
2.3
Severity Score:
High
CVE:
2026-39558
The vulnerability has been patched, so you should update to version 2.3.

Micdrop

Theme:
Micdrop
Theme Slug:
micdrop
Vulnerability:
PHP Object Injection
Patched in Version:
1.4
Severity Score:
High
CVE:
2026-39580
The vulnerability has been patched, so you should update to version 1.4.

Mildhill

Theme:
Mildhill
Theme Slug:
mildhill
Vulnerability:
PHP Object Injection
Patched in Version:
1.6
Severity Score:
High
CVE:
2026-39573
The vulnerability has been patched, so you should update to version 1.6.

Mr. SEO

Theme:
Mr. SEO
Theme Slug:
mrseo
Vulnerability:
Local File Inclusion
Patched in Version:
2.1
Severity Score:
High
CVE:
2026-39568
The vulnerability has been patched, so you should update to version 2.1.

NeoBeat

Theme:
NeoBeat
Theme Slug:
neobeat
Vulnerability:
PHP Object Injection
Patched in Version:
1.8
Severity Score:
High
CVE:
2026-39557
The vulnerability has been patched, so you should update to version 1.8.

Playroom

Theme:
Playroom
Theme Slug:
playroom
Vulnerability:
PHP Object Injection
Patched in Version:
1.5
Severity Score:
High
CVE:
2026-39577
The vulnerability has been patched, so you should update to version 1.5.

Santé

Theme:
Santé
Theme Slug:
sante
Vulnerability:
PHP Object Injection
Patched in Version:
1.6
Severity Score:
High
CVE:
2026-39567
The vulnerability has been patched, so you should update to version 1.6.

SingleMalt

Theme:
SingleMalt
Theme Slug:
singlemalt
Vulnerability:
PHP Object Injection
Patched in Version:
1.6
Severity Score:
High
CVE:
2026-39576
The vulnerability has been patched, so you should update to version 1.6.

Solene

Theme:
Solene
Theme Slug:
solene
Vulnerability:
Local File Inclusion
Patched in Version:
3.4.1
Severity Score:
High
CVE:
2026-39522
The vulnerability has been patched, so you should update to version 3.4.1.

Töbel

Theme:
Töbel
Theme Slug:
tobel
Vulnerability:
PHP Object Injection
Patched in Version:
1.9
Severity Score:
High
CVE:
2026-39551
The vulnerability has been patched, so you should update to version 1.9.

Uppercase

Theme:
Uppercase
Theme Slug:
uppercase
Vulnerability:
Local File Inclusion
Patched in Version:
1.2.2
Severity Score:
High
CVE:
2026-39559
The vulnerability has been patched, so you should update to version 1.2.2.

Valiance

Theme:
Valiance
Theme Slug:
valiance
Vulnerability:
PHP Object Injection
Patched in Version:
1.3
Severity Score:
High
CVE:
2026-39578
The vulnerability has been patched, so you should update to version 1.3.

WaveRide

Theme:
WaveRide
Theme Slug:
waveride
Vulnerability:
Local File Inclusion
Patched in Version:
1.5
Severity Score:
High
CVE:
2026-39553
The vulnerability has been patched, so you should update to version 1.5.

Hitek

Theme:
Hitek
Theme Slug:
xts-hitek
Vulnerability:
Local File Inclusion
Patched in Version:
1.8.3
Severity Score:
High
CVE:
2026-39582
The vulnerability has been patched, so you should update to version 1.8.3.

Zermatt

Theme:
Zermatt
Theme Slug:
zermatt
Vulnerability:
PHP Object Injection
Patched in Version:
1.7
Severity Score:
High
CVE:
2026-39545
The vulnerability has been patched, so you should update to version 1.7.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — April 15, 2026 appeared first on SolidWP.

]]> WordPress Vulnerability Report — April 8, 2026 https://solidwp.com/blog/wordpress-vulnerability-report-april-8-2026/ Wed, 08 Apr 2026 13:15:11 +0000 https://solidwp.com/?p=2553122 Since last week, 68 new vulnerabilities have emerged in the WordPress ecosystem, including 67 plugins and 1 theme. Of those, 4 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

The post WordPress Vulnerability Report — April 8, 2026 appeared first on SolidWP.

]]> In this report, 68 vulnerabilities have been publicly disclosed. Security patches for 64 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 4 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.9.4 is available, addressing 10 security issues and a template loading bug. Immediate updates are recommended for all production sites.

WordPress 7.0 Release Candidate 2 (RC2) is now ready for testing via the Beta Tester plugin, direct download, WP-CLI, or WordPress Playground. As a pre-release version, it should only be evaluated in staging or local environments.

WordPress 7.0 is scheduled for release on April 9, 2026.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 63 Patched / 4 Unpatched

MSTW League Manager

Plugin:
MSTW League Manager
Plugin Slug:
mstw-league-manager
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-34890
The vulnerability has not been patched. You should deactivate the plugin.

Auto Post Scheduler

Plugin:
Auto Post Scheduler
Plugin Slug:
auto-post-scheduler
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1877
The vulnerability has not been patched. You should deactivate the plugin.

Performance Monitor

Plugin:
Performance Monitor
Plugin Slug:
performance-monitor
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3881
The vulnerability has not been patched. You should deactivate the plugin.

IDPay Payment Gateway for Woocommerce

Plugin:
IDPay Payment Gateway for Woocommerce
Plugin Slug:
woo-idpay-gateway
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-34891
The vulnerability has not been patched. You should deactivate the plugin.

Complianz – GDPR/CCPA Cookie Consent

Plugin:
Complianz – GDPR/CCPA Cookie Consent
Plugin Slug:
complianz-gdpr
Installations
1,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.4.5
Severity Score:
Medium
CVE:
2026-2389
The vulnerability has been patched, so you should update to version 7.4.5.

Loco Translate

Plugin:
Loco Translate
Plugin Slug:
loco-translate
Installations
1,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.8.3
Severity Score:
High
CVE:
2026-4146
The vulnerability has been patched, so you should update to version 2.8.3.

W3 Total Cache

Plugin:
W3 Total Cache
Plugin Slug:
w3-total-cache
Installations
900,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.9.4
Severity Score:
High
CVE:
2026-5032
The vulnerability has been patched, so you should update to version 2.9.4.

WooPayments: Integrated WooCommerce Payments

Plugin:
WooPayments: Integrated WooCommerce Payments
Plugin Slug:
woocommerce-payments
Installations
900,000+
Vulnerability:
Broken Access Control
Patched in Version:
10.6.0
Severity Score:
Medium
CVE:
2026-1710
The vulnerability has been patched, so you should update to version 10.6.0.

WP Shortcodes Plugin — Shortcodes Ultimate

Plugin:
WP Shortcodes Plugin — Shortcodes Ultimate
Plugin Slug:
shortcodes-ultimate
Installations
400,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.4.9
Severity Score:
Medium
CVE:
2026-0738
The vulnerability has been patched, so you should update to version 7.4.9.

WP Shortcodes Plugin — Shortcodes Ultimate

Plugin:
WP Shortcodes Plugin — Shortcodes Ultimate
Plugin Slug:
shortcodes-ultimate
Installations
400,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.4.8
Severity Score:
Medium
CVE:
2026-0737
The vulnerability has been patched, so you should update to version 7.4.8.

WP Shortcodes Plugin — Shortcodes Ultimate

Plugin:
WP Shortcodes Plugin — Shortcodes Ultimate
Plugin Slug:
shortcodes-ultimate
Installations
400,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.5.0
Severity Score:
Medium
CVE:
2026-2480
The vulnerability has been patched, so you should update to version 7.5.0.

MW WP Form

Plugin:
MW WP Form
Plugin Slug:
mw-wp-form
Installations
200,000+
Vulnerability:
Directory Traversal
Patched in Version:
5.1.1
Severity Score:
High
CVE:
2026-4347
The vulnerability has been patched, so you should update to version 5.1.1.

Query Monitor

Plugin:
Query Monitor
Plugin Slug:
query-monitor
Installations
200,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.20.4
Severity Score:
High
CVE:
2026-4267
The vulnerability has been patched, so you should update to version 3.20.4.

Kubio AI Page Builder

Plugin:
Kubio AI Page Builder
Plugin Slug:
kubio
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.7.1
Severity Score:
Medium
CVE:
2026-34887
The vulnerability has been patched, so you should update to version 2.7.1.

Booking for Appointments and Events Calendar – Amelia

Plugin:
Booking for Appointments and Events Calendar – Amelia
Plugin Slug:
ameliabooking
Installations
90,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
2.2
Severity Score:
High
CVE:
2026-5465
The vulnerability has been patched, so you should update to version 2.2.

Download Monitor

Plugin:
Download Monitor
Plugin Slug:
download-monitor
Installations
90,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
5.1.8
Severity Score:
Medium
CVE:
2026-3124
The vulnerability has been patched, so you should update to version 5.1.8.

Database for Contact Form 7, WPforms, Elementor forms

Plugin:
Database for Contact Form 7, WPforms, Elementor forms
Plugin Slug:
contact-form-entries
Installations
70,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.5.0
Severity Score:
Medium
CVE:
2026-3831
The vulnerability has been patched, so you should update to version 1.5.0.

Media Library Assistant

Plugin:
Media Library Assistant
Plugin Slug:
media-library-assistant
Installations
70,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.35
Severity Score:
Medium
CVE:
2026-34897
The vulnerability has been patched, so you should update to version 3.35.

Media Library Assistant

Plugin:
Media Library Assistant
Plugin Slug:
media-library-assistant
Installations
70,000+
Vulnerability:
SQL Injection
Patched in Version:
3.35
Severity Score:
High
CVE:
2026-34885
The vulnerability has been patched, so you should update to version 3.35.

Conditional Menus

Plugin:
Conditional Menus
Plugin Slug:
conditional-menus
Installations
60,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.2.7
Severity Score:
Medium
CVE:
2026-1032
The vulnerability has been patched, so you should update to version 1.2.7.

Export All URLs

Plugin:
Export All URLs
Plugin Slug:
export-all-urls
Installations
50,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
5.1
Severity Score:
Medium
CVE:
2026-2696
The vulnerability has been patched, so you should update to version 5.1.

Simple Membership

Plugin:
Simple Membership
Plugin Slug:
simple-membership
Installations
40,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.7.2
Severity Score:
High
CVE:
2026-34886
The vulnerability has been patched, so you should update to version 4.7.2.

Blackhole for Bad Bots

Plugin:
Blackhole for Bad Bots
Plugin Slug:
blackhole-bad-bots
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.8.1
Severity Score:
High
CVE:
2026-4329
The vulnerability has been patched, so you should update to version 3.8.1.

WP Lightbox 2

Plugin:
WP Lightbox 2
Plugin Slug:
wp-lightbox-2
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.7
Severity Score:
Medium
CVE:
2026-1430
The vulnerability has been patched, so you should update to version 3.0.7.

Xpro Addons — 140+ Widgets for Elementor

Plugin:
Xpro Addons — 140+ Widgets for Elementor
Plugin Slug:
xpro-elementor-addons
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.21
Severity Score:
Medium
CVE:
2025-13368
The vulnerability has been patched, so you should update to version 1.4.21.

Xpro Addons — 140+ Widgets for Elementor

Plugin:
Xpro Addons — 140+ Widgets for Elementor
Plugin Slug:
xpro-elementor-addons
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.25
Severity Score:
Medium
CVE:
2026-2949
The vulnerability has been patched, so you should update to version 1.4.25.

WCFM – Frontend Manager for WooCommerce

Plugin:
WCFM – Frontend Manager for WooCommerce
Plugin Slug:
wc-frontend-manager
Installations
20,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
6.7.26
Severity Score:
High
CVE:
2026-4896
The vulnerability has been patched, so you should update to version 6.7.26.

Frontend Admin by DynamiApps

Plugin:
Frontend Admin by DynamiApps
Plugin Slug:
acf-frontend-form-element
Installations
10,000+
Vulnerability:
PHP Object Injection
Patched in Version:
3.28.32
Severity Score:
High
CVE:
2026-3328
The vulnerability has been patched, so you should update to version 3.28.32.

Ibtana – WordPress Website Builder

Plugin:
Ibtana – WordPress Website Builder
Plugin Slug:
ibtana-visual-editor
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.2.5.8
Severity Score:
Medium
CVE:
2026-1834
The vulnerability has been patched, so you should update to version 1.2.5.8.

Minify HTML

Plugin:
Minify HTML
Plugin Slug:
minify-html-markup
Installations
10,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.1.13
Severity Score:
Medium
CVE:
2026-3191
The vulnerability has been patched, so you should update to version 2.1.13.

Responsive Plus – Elementor Templates & Starter Sites

Plugin:
Responsive Plus – Elementor Templates & Starter Sites
Plugin Slug:
responsive-add-ons
Installations
10,000+
Vulnerability:
Arbitrary Code Execution
Patched in Version:
3.4.3
Severity Score:
Medium
CVE:
2025-15488
The vulnerability has been patched, so you should update to version 3.4.3.

Simple Shopping Cart

Plugin:
Simple Shopping Cart
Plugin Slug:
wordpress-simple-paypal-shopping-cart
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.2.5
Severity Score:
Medium
CVE:
2026-0552
The vulnerability has been patched, so you should update to version 5.2.5.

Spam Protect for Contact Form 7

Plugin:
Spam Protect for Contact Form 7
Plugin Slug:
wp-contact-form-7-spam-blocker
Installations
10,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
1.2.10
Severity Score:
High
CVE:
2026-1540
The vulnerability has been patched, so you should update to version 1.2.10.

JS Help Desk – AI-Powered Support & Ticketing System

Plugin:
JS Help Desk – AI-Powered Support & Ticketing System
Plugin Slug:
js-support-ticket
Installations
8,000+
Vulnerability:
SQL Injection
Patched in Version:
3.0.5
Severity Score:
Critical
CVE:
2026-2511
The vulnerability has been patched, so you should update to version 3.0.5.

Contact Form by Supsystic

Plugin:
Contact Form by Supsystic
Plugin Slug:
contact-form-by-supsystic
Installations
7,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
1.8.0
Severity Score:
Critical
CVE:
2026-4257
The vulnerability has been patched, so you should update to version 1.8.0.

Webmention

Plugin:
Webmention
Plugin Slug:
webmention
Installations
900+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
5.7.0
Severity Score:
Medium
CVE:
2026-0688
The vulnerability has been patched, so you should update to version 5.7.0.

Webmention

Plugin:
Webmention
Plugin Slug:
webmention
Installations
900+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
5.7.0
Severity Score:
Medium
CVE:
2026-0686
The vulnerability has been patched, so you should update to version 5.7.0.

TrueBooker – Appointment Booking and Scheduler System

Plugin:
TrueBooker – Appointment Booking and Scheduler System
Plugin Slug:
truebooker-appointment-booking
Installations
600+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
1.1.5
Severity Score:
Medium
CVE:
2026-1797
The vulnerability has been patched, so you should update to version 1.1.5.

Debugger & Troubleshooter

Plugin:
Debugger & Troubleshooter
Plugin Slug:
debugger-troubleshooter
Installations
50+
Vulnerability:
Privilege Escalation
Patched in Version:
1.4.0
Severity Score:
Critical
CVE:
2026-5130
The vulnerability has been patched, so you should update to version 1.4.0.

Bricksforge

Plugin:
Bricksforge
Plugin Slug:
bricksforge
Vulnerability:
Sensitive Data Exposure
Patched in Version:
3.1.8.5
Severity Score:
High
CVE:
2026-34888
The vulnerability has been patched, so you should update to version 3.1.8.5.

Everest Forms Pro

Plugin:
Everest Forms Pro
Plugin Slug:
everest-forms-pro
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
1.9.13
Severity Score:
Critical
CVE:
2026-3300
The vulnerability has been patched, so you should update to version 1.9.13.

Gravity SMTP

Plugin:
Gravity SMTP
Plugin Slug:
gravitysmtp
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.1.5
Severity Score:
High
CVE:
2026-4020
The vulnerability has been patched, so you should update to version 2.1.5.

LeadConnector

Plugin:
LeadConnector
Plugin Slug:
leadconnector
Vulnerability:
Broken Access Control
Patched in Version:
3.0.22
Severity Score:
Medium
CVE:
2026-1890
The vulnerability has been patched, so you should update to version 3.0.22.

Perfmatters

Plugin:
Perfmatters
Plugin Slug:
perfmatters
Vulnerability:
Arbitrary File Deletion
Patched in Version:
2.6.0
Severity Score:
High
CVE:
2026-4350
The vulnerability has been patched, so you should update to version 2.6.0.

ThemeREX Addons

Plugin:
ThemeREX Addons
Plugin Slug:
trx_addons
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.38.5
Severity Score:
Critical
CVE:
2026-1969
The vulnerability has been patched, so you should update to version 2.38.5.

Ultimate Addons for WPBakery Page Builder

Plugin:
Ultimate Addons for WPBakery Page Builder
Plugin Slug:
ultimate_vc_addons
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.21.4
Severity Score:
Medium
CVE:
2026-34889
The vulnerability has been patched, so you should update to version 3.21.4.

WordPress Themes — 1 Patched / 0 Unpatched

Oxygen

Theme:
Oxygen
Theme Slug:
oxygen
Downloads
403,225
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
6.0.9
Severity Score:
High
CVE:
2025-12886
The vulnerability has been patched, so you should update to version 6.0.9.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — April 8, 2026 appeared first on SolidWP.

]]> WordPress Vulnerability Report — April 1, 2026 https://solidwp.com/blog/wordpress-vulnerability-report-april-1-2026/ Wed, 01 Apr 2026 13:18:55 +0000 https://solidwp.com/?p=2553112 Since last week, 225 new vulnerabilities have emerged in the WordPress ecosystem, including 203 plugins and 22 themes. Of those, 91 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

The post WordPress Vulnerability Report — April 1, 2026 appeared first on SolidWP.

]]> In this report, 225 vulnerabilities have been publicly disclosed. Security patches for 134 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 91 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.9.4 is available, addressing 10 security issues and a template loading bug. Immediate updates are recommended for all production sites.

WordPress 7.0 Release Candidate 2 (RC2) is now ready for testing via the Beta Tester plugin, direct download, WP-CLI, or WordPress Playground. As a pre-release version, it should only be evaluated in staging or local environments.

WordPress 7.0 is scheduled for release on April 9, 2026.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 113 Patched / 90 Unpatched

WPCargo Track & Trace

Plugin:
WPCargo Track & Trace
Plugin Slug:
wpcargo
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25401
The vulnerability has not been patched. You should deactivate the plugin.

MimeTypes Link Icons

Plugin:
MimeTypes Link Icons
Plugin Slug:
mimetypes-link-icons
Installations
8,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1313
The vulnerability has not been patched. You should deactivate the plugin.

Coinbase Commerce – Crypto Gateway for WooCommerce

Plugin:
Coinbase Commerce – Crypto Gateway for WooCommerce
Plugin Slug:
commerce-coinbase-for-woocommerce
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25396
The vulnerability has not been patched. You should deactivate the plugin.

SurveyJS: Drag & Drop Form Builder

Plugin:
SurveyJS: Drag & Drop Form Builder
Plugin Slug:
surveyjs
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2440
The vulnerability has not been patched. You should deactivate the plugin.

File Uploader for WooCommerce

Plugin:
File Uploader for WooCommerce
Plugin Slug:
file-uploader-for-woocommerce
Installations
100+
Vulnerability:
Path Traversal
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25397
The vulnerability has not been patched. You should deactivate the plugin.

Any Post Slider

Plugin:
Any Post Slider
Plugin Slug:
any-post-slider
Installations
60+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1899
The vulnerability has not been patched. You should deactivate the plugin.

FuseDesk

Plugin:
FuseDesk
Plugin Slug:
fusedesk
Installations
60+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1914
The vulnerability has not been patched. You should deactivate the plugin.

WPFAQBlock– FAQ & Accordion Plugin For Gutenberg

Plugin:
WPFAQBlock– FAQ & Accordion Plugin For Gutenberg
Plugin Slug:
wpfaqblock
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1093
The vulnerability has not been patched. You should deactivate the plugin.

Ad Short

Plugin:
Ad Short
Plugin Slug:
ad-short
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4067
The vulnerability has not been patched. You should deactivate the plugin.

Add Google Social Profiles to Knowledge Graph Box

Plugin:
Add Google Social Profiles to Knowledge Graph Box
Plugin Slug:
add-google-social-profiles-to-knowledge-graph-box
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1393
The vulnerability has not been patched. You should deactivate the plugin.

Alfie

Plugin:
Alfie
Plugin Slug:
alfie-the-productfeedtool-wp-plugin
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-4069
The vulnerability has not been patched. You should deactivate the plugin.

App Builder

Plugin:
App Builder
Plugin Slug:
app-builder
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2375
The vulnerability has not been patched. You should deactivate the plugin.

Reward Video Ad for WordPress

Plugin:
Reward Video Ad for WordPress
Plugin Slug:
applixir
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2424
The vulnerability has not been patched. You should deactivate the plugin.

Appmax

Plugin:
Appmax
Plugin Slug:
appmax
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3641
The vulnerability has not been patched. You should deactivate the plugin.

ARForms Form Builder

Plugin:
ARForms Form Builder
Plugin Slug:
arforms-form-builder
Vulnerability:
Content Injection
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-13785
The vulnerability has not been patched. You should deactivate the plugin.

Build App Online

Plugin:
Build App Online
Plugin Slug:
build-app-online
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3651
The vulnerability has not been patched. You should deactivate the plugin.

Canto

Plugin:
Canto
Plugin Slug:
canto
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3335
The vulnerability has not been patched. You should deactivate the plugin.

CMS Commander

Plugin:
CMS Commander
Plugin Slug:
cms-commander-client
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3334
The vulnerability has not been patched. You should deactivate the plugin.

Comment Genius

Plugin:
Comment Genius
Plugin Slug:
comment-genius
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1647
The vulnerability has not been patched. You should deactivate the plugin.

Comment SPAM Wiper

Plugin:
Comment SPAM Wiper
Plugin Slug:
comment-spam-wiper
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3353
The vulnerability has not been patched. You should deactivate the plugin.

Company Posts for LinkedIn

Plugin:
Company Posts for LinkedIn
Plugin Slug:
company-posts-for-linkedin
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1935
The vulnerability has not been patched. You should deactivate the plugin.

Content Syndication Toolkit

Plugin:
Content Syndication Toolkit
Plugin Slug:
content-syndication-toolkit
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3478
The vulnerability has not been patched. You should deactivate the plugin.

e-shot

Plugin:
e-shot
Plugin Slug:
e-shot-form-builder
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3546
The vulnerability has not been patched. You should deactivate the plugin.

Easy Image Gallery

Plugin:
Easy Image Gallery
Plugin Slug:
easy-image-gallery
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4766
The vulnerability has not been patched. You should deactivate the plugin.

Ecover Builder For Dummies

Plugin:
Ecover Builder For Dummies
Plugin Slug:
ecover-builder-for-dummies
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4077
The vulnerability has not been patched. You should deactivate the plugin.

Ed’s Font Awesome

Plugin:
Ed’s Font Awesome
Plugin Slug:
eds-font-awesome
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2496
The vulnerability has not been patched. You should deactivate the plugin.

Ed’s Social Share

Plugin:
Ed’s Social Share
Plugin Slug:
eds-social-share
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2501
The vulnerability has not been patched. You should deactivate the plugin.

ElementCamp

Plugin:
ElementCamp
Plugin Slug:
element-camp
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2503
The vulnerability has not been patched. You should deactivate the plugin.

Expire Users

Plugin:
Expire Users
Plugin Slug:
expire-users
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-4261
The vulnerability has not been patched. You should deactivate the plugin.

Fonts Manager | Custom Fonts

Plugin:
Fonts Manager | Custom Fonts
Plugin Slug:
fonts-manager-custom-fonts
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-1800
The vulnerability has not been patched. You should deactivate the plugin.

fyyd podcast shortcodes

Plugin:
fyyd podcast shortcodes
Plugin Slug:
fyyd-podcast-shortcodes
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4084
The vulnerability has not been patched. You should deactivate the plugin.

Go Night Pro

Plugin:
Go Night Pro
Plugin Slug:
go-night-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1886
The vulnerability has not been patched. You should deactivate the plugin.

Hr Press Lite

Plugin:
Hr Press Lite
Plugin Slug:
hr-press-lite
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2720
The vulnerability has not been patched. You should deactivate the plugin.

Integration with Hubspot Forms

Plugin:
Integration with Hubspot Forms
Plugin Slug:
integration-with-hubspot-forms
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1908
The vulnerability has not been patched. You should deactivate the plugin.

Invelity Product Feeds

Plugin:
Invelity Product Feeds
Plugin Slug:
invelity-products-feeds
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-14037
The vulnerability has not been patched. You should deactivate the plugin.

itsukaita

Plugin:
itsukaita
Plugin Slug:
itsukaita
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2427
The vulnerability has not been patched. You should deactivate the plugin.

iVysilani Shortcode

Plugin:
iVysilani Shortcode
Plugin Slug:
ivysilani-shortcode
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1851
The vulnerability has not been patched. You should deactivate the plugin.

Linksy Search and Replace

Plugin:
Linksy Search and Replace
Plugin Slug:
linksy-search-and-replace
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2941
The vulnerability has not been patched. You should deactivate the plugin.

Lobot Slider Administrator

Plugin:
Lobot Slider Administrator
Plugin Slug:
lobot-slider-administrator
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3331
The vulnerability has not been patched. You should deactivate the plugin.

login_register

Plugin:
login_register
Plugin Slug:
login-register
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1503
The vulnerability has not been patched. You should deactivate the plugin.

Mandatory Field

Plugin:
Mandatory Field
Plugin Slug:
mandatory-fields
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1278
The vulnerability has not been patched. You should deactivate the plugin.

MinhNhut Link Gateway

Plugin:
MinhNhut Link Gateway
Plugin Slug:
minhnhut-link-gateway
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3333
The vulnerability has not been patched. You should deactivate the plugin.

Multi Functional Flexi Lightbox

Plugin:
Multi Functional Flexi Lightbox
Plugin Slug:
multi-functional-flexi-lightbox
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3347
The vulnerability has not been patched. You should deactivate the plugin.

Multi Post Carousel by Category

Plugin:
Multi Post Carousel by Category
Plugin Slug:
multi-post-carousel
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1275
The vulnerability has not been patched. You should deactivate the plugin.

myLinksDump

Plugin:
myLinksDump
Plugin Slug:
mylinksdump
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2279
The vulnerability has not been patched. You should deactivate the plugin.

Neos Connector for Fakturama

Plugin:
Neos Connector for Fakturama
Plugin Slug:
neos-connector-for-fakturama
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4143
The vulnerability has not been patched. You should deactivate the plugin.

Outgrow

Plugin:
Outgrow
Plugin Slug:
outgrow
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1889
The vulnerability has not been patched. You should deactivate the plugin.

Paypal Shortcodes

Plugin:
Paypal Shortcodes
Plugin Slug:
paypal-shortcodes
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3617
The vulnerability has not been patched. You should deactivate the plugin.

PQ Addons – Creative Elementor Widgets

Plugin:
PQ Addons – Creative Elementor Widgets
Plugin Slug:
peacefulqode-elementzplus-widgets
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1397
The vulnerability has not been patched. You should deactivate the plugin.

Performance Monitor

Plugin:
Performance Monitor
Plugin Slug:
performance-monitor
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1648
The vulnerability has not been patched. You should deactivate the plugin.

Post Flagger

Plugin:
Post Flagger
Plugin Slug:
post-flagger
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1854
The vulnerability has not been patched. You should deactivate the plugin.

Post Snippits

Plugin:
Post Snippits
Plugin Slug:
post-snippits
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2723
The vulnerability has not been patched. You should deactivate the plugin.

Post Affiliate Pro

Plugin:
Post Affiliate Pro
Plugin Slug:
postaffiliatepro
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2290
The vulnerability has not been patched. You should deactivate the plugin.

Pre* Party Resource Hints

Plugin:
Pre* Party Resource Hints
Plugin Slug:
pre-party-browser-hints
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-4087
The vulnerability has not been patched. You should deactivate the plugin.

Punnel – Landing Page Builder

Plugin:
Punnel – Landing Page Builder
Plugin Slug:
punnel-landing-page-builder
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3645
The vulnerability has not been patched. You should deactivate the plugin.

Quentn WP

Plugin:
Quentn WP
Plugin Slug:
quentn-wp
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-2468
The vulnerability has not been patched. You should deactivate the plugin.

Redirect countdown

Plugin:
Redirect countdown
Plugin Slug:
redirect-countdown
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1390
The vulnerability has not been patched. You should deactivate the plugin.

REST API TO MiniProgram

Plugin:
REST API TO MiniProgram
Plugin Slug:
rest-api-to-miniprogram
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3460
The vulnerability has not been patched. You should deactivate the plugin.

Review Map by RevuKangaroo

Plugin:
Review Map by RevuKangaroo
Plugin Slug:
review-map-by-revukangaroo
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4161
The vulnerability has not been patched. You should deactivate the plugin.

rexCrawler

Plugin:
rexCrawler
Plugin Slug:
rexcrawler
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2277
The vulnerability has not been patched. You should deactivate the plugin.

Ricerca – advanced search

Plugin:
Ricerca – advanced search
Plugin Slug:
ricerca-smart-search
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2837
The vulnerability has not been patched. You should deactivate the plugin.

Schema Shortcode

Plugin:
Schema Shortcode
Plugin Slug:
schema-shortcode
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1575
The vulnerability has not been patched. You should deactivate the plugin.

Sheets2Table

Plugin:
Sheets2Table
Plugin Slug:
sheets2table
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3619
The vulnerability has not been patched. You should deactivate the plugin.

Sherk Custom Post Type Displays

Plugin:
Sherk Custom Post Type Displays
Plugin Slug:
sherk-custom-post-type-displays
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3554
The vulnerability has not been patched. You should deactivate the plugin.

Weaver Show Posts

Plugin:
Weaver Show Posts
Plugin Slug:
show-posts
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2121
The vulnerability has not been patched. You should deactivate the plugin.

Show Posts list

Plugin:
Show Posts list
Plugin Slug:
show-posts-shortcodes
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4022
The vulnerability has not been patched. You should deactivate the plugin.

Simple Football Scoreboard

Plugin:
Simple Football Scoreboard
Plugin Slug:
simple-football-score-board
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1891
The vulnerability has not been patched. You should deactivate the plugin.

Smarter Analytics

Plugin:
Smarter Analytics
Plugin Slug:
smarter-analytics
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3570
The vulnerability has not been patched. You should deactivate the plugin.

Speedup Optimization

Plugin:
Speedup Optimization
Plugin Slug:
speedup-optimization
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4127
The vulnerability has not been patched. You should deactivate the plugin.

SR WP Minify HTML

Plugin:
SR WP Minify HTML
Plugin Slug:
sr-wp-minify-html
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1392
The vulnerability has not been patched. You should deactivate the plugin.

Survey

Plugin:
Survey
Plugin Slug:
survey
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1247
The vulnerability has not been patched. You should deactivate the plugin.

Task Manager

Plugin:
Task Manager
Plugin Slug:
task-manager
Vulnerability:
Arbitrary File Download
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2351
The vulnerability has not been patched. You should deactivate the plugin.

Task Manager

Plugin:
Task Manager
Plugin Slug:
task-manager
Vulnerability:
Content Injection
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4004
The vulnerability has not been patched. You should deactivate the plugin.

Text Toggle

Plugin:
Text Toggle
Plugin Slug:
text-toggle
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3997
The vulnerability has not been patched. You should deactivate the plugin.

Tour & Activity Operator Plugin for TourCMS

Plugin:
Tour & Activity Operator Plugin for TourCMS
Plugin Slug:
tour-operator-plugin
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1806
The vulnerability has not been patched. You should deactivate the plugin.

Tutor LMS Pro

Plugin:
Tutor LMS Pro
Plugin Slug:
tutor-pro
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25406
The vulnerability has not been patched. You should deactivate the plugin.

Twitter Feeds

Plugin:
Twitter Feeds
Plugin Slug:
twitter-feeds
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1911
The vulnerability has not been patched. You should deactivate the plugin.

Shortcodes Blocks Creator Ultimate

Plugin:
Shortcodes Blocks Creator Ultimate
Plugin Slug:
ultimate-shortcodes-creator
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-12166
The vulnerability has not been patched. You should deactivate the plugin.

Shortcodes Blocks Creator Ultimate

Plugin:
Shortcodes Blocks Creator Ultimate
Plugin Slug:
ultimate-shortcodes-creator
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-12167
The vulnerability has not been patched. You should deactivate the plugin.

Vagaro Booking Widget

Plugin:
Vagaro Booking Widget
Plugin Slug:
vagaro-booking-widget
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3003
The vulnerability has not been patched. You should deactivate the plugin.

Wikilookup

Plugin:
Wikilookup
Plugin Slug:
wikilookup
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3354
The vulnerability has not been patched. You should deactivate the plugin.

WordPress PayPal Donation

Plugin:
WordPress PayPal Donation
Plugin Slug:
wordpress-paypal-donation
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4072
The vulnerability has not been patched. You should deactivate the plugin.

WP Games Embed

Plugin:
WP Games Embed
Plugin Slug:
wp-games-embed
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3996
The vulnerability has not been patched. You should deactivate the plugin.

WP NG Weather

Plugin:
WP NG Weather
Plugin Slug:
wp-ng-weather
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1822
The vulnerability has not been patched. You should deactivate the plugin.

WP Posts Re-order

Plugin:
WP Posts Re-order
Plugin Slug:
wp-posts-re-order
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1378
The vulnerability has not been patched. You should deactivate the plugin.

WP Random Button

Plugin:
WP Random Button
Plugin Slug:
wp-random-button
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4086
The vulnerability has not been patched. You should deactivate the plugin.

WP-WebAuthn

Plugin:
WP-WebAuthn
Plugin Slug:
wp-webauthn
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-13910
The vulnerability has not been patched. You should deactivate the plugin.

WPBookit Pro

Plugin:
WPBookit Pro
Plugin Slug:
wpbookit-pro
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-25413
The vulnerability has not been patched. You should deactivate the plugin.

WPBookit Pro

Plugin:
WPBookit Pro
Plugin Slug:
wpbookit-pro
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25414
The vulnerability has not been patched. You should deactivate the plugin.

Xhanch – My Advanced Settings

Plugin:
Xhanch – My Advanced Settings
Plugin Slug:
xhanch-my-advanced-settings
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3332
The vulnerability has not been patched. You should deactivate the plugin.

Complianz – GDPR/CCPA Cookie Consent

Plugin:
Complianz – GDPR/CCPA Cookie Consent
Plugin Slug:
complianz-gdpr
Installations
1,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.4.5
Severity Score:
Medium
CVE:
2026-2389
The vulnerability has been patched, so you should update to version 7.4.5.

Smart Slider 3

Plugin:
Smart Slider 3
Plugin Slug:
smart-slider-3
Installations
800,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
3.5.1.34
Severity Score:
Medium
CVE:
2026-3098
The vulnerability has been patched, so you should update to version 3.5.1.34.

Booking for Appointments and Events Calendar – Amelia

Plugin:
Booking for Appointments and Events Calendar – Amelia
Plugin Slug:
ameliabooking
Installations
90,000+
Vulnerability:
Broken Authentication
Patched in Version:
9.2
Severity Score:
High
CVE:
2026-2931
The vulnerability has been patched, so you should update to version 9.2.

Download Monitor

Plugin:
Download Monitor
Plugin Slug:
download-monitor
Installations
90,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
5.1.8
Severity Score:
Medium
CVE:
2026-3124
The vulnerability has been patched, so you should update to version 5.1.8.

JetFormBuilder — Dynamic Blocks Form Builder

Plugin:
JetFormBuilder — Dynamic Blocks Form Builder
Plugin Slug:
jetformbuilder
Installations
90,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
3.5.6.3
Severity Score:
High
CVE:
2026-4373
The vulnerability has been patched, so you should update to version 3.5.6.3.

JetFormBuilder — Dynamic Blocks Form Builder

Plugin:
JetFormBuilder — Dynamic Blocks Form Builder
Plugin Slug:
jetformbuilder
Installations
90,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
3.5.6.2
Severity Score:
Critical
CVE:
2026-32525
The vulnerability has been patched, so you should update to version 3.5.6.2.

Import and export users and customers

Plugin:
Import and export users and customers
Plugin Slug:
import-users-from-csv-with-meta
Installations
80,000+
Vulnerability:
Privilege Escalation
Patched in Version:
2.0
Severity Score:
High
CVE:
2026-3629
The vulnerability has been patched, so you should update to version 2.0.

Jupiter X Core

Plugin:
Jupiter X Core
Plugin Slug:
jupiterx-core
Installations
80,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.14.2
Severity Score:
High
CVE:
2026-3533
The vulnerability has been patched, so you should update to version 4.14.2.

Conditional Menus

Plugin:
Conditional Menus
Plugin Slug:
conditional-menus
Installations
60,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.2.7
Severity Score:
Medium
CVE:
2026-1032
The vulnerability has been patched, so you should update to version 1.2.7.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.1.5
Severity Score:
Medium
CVE:
2026-4056
The vulnerability has been patched, so you should update to version 5.1.5.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Privilege Escalation
Patched in Version:
5.1.3
Severity Score:
High
CVE:
2026-32488
The vulnerability has been patched, so you should update to version 5.1.3.

Product Filter for WooCommerce by WBW

Plugin:
Product Filter for WooCommerce by WBW
Plugin Slug:
woo-product-filter
Installations
60,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.1.3
Severity Score:
Medium
CVE:
2026-3138
The vulnerability has been patched, so you should update to version 3.1.3.

Blog2Social: Social Media Auto Post & Scheduler

Plugin:
Blog2Social: Social Media Auto Post & Scheduler
Plugin Slug:
blog2social
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
8.8.3
Severity Score:
Medium
CVE:
2026-4331
The vulnerability has been patched, so you should update to version 8.8.3.

Sina Extension for Elementor

Plugin:
Sina Extension for Elementor
Plugin Slug:
sina-extension-for-elementor
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.7.1
Severity Score:
Medium
CVE:
2025-6229
The vulnerability has been patched, so you should update to version 3.7.1.

Smart Custom Fields

Plugin:
Smart Custom Fields
Plugin Slug:
smart-custom-fields
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.0.7
Severity Score:
Medium
CVE:
2026-4066
The vulnerability has been patched, so you should update to version 5.0.7.

Mixed Media Gallery Blocks

Plugin:
Mixed Media Gallery Blocks
Plugin Slug:
simply-gallery-block
Installations
40,000+
Vulnerability:
Arbitrary Code Execution
Patched in Version:
3.3.2.1
Severity Score:
Critical
CVE:
2026-25345
The vulnerability has been patched, so you should update to version 3.3.2.1.

Blackhole for Bad Bots

Plugin:
Blackhole for Bad Bots
Plugin Slug:
blackhole-bad-bots
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.8.1
Severity Score:
High
CVE:
2026-4329
The vulnerability has been patched, so you should update to version 3.8.1.

LeadConnector

Plugin:
LeadConnector
Plugin Slug:
leadconnector
Installations
30,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.0.22
Severity Score:
Medium
CVE:
2026-1890
The vulnerability has been patched, so you should update to version 3.0.22.

PPWP – Password Protect Pages

Plugin:
PPWP – Password Protect Pages
Plugin Slug:
password-protect-page
Installations
30,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.9.16
Severity Score:
Medium
CVE:
2026-32562
The vulnerability has been patched, so you should update to version 1.9.16.

WPGraphQL

Plugin:
WPGraphQL
Plugin Slug:
wp-graphql
Installations
30,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.10
Severity Score:
Medium
CVE:
2026-33290
The vulnerability has been patched, so you should update to version 2.10.

WP Lightbox 2

Plugin:
WP Lightbox 2
Plugin Slug:
wp-lightbox-2
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.7
Severity Score:
Medium
CVE:
2026-1430
The vulnerability has been patched, so you should update to version 3.0.7.

Ibtana – WordPress Website Builder

Plugin:
Ibtana – WordPress Website Builder
Plugin Slug:
ibtana-visual-editor
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.2.5.8
Severity Score:
Medium
CVE:
2026-1834
The vulnerability has been patched, so you should update to version 1.2.5.8.

Quads Ads Manager for Google AdSense

Plugin:
Quads Ads Manager for Google AdSense
Plugin Slug:
quick-adsense-reloaded
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.99
Severity Score:
Medium
CVE:
2026-2595
The vulnerability has been patched, so you should update to version 2.0.99.

Frontend Admin by DynamiApps

Plugin:
Frontend Admin by DynamiApps
Plugin Slug:
acf-frontend-form-element
Installations
10,000+
Vulnerability:
PHP Object Injection
Patched in Version:
3.28.32
Severity Score:
High
CVE:
2026-3328
The vulnerability has been patched, so you should update to version 3.28.32.

Kali Forms — Contact Form & Drag-and-Drop Builder

Plugin:
Kali Forms — Contact Form & Drag-and-Drop Builder
Plugin Slug:
kali-forms
Installations
10,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
2.4.10
Severity Score:
Critical
CVE:
2026-3584
The vulnerability has been patched, so you should update to version 2.4.10.

Lead Form Builder & Contact Form

Plugin:
Lead Form Builder & Contact Form
Plugin Slug:
lead-form-builder
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.2
Severity Score:
High
CVE:
2026-32532
The vulnerability has been patched, so you should update to version 2.0.2.

Responsive Plus – Elementor Templates & Starter Sites

Plugin:
Responsive Plus – Elementor Templates & Starter Sites
Plugin Slug:
responsive-add-ons
Installations
10,000+
Vulnerability:
Arbitrary Code Execution
Patched in Version:
3.4.3
Severity Score:
Medium
CVE:
2025-15488
The vulnerability has been patched, so you should update to version 3.4.3.

Review Schema – Review & Structure Data Schema Plugin

Plugin:
Review Schema – Review & Structure Data Schema Plugin
Plugin Slug:
review-schema
Installations
10,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.2.7
Severity Score:
Medium
CVE:
2026-25344
The vulnerability has been patched, so you should update to version 2.2.7.

WP DSGVO Tools (GDPR)

Plugin:
WP DSGVO Tools (GDPR)
Plugin Slug:
shapepress-dsgvo
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.1.39
Severity Score:
Critical
CVE:
2026-4283
The vulnerability has been patched, so you should update to version 3.1.39.

Team – Team Members Showcase Plugin

Plugin:
Team – Team Members Showcase Plugin
Plugin Slug:
tlp-team
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.0.12
Severity Score:
High
CVE:
2026-25026
The vulnerability has been patched, so you should update to version 5.0.12.

WP REST Cache

Plugin:
WP REST Cache
Plugin Slug:
wp-rest-cache
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2026.1.1
Severity Score:
High
CVE:
2026-25347
The vulnerability has been patched, so you should update to version 2026.1.1.

YML for Yandex Market

Plugin:
YML for Yandex Market
Plugin Slug:
yml-for-yandex-market
Installations
10,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
5.3.0
Severity Score:
Medium
CVE:
2026-32567
The vulnerability has been patched, so you should update to version 5.3.0.

Contact Form Email

Plugin:
Contact Form Email
Plugin Slug:
contact-form-to-email
Installations
9,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.3.64
Severity Score:
Medium
CVE:
2026-32483
The vulnerability has been patched, so you should update to version 1.3.64.

WP TripAdvisor Review Slider

Plugin:
WP TripAdvisor Review Slider
Plugin Slug:
wp-tripadvisor-review-slider
Installations
8,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
14.2
Severity Score:
Medium
CVE:
2026-32490
The vulnerability has been patched, so you should update to version 14.2.

JS Help Desk – AI-Powered Support & Ticketing System

Plugin:
JS Help Desk – AI-Powered Support & Ticketing System
Plugin Slug:
js-support-ticket
Installations
7,000+
Vulnerability:
SQL Injection
Patched in Version:
3.0.5
Severity Score:
Critical
CVE:
2026-2511
The vulnerability has been patched, so you should update to version 3.0.5.

JS Help Desk – AI-Powered Support & Ticketing System

Plugin:
JS Help Desk – AI-Powered Support & Ticketing System
Plugin Slug:
js-support-ticket
Installations
7,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
3.0.4
Severity Score:
Medium
CVE:
2026-32535
The vulnerability has been patched, so you should update to version 3.0.4.

WP Review Slider

Plugin:
WP Review Slider
Plugin Slug:
wp-facebook-reviews
Installations
7,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
14.0
Severity Score:
Medium
CVE:
2026-32491
The vulnerability has been patched, so you should update to version 14.0.

PeproDev Ultimate Invoice

Plugin:
PeproDev Ultimate Invoice
Plugin Slug:
pepro-ultimate-invoice
Installations
6,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.2.6
Severity Score:
Medium
CVE:
2026-2343
The vulnerability has been patched, so you should update to version 2.2.6.

ProfileGrid – User Profiles, Groups and Communities

Plugin:
ProfileGrid – User Profiles, Groups and Communities
Plugin Slug:
profilegrid-user-profiles-groups-and-communities
Installations
6,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.9.8.2
Severity Score:
Medium
CVE:
2026-25417
The vulnerability has been patched, so you should update to version 5.9.8.2.

User Verification by PickPlugins

Plugin:
User Verification by PickPlugins
Plugin Slug:
user-verification
Installations
5,000+
Vulnerability:
Broken Authentication
Patched in Version:
2.0.46
Severity Score:
Medium
CVE:
2026-32497
The vulnerability has been patched, so you should update to version 2.0.46.

RSFirewall!

Plugin:
RSFirewall!
Plugin Slug:
rsfirewall
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.46
Severity Score:
High
CVE:
2026-25341
The vulnerability has been patched, so you should update to version 1.1.46.

WP Telegram Widget and Join Link

Plugin:
WP Telegram Widget and Join Link
Plugin Slug:
wptelegram-widget
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.14
Severity Score:
High
CVE:
2026-23807
The vulnerability has been patched, so you should update to version 2.2.14.

ElementInvader Addons for Elementor

Plugin:
ElementInvader Addons for Elementor
Plugin Slug:
elementinvader-addons-for-elementor
Installations
3,000+
Vulnerability:
SQL Injection
Patched in Version:
1.4.3
Severity Score:
High
CVE:
2026-25007
The vulnerability has been patched, so you should update to version 1.4.3.

KiviCare – Clinic & Patient Management System (EHR)

Plugin:
KiviCare – Clinic & Patient Management System (EHR)
Plugin Slug:
kivicare-clinic-management-system
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.0.0
Severity Score:
High
CVE:
2026-25383
The vulnerability has been patched, so you should update to version 4.0.0.

KiviCare – Clinic & Patient Management System (EHR)

Plugin:
KiviCare – Clinic & Patient Management System (EHR)
Plugin Slug:
kivicare-clinic-management-system
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.0.0
Severity Score:
Medium
CVE:
2026-25034
The vulnerability has been patched, so you should update to version 4.0.0.

Simple Download Counter

Plugin:
Simple Download Counter
Plugin Slug:
simple-download-counter
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.1
Severity Score:
Medium
CVE:
2026-4278
The vulnerability has been patched, so you should update to version 2.3.1.

Injection Guard

Plugin:
Injection Guard
Plugin Slug:
injection-guard
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.0
Severity Score:
High
CVE:
2026-3368
The vulnerability has been patched, so you should update to version 1.3.0.

The Ultimate WordPress Toolkit – WP Extended

Plugin:
The Ultimate WordPress Toolkit – WP Extended
Plugin Slug:
wpextended
Installations
700+
Vulnerability:
Privilege Escalation
Patched in Version:
3.2.5
Severity Score:
High
CVE:
2026-4314
The vulnerability has been patched, so you should update to version 3.2.5.

Truebooker – Appointment Booking and Scheduler System

Plugin:
Truebooker – Appointment Booking and Scheduler System
Plugin Slug:
truebooker-appointment-booking
Installations
600+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
1.1.5
Severity Score:
Medium
CVE:
2026-1797
The vulnerability has been patched, so you should update to version 1.1.5.

VikRestaurants Table Reservations and Take-Away

Plugin:
VikRestaurants Table Reservations and Take-Away
Plugin Slug:
vikrestaurants
Installations
600+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.3
Severity Score:
High
CVE:
2026-25025
The vulnerability has been patched, so you should update to version 1.5.3.

Vertex Addons for Elementor

Plugin:
Vertex Addons for Elementor
Plugin Slug:
addons-for-elementor-builder
Installations
400+
Vulnerability:
Broken Access Control
Patched in Version:
1.7.0
Severity Score:
Medium
CVE:
2026-25398
The vulnerability has been patched, so you should update to version 1.7.0.

FormLift for Infusionsoft Web Forms

Plugin:
FormLift for Infusionsoft Web Forms
Plugin Slug:
formlift
Installations
400+
Vulnerability:
Broken Access Control
Patched in Version:
7.5.22
Severity Score:
Medium
CVE:
2026-4281
The vulnerability has been patched, so you should update to version 7.5.22.

Helpdesk Support Ticket System for WooCommerce

Plugin:
Helpdesk Support Ticket System for WooCommerce
Plugin Slug:
support-ticket-system-for-woocommerce
Installations
200+
Vulnerability:
Broken Access Control
Patched in Version:
2.1.3
Severity Score:
High
CVE:
2026-23977
The vulnerability has been patched, so you should update to version 2.1.3.

Contact Manager

Plugin:
Contact Manager
Plugin Slug:
contact-manager
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
9.1.1
Severity Score:
High
CVE:
2026-32517
The vulnerability has been patched, so you should update to version 9.1.1.

DSGVO snippet for Leaflet Map and its Extensions

Plugin:
DSGVO snippet for Leaflet Map and its Extensions
Plugin Slug:
dsgvo-leaflet-map
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.4
Severity Score:
Medium
CVE:
2026-4389
The vulnerability has been patched, so you should update to version 3.4.

Video & Photo Gallery for Ultimate Member

Plugin:
Video & Photo Gallery for Ultimate Member
Plugin Slug:
gallery-for-ultimate-member
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.2
Severity Score:
High
CVE:
2024-12162
The vulnerability has been patched, so you should update to version 1.1.2.

Product File Upload for WooCommerce

Plugin:
Product File Upload for WooCommerce
Plugin Slug:
products-file-upload-for-woocommerce
Installations
100+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
2.2.5
Severity Score:
Medium
CVE:
2026-25328
The vulnerability has been patched, so you should update to version 2.2.5.

Filestack WP Upload

Plugin:
Filestack WP Upload
Plugin Slug:
filestack-upload
Installations
60+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.0
Severity Score:
High
CVE:
2024-11462
The vulnerability has been patched, so you should update to version 3.0.0.

Debugger & Troubleshooter

Plugin:
Debugger & Troubleshooter
Plugin Slug:
debugger-troubleshooter
Installations
40+
Vulnerability:
Privilege Escalation
Patched in Version:
1.4.0
Severity Score:
Critical
CVE:
2026-5130
The vulnerability has been patched, so you should update to version 1.4.0.

BWL Advanced FAQ Manager Lite

Plugin:
BWL Advanced FAQ Manager Lite
Plugin Slug:
bwl-advanced-faq-manager-lite
Installations
30+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.2
Severity Score:
Medium
CVE:
2026-4075
The vulnerability has been patched, so you should update to version 1.1.2.

WP Cost Estimation & Payment Forms Builder

Plugin:
WP Cost Estimation & Payment Forms Builder
Plugin Slug:
WP_Estimation_Form
Vulnerability:
Broken Access Control
Patched in Version:
10.3.0
Severity Score:
High
CVE:
2026-24363
The vulnerability has been patched, so you should update to version 10.3.0.

Addon Jobsearch Chat

Plugin:
Addon Jobsearch Chat
Plugin Slug:
addon-jobsearch-chat
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.1
Severity Score:
High
CVE:
2026-25376
The vulnerability has been patched, so you should update to version 3.1.

Addon Jobsearch Chat

Plugin:
Addon Jobsearch Chat
Plugin Slug:
addon-jobsearch-chat
Vulnerability:
SQL Injection
Patched in Version:
3.1
Severity Score:
Critical
CVE:
2026-25377
The vulnerability has been patched, so you should update to version 3.1.

Gyan Elements

Plugin:
Gyan Elements
Plugin Slug:
gyan-elements
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.2
Severity Score:
High
CVE:
2026-23979
The vulnerability has been patched, so you should update to version 2.2.2.

Ultimate Membership Pro

Plugin:
Ultimate Membership Pro
Plugin Slug:
indeed-membership-pro
Vulnerability:
Broken Authentication
Patched in Version:
13.7.1
Severity Score:
High
CVE:
2026-25357
The vulnerability has been patched, so you should update to version 13.7.1.

JetEngine

Plugin:
JetEngine
Plugin Slug:
jet-engine
Vulnerability:
SQL Injection
Patched in Version:
3.8.6.2
Severity Score:
Critical
CVE:
2026-4662
The vulnerability has been patched, so you should update to version 3.8.6.2.

NaturaLife Extensions

Plugin:
NaturaLife Extensions
Plugin Slug:
naturalife-extensions
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2
Severity Score:
High
CVE:
2026-25018
The vulnerability has been patched, so you should update to version 2.2.

NaturaLife Extensions

Plugin:
NaturaLife Extensions
Plugin Slug:
naturalife-extensions
Vulnerability:
Local File Inclusion
Patched in Version:
2.2
Severity Score:
High
CVE:
2026-25017
The vulnerability has been patched, so you should update to version 2.2.

Salon Booking System Pro

Plugin:
Salon Booking System Pro
Plugin Slug:
salon-booking-plugin-pro
Vulnerability:
Broken Authentication
Patched in Version:
10.30.12
Severity Score:
High
CVE:
2026-25334
The vulnerability has been patched, so you should update to version 10.30.12.

LearnDash LMS

Plugin:
LearnDash LMS
Plugin Slug:
sfwd-lms
Vulnerability:
SQL Injection
Patched in Version:
5.0.3.1
Severity Score:
High
CVE:
2026-3079
The vulnerability has been patched, so you should update to version 5.0.3.1.

The Grid

Plugin:
The Grid
Plugin Slug:
the-grid
Vulnerability:
Broken Access Control
Patched in Version:
2.8.0
Severity Score:
High
CVE:
2026-24369
The vulnerability has been patched, so you should update to version 2.8.0.

The Grid

Plugin:
The Grid
Plugin Slug:
the-grid
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.8.0
Severity Score:
Medium
CVE:
2026-24370
The vulnerability has been patched, so you should update to version 2.8.0.

ThemeREX Addons

Plugin:
ThemeREX Addons
Plugin Slug:
trx_addons
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.38.5
Severity Score:
Critical
CVE:
2026-1969
The vulnerability has been patched, so you should update to version 2.38.5.

Woocommerce Custom Product Addons Pro

Plugin:
Woocommerce Custom Product Addons Pro
Plugin Slug:
woo-custom-product-addons-pro
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
5.4.2
Severity Score:
Critical
CVE:
2026-4001
The vulnerability has been patched, so you should update to version 5.4.2.

WP Configurator Pro

Plugin:
WP Configurator Pro
Plugin Slug:
wp-configurator-pro
Vulnerability:
Broken Access Control
Patched in Version:
3.8.0
Severity Score:
High
CVE:
2026-32501
The vulnerability has been patched, so you should update to version 3.8.0.

JobSearch

Plugin:
JobSearch
Plugin Slug:
wp-jobsearch
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.2
Severity Score:
High
CVE:
2026-32493
The vulnerability has been patched, so you should update to version 3.2.2.

WordPress Themes — 21 Patched / 1 Unpatched

Apicona

Theme:
Apicona
Theme Slug:
apicona
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25400
The vulnerability has not been patched. You should switch themes.

Ona

Theme:
Ona
Theme Slug:
ona
Downloads
244,053
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.24
Severity Score:
Critical
CVE:
2026-32482
The vulnerability has been patched, so you should update to version 1.24.

Archicon

Theme:
Archicon
Theme Slug:
archicon
Vulnerability:
PHP Object Injection
Patched in Version:
1.7
Severity Score:
Medium
CVE:
2026-32506
The vulnerability has been patched, so you should update to version 1.7.

Borgholm

Theme:
Borgholm
Theme Slug:
borgholm-marketing-agency-theme
Vulnerability:
PHP Object Injection
Patched in Version:
1.6
Severity Score:
Critical
CVE:
2026-32502
The vulnerability has been patched, so you should update to version 1.6.

Car Dealer

Theme:
Car Dealer
Theme Slug:
cardealer
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.6.8
Severity Score:
High
CVE:
2026-24391
The vulnerability has been patched, so you should update to version 1.6.8.

Gaea

Theme:
Gaea
Theme Slug:
gaea
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.8
Severity Score:
High
CVE:
2026-32518
The vulnerability has been patched, so you should update to version 3.8.

Goldish

Theme:
Goldish
Theme Slug:
goldish
Vulnerability:
PHP Object Injection
Patched in Version:
3.47
Severity Score:
Critical
CVE:
2026-25030
The vulnerability has been patched, so you should update to version 3.47.

Golo

Theme:
Golo
Theme Slug:
golo
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.5
Severity Score:
High
CVE:
2026-23973
The vulnerability has been patched, so you should update to version 1.7.5.

Gracey

Theme:
Gracey
Theme Slug:
gracey
Vulnerability:
PHP Object Injection
Patched in Version:
1.4
Severity Score:
Medium
CVE:
2026-32509
The vulnerability has been patched, so you should update to version 1.4.

Halstein

Theme:
Halstein
Theme Slug:
halstein
Vulnerability:
PHP Object Injection
Patched in Version:
1.8
Severity Score:
Medium
CVE:
2026-32508
The vulnerability has been patched, so you should update to version 1.8.

Kamperen

Theme:
Kamperen
Theme Slug:
kamperen
Vulnerability:
PHP Object Injection
Patched in Version:
1.3
Severity Score:
Medium
CVE:
2026-32510
The vulnerability has been patched, so you should update to version 1.3.

KIDZ

Theme:
KIDZ
Theme Slug:
kidz
Vulnerability:
PHP Object Injection
Patched in Version:
5.25
Severity Score:
Critical
CVE:
2026-25029
The vulnerability has been patched, so you should update to version 5.25.

Boutique

Theme:
Boutique
Theme Slug:
kute-boutique
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.6
Severity Score:
High
CVE:
2026-25342
The vulnerability has been patched, so you should update to version 2.4.6.

Leroux

Theme:
Leroux
Theme Slug:
leroux
Vulnerability:
PHP Object Injection
Patched in Version:
1.4
Severity Score:
Medium
CVE:
2026-32507
The vulnerability has been patched, so you should update to version 1.4.

Meloo

Theme:
Meloo
Theme Slug:
meloo
Vulnerability:
PHP Object Injection
Patched in Version:
2.8.2
Severity Score:
High
CVE:
2026-25358
The vulnerability has been patched, so you should update to version 2.8.2.

Jobmonster

Theme:
Jobmonster
Theme Slug:
noo-jobmonster
Vulnerability:
SQL Injection
Patched in Version:
4.8.4
Severity Score:
Critical
CVE:
2026-25340
The vulnerability has been patched, so you should update to version 4.8.4.

Ricky

Theme:
Ricky
Theme Slug:
ricky
Vulnerability:
PHP Object Injection
Patched in Version:
2.31
Severity Score:
Critical
CVE:
2026-25032
The vulnerability has been patched, so you should update to version 2.31.

Sanzo

Theme:
Sanzo
Theme Slug:
sanzo
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.3
Severity Score:
Medium
CVE:
2026-25355
The vulnerability has been patched, so you should update to version 2.4.3.

Stål

Theme:
Stål
Theme Slug:
stal
Vulnerability:
PHP Object Injection
Patched in Version:
1.7
Severity Score:
Medium
CVE:
2026-32511
The vulnerability has been patched, so you should update to version 1.7.

Tasty Daily

Theme:
Tasty Daily
Theme Slug:
tastydaily
Vulnerability:
PHP Object Injection
Patched in Version:
1.27
Severity Score:
Critical
CVE:
2026-25031
The vulnerability has been patched, so you should update to version 1.27.

Vayvo

Theme:
Vayvo
Theme Slug:
vayvo-progression
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.8
Severity Score:
High
CVE:
2026-25373
The vulnerability has been patched, so you should update to version 6.8.

WoodMart

Theme:
WoodMart
Theme Slug:
woodmart
Vulnerability:
PHP Object Injection
Patched in Version:
8.3.9
Severity Score:
High
CVE:
2026-23971
The vulnerability has been patched, so you should update to version 8.3.9.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — April 1, 2026 appeared first on SolidWP.

]]> WordPress Vulnerability Report — March 25, 2026 https://solidwp.com/blog/wordpress-vulnerability-report-march-25-2026/ Wed, 25 Mar 2026 13:10:39 +0000 https://solidwp.com/?p=2553103 Since last week, 331 new vulnerabilities have emerged in the WordPress ecosystem, including 275 plugins and 56 themes. Of those, 120 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

The post WordPress Vulnerability Report — March 25, 2026 appeared first on SolidWP.

]]> In this report, 331 vulnerabilities have been publicly disclosed. Security patches for 211 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 120 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.9.4 is now available, addressing 10 security issues and a bug that affected template file loading on a limited number of sites. Because this is a security release, it is recommended that you update your sites immediately.

Also, WordPress 7.0 RC1 is ready for download and testing! As this is a pre-release version, it is intended for testing and development only and should not be installed on production or mission-critical sites. Organizations should use local or staging environments to evaluate compatibility and new features before the final rollout.

WordPress 7.0 is scheduled for release on April 9, 2026.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 162 Patched / 113 Unpatched

Product Slider, Product Grid, Product Masonry

Plugin:
Product Slider, Product Grid, Product Masonry
Plugin Slug:
woocommerce-products-slider
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-25455
The vulnerability has not been patched. You should deactivate the plugin.

WPCargo Track & Trace

Plugin:
WPCargo Track & Trace
Plugin Slug:
wpcargo
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25401
The vulnerability has not been patched. You should deactivate the plugin.

Booking calendar, Appointment Booking System

Plugin:
Booking calendar, Appointment Booking System
Plugin Slug:
booking-calendar
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25435
The vulnerability has not been patched. You should deactivate the plugin.

Coinbase Commerce – Crypto Gateway for WooCommerce

Plugin:
Coinbase Commerce – Crypto Gateway for WooCommerce
Plugin Slug:
commerce-coinbase-for-woocommerce
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25396
The vulnerability has not been patched. You should deactivate the plugin.

CP Multi View Events Calendar

Plugin:
CP Multi View Events Calendar
Plugin Slug:
cp-multi-view-calendar
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-25465
The vulnerability has not been patched. You should deactivate the plugin.

TotalPoll for Polls and Contests

Plugin:
TotalPoll for Polls and Contests
Plugin Slug:
totalpoll-lite
Installations
1,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27044
The vulnerability has not been patched. You should deactivate the plugin.

Gutenberg Blocks – Unlimited blocks For Gutenberg

Plugin:
Gutenberg Blocks – Unlimited blocks For Gutenberg
Plugin Slug:
unlimited-blocks
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25438
The vulnerability has not been patched. You should deactivate the plugin.

GZSEO

Plugin:
GZSEO
Plugin Slug:
gzseo
Installations
600+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-25437
The vulnerability has not been patched. You should deactivate the plugin.

ViaBill – WooCommerce

Plugin:
ViaBill – WooCommerce
Plugin Slug:
viabill-woocommerce
Installations
500+
Vulnerability:
Settings Change
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-25469
The vulnerability has not been patched. You should deactivate the plugin.

Vertex Addons for Elementor

Plugin:
Vertex Addons for Elementor
Plugin Slug:
addons-for-elementor-builder
Installations
400+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-25398
The vulnerability has not been patched. You should deactivate the plugin.

Product Rearrange for WooCommerce

Plugin:
Product Rearrange for WooCommerce
Plugin Slug:
products-rearrange-woocommerce
Installations
400+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-31920
The vulnerability has not been patched. You should deactivate the plugin.

Product Rearrange for WooCommerce

Plugin:
Product Rearrange for WooCommerce
Plugin Slug:
products-rearrange-woocommerce
Installations
400+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-31921
The vulnerability has not been patched. You should deactivate the plugin.

Remoji – Post/Comment Reaction and Enhancement

Plugin:
Remoji – Post/Comment Reaction and Enhancement
Plugin Slug:
remoji
Installations
400+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25452
The vulnerability has not been patched. You should deactivate the plugin.

Widget Wrangler

Plugin:
Widget Wrangler
Plugin Slug:
widget-wrangler
Installations
200+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-25447
The vulnerability has not been patched. You should deactivate the plugin.

File Uploader for WooCommerce

Plugin:
File Uploader for WooCommerce
Plugin Slug:
file-uploader-for-woocommerce
Installations
100+
Vulnerability:
Path Traversal
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25397
The vulnerability has not been patched. You should deactivate the plugin.

Admin Safety Guard — Login Security & 2FA

Plugin:
Admin Safety Guard — Login Security & 2FA
Plugin Slug:
admin-safety-guard
Installations
10+
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25471
The vulnerability has not been patched. You should deactivate the plugin.

Ad Short

Plugin:
Ad Short
Plugin Slug:
ad-short
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4067
The vulnerability has not been patched. You should deactivate the plugin.

Add Google Social Profiles to Knowledge Graph Box

Plugin:
Add Google Social Profiles to Knowledge Graph Box
Plugin Slug:
add-google-social-profiles-to-knowledge-graph-box
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1393
The vulnerability has not been patched. You should deactivate the plugin.

ACPT (Pro) – Custom Post Types Plugin for WordPress

Plugin:
ACPT (Pro) – Custom Post Types Plugin for WordPress
Plugin Slug:
advanced-custom-post-type
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-25470
The vulnerability has not been patched. You should deactivate the plugin.

Alfie

Plugin:
Alfie
Plugin Slug:
alfie-the-productfeedtool-wp-plugin
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-4069
The vulnerability has not been patched. You should deactivate the plugin.

Any Post Slider

Plugin:
Any Post Slider
Plugin Slug:
any-post-slider
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1899
The vulnerability has not been patched. You should deactivate the plugin.

App Builder

Plugin:
App Builder
Plugin Slug:
app-builder
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2375
The vulnerability has not been patched. You should deactivate the plugin.

Reward Video Ad for WordPress

Plugin:
Reward Video Ad for WordPress
Plugin Slug:
applixir
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2424
The vulnerability has not been patched. You should deactivate the plugin.

Appmax

Plugin:
Appmax
Plugin Slug:
appmax
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3641
The vulnerability has not been patched. You should deactivate the plugin.

Ave Core

Plugin:
Ave Core
Plugin Slug:
ave-core
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-25460
The vulnerability has not been patched. You should deactivate the plugin.

Build App Online

Plugin:
Build App Online
Plugin Slug:
build-app-online
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3651
The vulnerability has not been patched. You should deactivate the plugin.

Canto

Plugin:
Canto
Plugin Slug:
canto
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3335
The vulnerability has not been patched. You should deactivate the plugin.

CMS Commander

Plugin:
CMS Commander
Plugin Slug:
cms-commander-client
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3334
The vulnerability has not been patched. You should deactivate the plugin.

Comment SPAM Wiper

Plugin:
Comment SPAM Wiper
Plugin Slug:
comment-spam-wiper
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3353
The vulnerability has not been patched. You should deactivate the plugin.

Company Posts for LinkedIn

Plugin:
Company Posts for LinkedIn
Plugin Slug:
company-posts-for-linkedin
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1935
The vulnerability has not been patched. You should deactivate the plugin.

Content Syndication Toolkit

Plugin:
Content Syndication Toolkit
Plugin Slug:
content-syndication-toolkit
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3478
The vulnerability has not been patched. You should deactivate the plugin.

Curly Core

Plugin:
Curly Core
Plugin Slug:
curly-core
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27047
The vulnerability has not been patched. You should deactivate the plugin.

e-shot

Plugin:
e-shot
Plugin Slug:
e-shot-form-builder
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3546
The vulnerability has not been patched. You should deactivate the plugin.

Easy Image Gallery

Plugin:
Easy Image Gallery
Plugin Slug:
easy-image-gallery
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-2540
The vulnerability has not been patched. You should deactivate the plugin.

Ecover Builder For Dummies

Plugin:
Ecover Builder For Dummies
Plugin Slug:
ecover-builder-for-dummies
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4077
The vulnerability has not been patched. You should deactivate the plugin.

Ed’s Font Awesome

Plugin:
Ed’s Font Awesome
Plugin Slug:
eds-font-awesome
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2496
The vulnerability has not been patched. You should deactivate the plugin.

Ed’s Social Share

Plugin:
Ed’s Social Share
Plugin Slug:
eds-social-share
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2501
The vulnerability has not been patched. You should deactivate the plugin.

ElementCamp

Plugin:
ElementCamp
Plugin Slug:
element-camp
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2503
The vulnerability has not been patched. You should deactivate the plugin.

Expire Users

Plugin:
Expire Users
Plugin Slug:
expire-users
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-4261
The vulnerability has not been patched. You should deactivate the plugin.

Fonts Manager | Custom Fonts

Plugin:
Fonts Manager | Custom Fonts
Plugin Slug:
fonts-manager-custom-fonts
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-1800
The vulnerability has not been patched. You should deactivate the plugin.

FuseDesk

Plugin:
FuseDesk
Plugin Slug:
fusedesk
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1914
The vulnerability has not been patched. You should deactivate the plugin.

fyyd podcast shortcodes

Plugin:
fyyd podcast shortcodes
Plugin Slug:
fyyd-podcast-shortcodes
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4084
The vulnerability has not been patched. You should deactivate the plugin.

Go Night Pro

Plugin:
Go Night Pro
Plugin Slug:
go-night-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1886
The vulnerability has not been patched. You should deactivate the plugin.

Hr Press Lite

Plugin:
Hr Press Lite
Plugin Slug:
hr-press-lite
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2720
The vulnerability has not been patched. You should deactivate the plugin.

Integration with Hubspot Forms

Plugin:
Integration with Hubspot Forms
Plugin Slug:
integration-with-hubspot-forms
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1908
The vulnerability has not been patched. You should deactivate the plugin.

Invelity Product Feeds

Plugin:
Invelity Product Feeds
Plugin Slug:
invelity-products-feeds
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-14037
The vulnerability has not been patched. You should deactivate the plugin.

itsukaita

Plugin:
itsukaita
Plugin Slug:
itsukaita
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2427
The vulnerability has not been patched. You should deactivate the plugin.

iVysilani Shortcode

Plugin:
iVysilani Shortcode
Plugin Slug:
ivysilani-shortcode
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1851
The vulnerability has not been patched. You should deactivate the plugin.

Jobica Core

Plugin:
Jobica Core
Plugin Slug:
jobica-core
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27049
The vulnerability has not been patched. You should deactivate the plugin.

Linksy Search and Replace

Plugin:
Linksy Search and Replace
Plugin Slug:
linksy-search-and-replace
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2941
The vulnerability has not been patched. You should deactivate the plugin.

Listeo Core

Plugin:
Listeo Core
Plugin Slug:
listeo-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25461
The vulnerability has not been patched. You should deactivate the plugin.

Lobot Slider Administrator

Plugin:
Lobot Slider Administrator
Plugin Slug:
lobot-slider-administrator
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3331
The vulnerability has not been patched. You should deactivate the plugin.

login_register

Plugin:
login_register
Plugin Slug:
login-register
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1503
The vulnerability has not been patched. You should deactivate the plugin.

Mandatory Field

Plugin:
Mandatory Field
Plugin Slug:
mandatory-fields
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1278
The vulnerability has not been patched. You should deactivate the plugin.

MimeTypes Link Icons

Plugin:
MimeTypes Link Icons
Plugin Slug:
mimetypes-link-icons
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1313
The vulnerability has not been patched. You should deactivate the plugin.

MinhNhut Link Gateway

Plugin:
MinhNhut Link Gateway
Plugin Slug:
minhnhut-link-gateway
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3333
The vulnerability has not been patched. You should deactivate the plugin.

Modern Events Calendar

Plugin:
Modern Events Calendar
Plugin Slug:
modern-events-calendar
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-32583
The vulnerability has not been patched. You should deactivate the plugin.

Multi Functional Flexi Lightbox

Plugin:
Multi Functional Flexi Lightbox
Plugin Slug:
multi-functional-flexi-lightbox
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3347
The vulnerability has not been patched. You should deactivate the plugin.

Multi Post Carousel by Category

Plugin:
Multi Post Carousel by Category
Plugin Slug:
multi-post-carousel
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1275
The vulnerability has not been patched. You should deactivate the plugin.

myLinksDump

Plugin:
myLinksDump
Plugin Slug:
mylinksdump
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2279
The vulnerability has not been patched. You should deactivate the plugin.

Neos Connector for Fakturama

Plugin:
Neos Connector for Fakturama
Plugin Slug:
neos-connector-for-fakturama
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4143
The vulnerability has not been patched. You should deactivate the plugin.

Outgrow

Plugin:
Outgrow
Plugin Slug:
outgrow
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1889
The vulnerability has not been patched. You should deactivate the plugin.

Paypal Shortcodes

Plugin:
Paypal Shortcodes
Plugin Slug:
paypal-shortcodes
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3617
The vulnerability has not been patched. You should deactivate the plugin.

PQ Addons – Creative Elementor Widgets

Plugin:
PQ Addons – Creative Elementor Widgets
Plugin Slug:
peacefulqode-elementzplus-widgets
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1397
The vulnerability has not been patched. You should deactivate the plugin.

Performance Monitor

Plugin:
Performance Monitor
Plugin Slug:
performance-monitor
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1648
The vulnerability has not been patched. You should deactivate the plugin.

Post Flagger

Plugin:
Post Flagger
Plugin Slug:
post-flagger
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1854
The vulnerability has not been patched. You should deactivate the plugin.

Post Snippits

Plugin:
Post Snippits
Plugin Slug:
post-snippits
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2723
The vulnerability has not been patched. You should deactivate the plugin.

Post Affiliate Pro

Plugin:
Post Affiliate Pro
Plugin Slug:
postaffiliatepro
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2290
The vulnerability has not been patched. You should deactivate the plugin.

Pre* Party Resource Hints

Plugin:
Pre* Party Resource Hints
Plugin Slug:
pre-party-browser-hints
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-4087
The vulnerability has not been patched. You should deactivate the plugin.

Punnel – Landing Page Builder

Plugin:
Punnel – Landing Page Builder
Plugin Slug:
punnel-landing-page-builder
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3645
The vulnerability has not been patched. You should deactivate the plugin.

Quentn WP

Plugin:
Quentn WP
Plugin Slug:
quentn-wp
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-2468
The vulnerability has not been patched. You should deactivate the plugin.

Redirect countdown

Plugin:
Redirect countdown
Plugin Slug:
redirect-countdown
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1390
The vulnerability has not been patched. You should deactivate the plugin.

REST API TO MiniProgram

Plugin:
REST API TO MiniProgram
Plugin Slug:
rest-api-to-miniprogram
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3460
The vulnerability has not been patched. You should deactivate the plugin.

Review Map by RevuKangaroo

Plugin:
Review Map by RevuKangaroo
Plugin Slug:
review-map-by-revukangaroo
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4161
The vulnerability has not been patched. You should deactivate the plugin.

Ricerca – advanced search

Plugin:
Ricerca – advanced search
Plugin Slug:
ricerca-smart-search
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2837
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Infinite Scroll

Plugin:
WooCommerce Infinite Scroll
Plugin Slug:
sb-woocommerce-infinite-scroll
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27045
The vulnerability has not been patched. You should deactivate the plugin.

Schema Shortcode

Plugin:
Schema Shortcode
Plugin Slug:
schema-shortcode
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1575
The vulnerability has not been patched. You should deactivate the plugin.

Sheets2Table

Plugin:
Sheets2Table
Plugin Slug:
sheets2table
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3619
The vulnerability has not been patched. You should deactivate the plugin.

Sherk Custom Post Type Displays

Plugin:
Sherk Custom Post Type Displays
Plugin Slug:
sherk-custom-post-type-displays
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3554
The vulnerability has not been patched. You should deactivate the plugin.

Weaver Show Posts

Plugin:
Weaver Show Posts
Plugin Slug:
show-posts
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2121
The vulnerability has not been patched. You should deactivate the plugin.

Show Posts list

Plugin:
Show Posts list
Plugin Slug:
show-posts-shortcodes
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4022
The vulnerability has not been patched. You should deactivate the plugin.

Simple Football Scoreboard

Plugin:
Simple Football Scoreboard
Plugin Slug:
simple-football-score-board
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1891
The vulnerability has not been patched. You should deactivate the plugin.

Smarter Analytics

Plugin:
Smarter Analytics
Plugin Slug:
smarter-analytics
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3570
The vulnerability has not been patched. You should deactivate the plugin.

Speedup Optimization

Plugin:
Speedup Optimization
Plugin Slug:
speedup-optimization
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4127
The vulnerability has not been patched. You should deactivate the plugin.

SR WP Minify HTML

Plugin:
SR WP Minify HTML
Plugin Slug:
sr-wp-minify-html
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1392
The vulnerability has not been patched. You should deactivate the plugin.

Survey

Plugin:
Survey
Plugin Slug:
survey
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1247
The vulnerability has not been patched. You should deactivate the plugin.

Task Manager

Plugin:
Task Manager
Plugin Slug:
task-manager
Vulnerability:
Arbitrary File Download
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2351
The vulnerability has not been patched. You should deactivate the plugin.

Text Toggle

Plugin:
Text Toggle
Plugin Slug:
text-toggle
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3997
The vulnerability has not been patched. You should deactivate the plugin.

The Aisle Core

Plugin:
The Aisle Core
Plugin Slug:
theaisle-core
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27048
The vulnerability has not been patched. You should deactivate the plugin.

Tour & Activity Operator Plugin for TourCMS

Plugin:
Tour & Activity Operator Plugin for TourCMS
Plugin Slug:
tour-operator-plugin
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1806
The vulnerability has not been patched. You should deactivate the plugin.

Tutor LMS Pro

Plugin:
Tutor LMS Pro
Plugin Slug:
tutor-pro
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25406
The vulnerability has not been patched. You should deactivate the plugin.

Twitter Feeds

Plugin:
Twitter Feeds
Plugin Slug:
twitter-feeds
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1911
The vulnerability has not been patched. You should deactivate the plugin.

Unlimited Elements for Elementor (Premium)

Plugin:
Unlimited Elements for Elementor (Premium)
Plugin Slug:
unlimited-elements-for-elementor-premium
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27041
The vulnerability has not been patched. You should deactivate the plugin.

Vagaro Booking Widget

Plugin:
Vagaro Booking Widget
Plugin Slug:
vagaro-booking-widget
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3003
The vulnerability has not been patched. You should deactivate the plugin.

Wikilookup

Plugin:
Wikilookup
Plugin Slug:
wikilookup
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3354
The vulnerability has not been patched. You should deactivate the plugin.

WishList Member X

Plugin:
WishList Member X
Plugin Slug:
wishlist-member-x
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25445
The vulnerability has not been patched. You should deactivate the plugin.

WishList Member X

Plugin:
WishList Member X
Plugin Slug:
wishlist-member-x
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-25446
The vulnerability has not been patched. You should deactivate the plugin.

WZone

Plugin:
WZone
Plugin Slug:
woozone
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27039
The vulnerability has not been patched. You should deactivate the plugin.

WZone

Plugin:
WZone
Plugin Slug:
woozone
Vulnerability:
Arbitrary File Deletion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27040
The vulnerability has not been patched. You should deactivate the plugin.

WordPress PayPal Donation

Plugin:
WordPress PayPal Donation
Plugin Slug:
wordpress-paypal-donation
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4072
The vulnerability has not been patched. You should deactivate the plugin.

WP-Chatbot for Messenger

Plugin:
WP-Chatbot for Messenger
Plugin Slug:
wp-chatbot
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3506
The vulnerability has not been patched. You should deactivate the plugin.

WP Games Embed

Plugin:
WP Games Embed
Plugin Slug:
wp-games-embed
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3996
The vulnerability has not been patched. You should deactivate the plugin.

WP NG Weather

Plugin:
WP NG Weather
Plugin Slug:
wp-ng-weather
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1822
The vulnerability has not been patched. You should deactivate the plugin.

WP Posts Re-order

Plugin:
WP Posts Re-order
Plugin Slug:
wp-posts-re-order
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1378
The vulnerability has not been patched. You should deactivate the plugin.

WP Random Button

Plugin:
WP Random Button
Plugin Slug:
wp-random-button
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-4086
The vulnerability has not been patched. You should deactivate the plugin.

WPBookit Pro

Plugin:
WPBookit Pro
Plugin Slug:
wpbookit-pro
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-25413
The vulnerability has not been patched. You should deactivate the plugin.

WPBookit Pro

Plugin:
WPBookit Pro
Plugin Slug:
wpbookit-pro
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25414
The vulnerability has not been patched. You should deactivate the plugin.

WPFAQBlock

Plugin:
WPFAQBlock
Plugin Slug:
wpfaqblock
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1093
The vulnerability has not been patched. You should deactivate the plugin.

Writeprint Stylometry

Plugin:
Writeprint Stylometry
Plugin Slug:
writeprint-stylometry
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-3512
The vulnerability has not been patched. You should deactivate the plugin.

Xhanch – My Advanced Settings

Plugin:
Xhanch – My Advanced Settings
Plugin Slug:
xhanch-my-advanced-settings
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-3332
The vulnerability has not been patched. You should deactivate the plugin.

Yoast Duplicate Post

Plugin:
Yoast Duplicate Post
Plugin Slug:
duplicate-post
Installations
4,000,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.6
Severity Score:
Medium
CVE:
2026-1217
The vulnerability has been patched, so you should update to version 4.6.

Autoptimize

Plugin:
Autoptimize
Plugin Slug:
autoptimize
Installations
900,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.1.15
Severity Score:
Medium
CVE:
2026-2430
The vulnerability has been patched, so you should update to version 3.1.15.

Autoptimize

Plugin:
Autoptimize
Plugin Slug:
autoptimize
Installations
900,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.1.15
Severity Score:
Medium
CVE:
2026-2352
The vulnerability has been patched, so you should update to version 3.1.15.

WP Go Maps (formerly WP Google Maps)

Plugin:
WP Go Maps (formerly WP Google Maps)
Plugin Slug:
wp-google-maps
Installations
300,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
10.0.06
Severity Score:
Medium
CVE:
2026-4268
The vulnerability has been patched, so you should update to version 10.0.06.

Download Manager

Plugin:
Download Manager
Plugin Slug:
download-manager
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.3.50
Severity Score:
Medium
CVE:
2026-2571
The vulnerability has been patched, so you should update to version 3.3.50.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
3.9.5
Severity Score:
Medium
CVE:
2025-32223
The vulnerability has been patched, so you should update to version 3.9.5.

JetFormBuilder — Dynamic Blocks Form Builder

Plugin:
JetFormBuilder — Dynamic Blocks Form Builder
Plugin Slug:
jetformbuilder
Installations
90,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
3.5.6.2
Severity Score:
Critical
CVE:
2026-32525
The vulnerability has been patched, so you should update to version 3.5.6.2.

SlimStat Analytics

Plugin:
SlimStat Analytics
Plugin Slug:
wp-slimstat
Installations
80,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.4.0
Severity Score:
High
CVE:
2026-1238
The vulnerability has been patched, so you should update to version 5.4.0.

Online Scheduling and Appointment Booking System – Bookly

Plugin:
Online Scheduling and Appointment Booking System – Bookly
Plugin Slug:
bookly-responsive-appointment-booking-tool
Installations
70,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
26.8
Severity Score:
High
CVE:
2026-32540
The vulnerability has been patched, so you should update to version 26.8.

EmailKit – Email Customizer for WooCommerce & WP

Plugin:
EmailKit – Email Customizer for WooCommerce & WP
Plugin Slug:
emailkit
Installations
70,000+
Vulnerability:
Path Traversal
Patched in Version:
1.6.4
Severity Score:
Medium
CVE:
2026-3474
The vulnerability has been patched, so you should update to version 1.6.4.

SMTP Mailer

Plugin:
SMTP Mailer
Plugin Slug:
smtp-mailer
Installations
70,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
1.1.25
Severity Score:
High
CVE:
2026-32538
The vulnerability has been patched, so you should update to version 1.1.25.

Contextual Related Posts

Plugin:
Contextual Related Posts
Plugin Slug:
contextual-related-posts
Installations
60,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.2.2
Severity Score:
Medium
CVE:
2026-32565
The vulnerability has been patched, so you should update to version 4.2.2.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Privilege Escalation
Patched in Version:
5.1.3
Severity Score:
High
CVE:
2026-32488
The vulnerability has been patched, so you should update to version 5.1.3.

Visual Portfolio, Photo Gallery & Post Grid

Plugin:
Visual Portfolio, Photo Gallery & Post Grid
Plugin Slug:
visual-portfolio
Installations
60,000+
Vulnerability:
Local File Inclusion
Patched in Version:
3.5.2
Severity Score:
High
CVE:
2026-32537
The vulnerability has been patched, so you should update to version 3.5.2.

Mixed Media Gallery Blocks

Plugin:
Mixed Media Gallery Blocks
Plugin Slug:
simply-gallery-block
Installations
40,000+
Vulnerability:
Arbitrary Code Execution
Patched in Version:
3.3.2.1
Severity Score:
Critical
CVE:
2026-25345
The vulnerability has been patched, so you should update to version 3.3.2.1.

PPWP – Password Protect Pages

Plugin:
PPWP – Password Protect Pages
Plugin Slug:
password-protect-page
Installations
30,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.9.16
Severity Score:
Medium
CVE:
2026-32562
The vulnerability has been patched, so you should update to version 1.9.16.

Ultimate Post Kit Addons for Elementor

Plugin:
Ultimate Post Kit Addons for Elementor
Plugin Slug:
ultimate-post-kit
Installations
30,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.0.22
Severity Score:
Medium
CVE:
2026-24362
The vulnerability has been patched, so you should update to version 4.0.22.

Print Invoice & Delivery Notes for WooCommerce

Plugin:
Print Invoice & Delivery Notes for WooCommerce
Plugin Slug:
woocommerce-delivery-notes
Installations
30,000+
Vulnerability:
Broken Access Control
Patched in Version:
6.0.0
Severity Score:
High
CVE:
2026-25317
The vulnerability has been patched, so you should update to version 6.0.0.

WP Custom Admin Interface

Plugin:
WP Custom Admin Interface
Plugin Slug:
wp-custom-admin-interface
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.43
Severity Score:
Medium
CVE:
2026-32521
The vulnerability has been patched, so you should update to version 7.43.

Kali Forms — Contact Form & Drag-and-Drop Builder

Plugin:
Kali Forms — Contact Form & Drag-and-Drop Builder
Plugin Slug:
kali-forms
Installations
20,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
2.4.10
Severity Score:
Critical
CVE:
2026-3584
The vulnerability has been patched, so you should update to version 2.4.10.

New User Approve

Plugin:
New User Approve
Plugin Slug:
new-user-approve
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.2.4
Severity Score:
Medium
CVE:
2026-25390
The vulnerability has been patched, so you should update to version 3.2.4.

Lead Form Builder & Contact Form

Plugin:
Lead Form Builder & Contact Form
Plugin Slug:
lead-form-builder
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.2
Severity Score:
High
CVE:
2026-32532
The vulnerability has been patched, so you should update to version 2.0.2.

Membership Plugin – Restrict Content

Plugin:
Membership Plugin – Restrict Content
Plugin Slug:
restrict-content
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.2.23
Severity Score:
High
CVE:
2026-32546
The vulnerability has been patched, so you should update to version 3.2.23.

Membership Plugin – Restrict Content

Plugin:
Membership Plugin – Restrict Content
Plugin Slug:
restrict-content
Installations
10,000+
Vulnerability:
Broken Authentication
Patched in Version:
3.2.25
Severity Score:
Medium
CVE:
2026-4136
The vulnerability has been patched, so you should update to version 3.2.25.

Review Schema – Review & Structure Data Schema Plugin

Plugin:
Review Schema – Review & Structure Data Schema Plugin
Plugin Slug:
review-schema
Installations
10,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.2.7
Severity Score:
Medium
CVE:
2026-25344
The vulnerability has been patched, so you should update to version 2.2.7.

Code Embed

Plugin:
Code Embed
Plugin Slug:
simple-embed-code
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.5.2
Severity Score:
Medium
CVE:
2026-2512
The vulnerability has been patched, so you should update to version 2.5.2.

Subscriptions for WooCommerce

Plugin:
Subscriptions for WooCommerce
Plugin Slug:
subscriptions-for-woocommerce
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.9.3
Severity Score:
Medium
CVE:
2026-1926
The vulnerability has been patched, so you should update to version 1.9.3.

Team – Team Members Showcase Plugin

Plugin:
Team – Team Members Showcase Plugin
Plugin Slug:
tlp-team
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.0.12
Severity Score:
High
CVE:
2026-25026
The vulnerability has been patched, so you should update to version 5.0.12.

Spam Protect for Contact Form 7

Plugin:
Spam Protect for Contact Form 7
Plugin Slug:
wp-contact-form-7-spam-blocker
Installations
10,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.2.10
Severity Score:
Medium
CVE:
2026-32496
The vulnerability has been patched, so you should update to version 1.2.10.

WP REST Cache

Plugin:
WP REST Cache
Plugin Slug:
wp-rest-cache
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2026.1.1
Severity Score:
High
CVE:
2026-25347
The vulnerability has been patched, so you should update to version 2026.1.1.

WPVulnerability

Plugin:
WPVulnerability
Plugin Slug:
wpvulnerability
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.2.1.1
Severity Score:
Medium
CVE:
2026-24376
The vulnerability has been patched, so you should update to version 4.2.1.1.

YML for Yandex Market

Plugin:
YML for Yandex Market
Plugin Slug:
yml-for-yandex-market
Installations
10,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
5.3.0
Severity Score:
Medium
CVE:
2026-32567
The vulnerability has been patched, so you should update to version 5.3.0.

Contact Form Email

Plugin:
Contact Form Email
Plugin Slug:
contact-form-to-email
Installations
9,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.3.64
Severity Score:
Medium
CVE:
2026-32483
The vulnerability has been patched, so you should update to version 1.3.64.

Event Booking Manager for WooCommerce

Plugin:
Event Booking Manager for WooCommerce
Plugin Slug:
mage-eventpress
Installations
8,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.1.5
Severity Score:
High
CVE:
2026-25361
The vulnerability has been patched, so you should update to version 5.1.5.

WP TripAdvisor Review Slider

Plugin:
WP TripAdvisor Review Slider
Plugin Slug:
wp-tripadvisor-review-slider
Installations
8,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
14.2
Severity Score:
Medium
CVE:
2026-32490
The vulnerability has been patched, so you should update to version 14.2.

EventPrime – Events Calendar, Bookings and Tickets

Plugin:
EventPrime – Events Calendar, Bookings and Tickets
Plugin Slug:
eventprime-event-calendar-management
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.2.8.4
Severity Score:
High
CVE:
2026-25312
The vulnerability has been patched, so you should update to version 4.2.8.4.

EventPrime – Events Calendar, Bookings and Tickets

Plugin:
EventPrime – Events Calendar, Bookings and Tickets
Plugin Slug:
eventprime-event-calendar-management
Installations
7,000+
Vulnerability:
PHP Object Injection
Patched in Version:
4.2.8.1
Severity Score:
Critical
CVE:
2026-24378
The vulnerability has been patched, so you should update to version 4.2.8.1.

JS Help Desk – AI-Powered Support & Ticketing System

Plugin:
JS Help Desk – AI-Powered Support & Ticketing System
Plugin Slug:
js-support-ticket
Installations
7,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
3.0.4
Severity Score:
Medium
CVE:
2026-32535
The vulnerability has been patched, so you should update to version 3.0.4.

NEX-Forms – Ultimate Forms Plugin for WordPress

Plugin:
NEX-Forms – Ultimate Forms Plugin for WordPress
Plugin Slug:
nex-forms-express-wp-form-builder
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
9.1.10
Severity Score:
Medium
CVE:
2026-1948
The vulnerability has been patched, so you should update to version 9.1.10.

NEX-Forms – Ultimate Forms Plugin for WordPress

Plugin:
NEX-Forms – Ultimate Forms Plugin for WordPress
Plugin Slug:
nex-forms-express-wp-form-builder
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
9.1.10
Severity Score:
High
CVE:
2026-1947
The vulnerability has been patched, so you should update to version 9.1.10.

WP Review Slider

Plugin:
WP Review Slider
Plugin Slug:
wp-facebook-reviews
Installations
7,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
14.0
Severity Score:
Medium
CVE:
2026-32491
The vulnerability has been patched, so you should update to version 14.0.

Get Use APIs – JSON Content Importer

Plugin:
Get Use APIs – JSON Content Importer
Plugin Slug:
json-content-importer
Installations
6,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.10
Severity Score:
Medium
CVE:
2025-15363
The vulnerability has been patched, so you should update to version 2.0.10.

ProfileGrid – User Profiles, Groups and Communities

Plugin:
ProfileGrid – User Profiles, Groups and Communities
Plugin Slug:
profilegrid-user-profiles-groups-and-communities
Installations
6,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.9.8.2
Severity Score:
Medium
CVE:
2026-25417
The vulnerability has been patched, so you should update to version 5.9.8.2.

User Verification by PickPlugins

Plugin:
User Verification by PickPlugins
Plugin Slug:
user-verification
Installations
5,000+
Vulnerability:
Broken Authentication
Patched in Version:
2.0.46
Severity Score:
Medium
CVE:
2026-32497
The vulnerability has been patched, so you should update to version 2.0.46.

Fraud Prevention For WooCommerce and EDD

Plugin:
Fraud Prevention For WooCommerce and EDD
Plugin Slug:
woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers
Installations
5,000+
Vulnerability:
Arbitrary Content Deletion
Patched in Version:
2.3.4
Severity Score:
High
CVE:
2026-25443
The vulnerability has been patched, so you should update to version 2.3.4.

ElementInvader Addons for Elementor

Plugin:
ElementInvader Addons for Elementor
Plugin Slug:
elementinvader-addons-for-elementor
Installations
4,000+
Vulnerability:
SQL Injection
Patched in Version:
1.4.3
Severity Score:
High
CVE:
2026-25007
The vulnerability has been patched, so you should update to version 1.4.3.

RSFirewall!

Plugin:
RSFirewall!
Plugin Slug:
rsfirewall
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.46
Severity Score:
High
CVE:
2026-25341
The vulnerability has been patched, so you should update to version 1.1.46.

Abandoned Cart Recovery for WooCommerce

Plugin:
Abandoned Cart Recovery for WooCommerce
Plugin Slug:
woo-abandoned-cart-recovery
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.11
Severity Score:
High
CVE:
2026-32526
The vulnerability has been patched, so you should update to version 1.1.11.

WPJAM Basic

Plugin:
WPJAM Basic
Plugin Slug:
wpjam-basic
Installations
4,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
6.9.2.1
Severity Score:
Critical
CVE:
2026-32523
The vulnerability has been patched, so you should update to version 6.9.2.1.

WP Telegram Widget and Join Link

Plugin:
WP Telegram Widget and Join Link
Plugin Slug:
wptelegram-widget
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.14
Severity Score:
High
CVE:
2026-23807
The vulnerability has been patched, so you should update to version 2.2.14.

JS Archive List

Plugin:
JS Archive List
Plugin Slug:
jquery-archive-list-widget
Installations
3,000+
Vulnerability:
PHP Object Injection
Patched in Version:
6.2.0
Severity Score:
High
CVE:
2026-32513
The vulnerability has been patched, so you should update to version 6.2.0.

Kargo Takip

Plugin:
Kargo Takip
Plugin Slug:
kargo-takip-turkiye
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
0.2.4
Severity Score:
Medium
CVE:
2026-25365
The vulnerability has been patched, so you should update to version 0.2.4.

Bit SMTP – Easy SMTP Solution with Email Logs

Plugin:
Bit SMTP – Easy SMTP Solution with Email Logs
Plugin Slug:
bit-smtp
Installations
2,000+
Vulnerability:
Broken Authentication
Patched in Version:
1.2.3
Severity Score:
Critical
CVE:
2026-32519
The vulnerability has been patched, so you should update to version 1.2.3.

Comments Import & Export

Plugin:
Comments Import & Export
Plugin Slug:
comments-import-export-woocommerce
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.5.0
Severity Score:
High
CVE:
2026-32441
The vulnerability has been patched, so you should update to version 2.5.0.

Info Cards – Add Text and Media in Card Layouts

Plugin:
Info Cards – Add Text and Media in Card Layouts
Plugin Slug:
info-cards
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.8
Severity Score:
Medium
CVE:
2026-4120
The vulnerability has been patched, so you should update to version 2.0.8.

KiviCare – Clinic & Patient Management System (EHR)

Plugin:
KiviCare – Clinic & Patient Management System (EHR)
Plugin Slug:
kivicare-clinic-management-system
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.0.0
Severity Score:
High
CVE:
2026-25383
The vulnerability has been patched, so you should update to version 4.0.0.

KiviCare – Clinic & Patient Management System (EHR)

Plugin:
KiviCare – Clinic & Patient Management System (EHR)
Plugin Slug:
kivicare-clinic-management-system
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.0.0
Severity Score:
Medium
CVE:
2026-25034
The vulnerability has been patched, so you should update to version 4.0.0.

KiviCare – Clinic & Patient Management System (EHR)

Plugin:
KiviCare – Clinic & Patient Management System (EHR)
Plugin Slug:
kivicare-clinic-management-system
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.1.3
Severity Score:
High
CVE:
2026-2992
The vulnerability has been patched, so you should update to version 4.1.3.

KiviCare – Clinic & Patient Management System (EHR)

Plugin:
KiviCare – Clinic & Patient Management System (EHR)
Plugin Slug:
kivicare-clinic-management-system
Installations
2,000+
Vulnerability:
Privilege Escalation
Patched in Version:
4.1.3
Severity Score:
Critical
CVE:
2026-2991
The vulnerability has been patched, so you should update to version 4.1.3.

Photo Engine (Media Organizer & Lightroom)

Plugin:
Photo Engine (Media Organizer & Lightroom)
Plugin Slug:
wplr-sync
Installations
2,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
6.5.0
Severity Score:
Critical
CVE:
2026-32524
The vulnerability has been patched, so you should update to version 6.5.0.

avalex – Automatisch sichere Rechtstexte

Plugin:
avalex – Automatisch sichere Rechtstexte
Plugin Slug:
avalex
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.1.4
Severity Score:
Medium
CVE:
2026-25462
The vulnerability has been patched, so you should update to version 3.1.4.

Contact List – Online Staff Directory & Address Book

Plugin:
Contact List – Online Staff Directory & Address Book
Plugin Slug:
contact-list
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.19
Severity Score:
Medium
CVE:
2026-3516
The vulnerability has been patched, so you should update to version 3.0.19.

Flexmls® IDX Plugin

Plugin:
Flexmls® IDX Plugin
Plugin Slug:
flexmls-idx
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.15.10
Severity Score:
High
CVE:
2026-25369
The vulnerability has been patched, so you should update to version 3.15.10.

Injection Guard

Plugin:
Injection Guard
Plugin Slug:
injection-guard
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.0
Severity Score:
High
CVE:
2026-3368
The vulnerability has been patched, so you should update to version 1.3.0.

My Tickets – Accessible Event Ticketing

Plugin:
My Tickets – Accessible Event Ticketing
Plugin Slug:
my-tickets
Installations
700+
Vulnerability:
Bypass Vulnerability
Patched in Version:
2.1.2
Severity Score:
Medium
CVE:
2026-32492
The vulnerability has been patched, so you should update to version 2.1.2.

Premmerce Redirect Manager

Plugin:
Premmerce Redirect Manager
Plugin Slug:
premmerce-redirect-manager
Installations
600+
Vulnerability:
Broken Access Control
Patched in Version:
1.0.13
Severity Score:
Medium
CVE:
2026-32541
The vulnerability has been patched, so you should update to version 1.0.13.

VikRestaurants Table Reservations and Take-Away

Plugin:
VikRestaurants Table Reservations and Take-Away
Plugin Slug:
vikrestaurants
Installations
600+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.3
Severity Score:
High
CVE:
2026-25025
The vulnerability has been patched, so you should update to version 1.5.3.

Taboola Pixel

Plugin:
Taboola Pixel
Plugin Slug:
taboola-pixel
Installations
400+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.5
Severity Score:
High
CVE:
2026-32545
The vulnerability has been patched, so you should update to version 1.1.5.

Keep Backup Daily

Plugin:
Keep Backup Daily
Plugin Slug:
keep-backup-daily
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.3
Severity Score:
Medium
CVE:
2026-3577
The vulnerability has been patched, so you should update to version 2.1.3.

Keep Backup Daily

Plugin:
Keep Backup Daily
Plugin Slug:
keep-backup-daily
Installations
300+
Vulnerability:
Path Traversal
Patched in Version:
2.1.3
Severity Score:
Low
CVE:
2026-3339
The vulnerability has been patched, so you should update to version 2.1.3.

Helpdesk Support Ticket System for WooCommerce

Plugin:
Helpdesk Support Ticket System for WooCommerce
Plugin Slug:
support-ticket-system-for-woocommerce
Installations
200+
Vulnerability:
Broken Access Control
Patched in Version:
2.1.3
Severity Score:
High
CVE:
2026-23977
The vulnerability has been patched, so you should update to version 2.1.3.

ilGhera Carta Docente for WooCommerce

Plugin:
ilGhera Carta Docente for WooCommerce
Plugin Slug:
wc-carta-docente
Installations
200+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.5.1
Severity Score:
Medium
CVE:
2026-2421
The vulnerability has been patched, so you should update to version 1.5.1.

Image Slider by Ays- Responsive Slider and Carousel

Plugin:
Image Slider by Ays- Responsive Slider and Carousel
Plugin Slug:
ays-slider
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.7.2
Severity Score:
High
CVE:
2026-32494
The vulnerability has been patched, so you should update to version 2.7.2.

Contact Manager

Plugin:
Contact Manager
Plugin Slug:
contact-manager
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
9.1.1
Severity Score:
High
CVE:
2026-32517
The vulnerability has been patched, so you should update to version 9.1.1.

Creator LMS – Online Courses and eLearning Plugin

Plugin:
Creator LMS – Online Courses and eLearning Plugin
Plugin Slug:
creatorlms
Installations
100+
Vulnerability:
Privilege Escalation
Patched in Version:
1.1.19
Severity Score:
High
CVE:
2026-32530
The vulnerability has been patched, so you should update to version 1.1.19.

FAQ Builder AYS

Plugin:
FAQ Builder AYS
Plugin Slug:
faq-builder-ays
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.8.3
Severity Score:
High
CVE:
2026-25346
The vulnerability has been patched, so you should update to version 1.8.3.

LearnPress – Sepay Payment

Plugin:
LearnPress – Sepay Payment
Plugin Slug:
learnpress-sepay-payment
Installations
100+
Vulnerability:
Broken Authentication
Patched in Version:
4.0.1
Severity Score:
High
CVE:
2026-25002
The vulnerability has been patched, so you should update to version 4.0.1.

Petitioner

Plugin:
Petitioner
Plugin Slug:
petitioner
Installations
100+
Vulnerability:
Broken Access Control
Patched in Version:
0.7.4
Severity Score:
Medium
CVE:
2026-32514
The vulnerability has been patched, so you should update to version 0.7.4.

Product File Upload for WooCommerce

Plugin:
Product File Upload for WooCommerce
Plugin Slug:
products-file-upload-for-woocommerce
Installations
100+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
2.2.5
Severity Score:
Medium
CVE:
2026-25328
The vulnerability has been patched, so you should update to version 2.2.5.

Add Custom Fields to Media

Plugin:
Add Custom Fields to Media
Plugin Slug:
add-custom-fields-to-media
Installations
90+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.0.4
Severity Score:
Medium
CVE:
2026-4068
The vulnerability has been patched, so you should update to version 2.0.4.

Draft List

Plugin:
Draft List
Plugin Slug:
simple-draft-list
Installations
80+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.6.3
Severity Score:
Medium
CVE:
2026-4006
The vulnerability has been patched, so you should update to version 2.6.3.

Filestack WP Upload

Plugin:
Filestack WP Upload
Plugin Slug:
filestack-upload
Installations
60+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.0
Severity Score:
High
CVE:
2024-11462
The vulnerability has been patched, so you should update to version 3.0.0.

Activity Log for WordPress

Plugin:
Activity Log for WordPress
Plugin Slug:
winterlock
Installations
60+
Vulnerability:
Broken Access Control
Patched in Version:
1.2.8
Severity Score:
Medium
CVE:
2026-24987
The vulnerability has been patched, so you should update to version 1.2.8.

Scoreboard for HTML5 Games Lite

Plugin:
Scoreboard for HTML5 Games Lite
Plugin Slug:
scoreboard-for-html5-game-lite
Installations
20+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3
Severity Score:
Medium
CVE:
2026-4083
The vulnerability has been patched, so you should update to version 1.3.

[CR]Paid Link Manager

Plugin:
[CR]Paid Link Manager
Plugin Slug:
crpaid-link-manager
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.6
Severity Score:
High
CVE:
2026-1780
The vulnerability has been patched, so you should update to version 0.6.

RockPress

Plugin:
RockPress
Plugin Slug:
ft-rockpress
Installations
10+
Vulnerability:
Broken Access Control
Patched in Version:
1.0.18
Severity Score:
Medium
CVE:
2026-3550
The vulnerability has been patched, so you should update to version 1.0.18.

WP Cost Estimation & Payment Forms Builder

Plugin:
WP Cost Estimation & Payment Forms Builder
Plugin Slug:
WP_Estimation_Form
Vulnerability:
Broken Access Control
Patched in Version:
10.3.0
Severity Score:
High
CVE:
2026-24363
The vulnerability has been patched, so you should update to version 10.3.0.

Addon Jobsearch Chat

Plugin:
Addon Jobsearch Chat
Plugin Slug:
addon-jobsearch-chat
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.1
Severity Score:
High
CVE:
2026-25376
The vulnerability has been patched, so you should update to version 3.1.

Addon Jobsearch Chat

Plugin:
Addon Jobsearch Chat
Plugin Slug:
addon-jobsearch-chat
Vulnerability:
SQL Injection
Patched in Version:
3.1
Severity Score:
Critical
CVE:
2026-25377
The vulnerability has been patched, so you should update to version 3.1.

SUMO Affiliates Pro

Plugin:
SUMO Affiliates Pro
Plugin Slug:
affs
Vulnerability:
PHP Object Injection
Patched in Version:
11.4.0
Severity Score:
Critical
CVE:
2026-24989
The vulnerability has been patched, so you should update to version 11.4.0.

Aimogen Pro

Plugin:
Aimogen Pro
Plugin Slug:
aimogen-pro
Vulnerability:
Privilege Escalation
Patched in Version:
2.7.6
Severity Score:
Critical
CVE:
2026-4038
The vulnerability has been patched, so you should update to version 2.7.6.

Elated Listing

Plugin:
Elated Listing
Plugin Slug:
eltd-listing
Vulnerability:
Broken Access Control
Patched in Version:
1.5
Severity Score:
Medium
CVE:
2026-24972
The vulnerability has been patched, so you should update to version 1.5.

XStore Core

Plugin:
XStore Core
Plugin Slug:
et-core-plugin
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.6.5
Severity Score:
High
CVE:
2026-25306
The vulnerability has been patched, so you should update to version 5.6.5.

Fusion Builder

Plugin:
Fusion Builder
Plugin Slug:
fusion-builder
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.15.0
Severity Score:
High
CVE:
2026-32542
The vulnerability has been patched, so you should update to version 3.15.0.

Gyan Elements

Plugin:
Gyan Elements
Plugin Slug:
gyan-elements
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.2
Severity Score:
High
CVE:
2026-23979
The vulnerability has been patched, so you should update to version 2.2.2.

Green Downloads

Plugin:
Green Downloads
Plugin Slug:
halfdata-paypal-green-downloads
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.09
Severity Score:
Critical
CVE:
2026-32536
The vulnerability has been patched, so you should update to version 2.09.

Ultimate Membership Pro

Plugin:
Ultimate Membership Pro
Plugin Slug:
indeed-membership-pro
Vulnerability:
Broken Authentication
Patched in Version:
13.7.1
Severity Score:
High
CVE:
2026-25357
The vulnerability has been patched, so you should update to version 13.7.1.

Jobica Core

Plugin:
Jobica Core
Plugin Slug:
jobica-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.2
Severity Score:
High
CVE:
2026-24979
The vulnerability has been patched, so you should update to version 1.4.2.

Jobica Core

Plugin:
Jobica Core
Plugin Slug:
jobica-core
Vulnerability:
PHP Object Injection
Patched in Version:
1.4.2
Severity Score:
High
CVE:
2026-24978
The vulnerability has been patched, so you should update to version 1.4.2.

Lumise Product Designer

Plugin:
Lumise Product Designer
Plugin Slug:
lumise
Vulnerability:
SQL Injection
Patched in Version:
2.0.9
Severity Score:
Critical
CVE:
2026-25371
The vulnerability has been patched, so you should update to version 2.0.9.

Miraculous Core Plugin

Plugin:
Miraculous Core Plugin
Plugin Slug:
miraculouscore
Vulnerability:
SQL Injection
Patched in Version:
2.1.2
Severity Score:
High
CVE:
2026-32516
The vulnerability has been patched, so you should update to version 2.1.2.

Motta Addons

Plugin:
Motta Addons
Plugin Slug:
motta-addons
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.6.1
Severity Score:
High
CVE:
2026-25033
The vulnerability has been patched, so you should update to version 1.6.1.

NaturaLife Extensions

Plugin:
NaturaLife Extensions
Plugin Slug:
naturalife-extensions
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2
Severity Score:
High
CVE:
2026-25018
The vulnerability has been patched, so you should update to version 2.2.

NaturaLife Extensions

Plugin:
NaturaLife Extensions
Plugin Slug:
naturalife-extensions
Vulnerability:
Local File Inclusion
Patched in Version:
2.2
Severity Score:
High
CVE:
2026-25017
The vulnerability has been patched, so you should update to version 2.2.

Organici Library

Plugin:
Organici Library
Plugin Slug:
noo-organici-library
Vulnerability:
SQL Injection
Patched in Version:
2.1.3
Severity Score:
High
CVE:
2026-24977
The vulnerability has been patched, so you should update to version 2.1.3.

Organici Library

Plugin:
Organici Library
Plugin Slug:
noo-organici-library
Vulnerability:
PHP Object Injection
Patched in Version:
2.1.3
Severity Score:
High
CVE:
2026-24976
The vulnerability has been patched, so you should update to version 2.1.3.

Organici Library

Plugin:
Organici Library
Plugin Slug:
noo-organici-library
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.3
Severity Score:
High
CVE:
2026-24975
The vulnerability has been patched, so you should update to version 2.1.3.

Visionary Core

Plugin:
Visionary Core
Plugin Slug:
noo-visionary-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.0
Severity Score:
High
CVE:
2026-24980
The vulnerability has been patched, so you should update to version 1.5.0.

Visionary Core

Plugin:
Visionary Core
Plugin Slug:
noo-visionary-core
Vulnerability:
PHP Object Injection
Patched in Version:
1.5.0
Severity Score:
High
CVE:
2026-24981
The vulnerability has been patched, so you should update to version 1.5.0.

Phox Hosting

Plugin:
Phox Hosting
Plugin Slug:
phox-host
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.9
Severity Score:
High
CVE:
2026-25013
The vulnerability has been patched, so you should update to version 2.0.9.

Salon Booking System Pro

Plugin:
Salon Booking System Pro
Plugin Slug:
salon-booking-plugin-pro
Vulnerability:
Broken Authentication
Patched in Version:
10.30.12
Severity Score:
High
CVE:
2026-25334
The vulnerability has been patched, so you should update to version 10.30.12.

tagDiv Opt-In Builder

Plugin:
tagDiv Opt-In Builder
Plugin Slug:
td-subscription
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.4
Severity Score:
High
CVE:
2025-53222
The vulnerability has been patched, so you should update to version 1.7.4.

The Grid

Plugin:
The Grid
Plugin Slug:
the-grid
Vulnerability:
Broken Access Control
Patched in Version:
2.8.0
Severity Score:
High
CVE:
2026-24369
The vulnerability has been patched, so you should update to version 2.8.0.

The Grid

Plugin:
The Grid
Plugin Slug:
the-grid
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.8.0
Severity Score:
Medium
CVE:
2026-24370
The vulnerability has been patched, so you should update to version 2.8.0.

UpSolution Core

Plugin:
UpSolution Core
Plugin Slug:
us-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
8.42
Severity Score:
High
CVE:
2026-24983
The vulnerability has been patched, so you should update to version 8.42.

WooCommerce Support Ticket System

Plugin:
WooCommerce Support Ticket System
Plugin Slug:
woocommerce-support-ticket-system
Vulnerability:
Arbitrary File Deletion
Patched in Version:
18.5
Severity Score:
High
CVE:
2026-32522
The vulnerability has been patched, so you should update to version 18.5.

WP Configurator Pro

Plugin:
WP Configurator Pro
Plugin Slug:
wp-configurator-pro
Vulnerability:
Broken Access Control
Patched in Version:
3.8.0
Severity Score:
High
CVE:
2026-32501
The vulnerability has been patched, so you should update to version 3.8.0.

JobSearch

Plugin:
JobSearch
Plugin Slug:
wp-jobsearch
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.2
Severity Score:
High
CVE:
2026-32493
The vulnerability has been patched, so you should update to version 3.2.2.

WordPress Themes — 49 Patched / 7 Unpatched

Apicona

Theme:
Apicona
Theme Slug:
apicona
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25400
The vulnerability has not been patched. You should switch themes.

Jannah

Theme:
Jannah
Theme Slug:
jannah
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25464
The vulnerability has not been patched. You should switch themes.

Kentha

Theme:
Kentha
Theme Slug:
kentha
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25442
The vulnerability has not been patched. You should switch themes.

Mixtape

Theme:
Mixtape
Theme Slug:
mixtape
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25457
The vulnerability has not been patched. You should switch themes.

Moments

Theme:
Moments
Theme Slug:
moments
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25458
The vulnerability has not been patched. You should switch themes.

Photography

Theme:
Photography
Theme Slug:
photography
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27043
The vulnerability has not been patched. You should switch themes.

The League

Theme:
The League
Theme Slug:
the-league
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-25454
The vulnerability has not been patched. You should switch themes.

Education Zone

Theme:
Education Zone
Theme Slug:
education-zone
Downloads
483,880
Vulnerability:
Broken Access Control
Patched in Version:
1.3.9
Severity Score:
Medium
CVE:
2026-25009
The vulnerability has been patched, so you should update to version 1.3.9.

Ona

Theme:
Ona
Theme Slug:
ona
Downloads
243,101
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.24
Severity Score:
Critical
CVE:
2026-32482
The vulnerability has been patched, so you should update to version 1.24.

Archicon

Theme:
Archicon
Theme Slug:
archicon
Vulnerability:
PHP Object Injection
Patched in Version:
1.7
Severity Score:
Medium
CVE:
2026-32506
The vulnerability has been patched, so you should update to version 1.7.

Borgholm

Theme:
Borgholm
Theme Slug:
borgholm-marketing-agency-theme
Vulnerability:
PHP Object Injection
Patched in Version:
1.6
Severity Score:
Critical
CVE:
2026-32502
The vulnerability has been patched, so you should update to version 1.6.

Car Dealer

Theme:
Car Dealer
Theme Slug:
cardealer
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.6.8
Severity Score:
High
CVE:
2026-24391
The vulnerability has been patched, so you should update to version 1.6.8.

Feedy

Theme:
Feedy
Theme Slug:
feedy
Vulnerability:
Local File Inclusion
Patched in Version:
2.1.5
Severity Score:
High
CVE:
2026-25380
The vulnerability has been patched, so you should update to version 2.1.5.

Gaea

Theme:
Gaea
Theme Slug:
gaea
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.8
Severity Score:
High
CVE:
2026-32518
The vulnerability has been patched, so you should update to version 3.8.

Goldish

Theme:
Goldish
Theme Slug:
goldish
Vulnerability:
PHP Object Injection
Patched in Version:
3.47
Severity Score:
Critical
CVE:
2026-25030
The vulnerability has been patched, so you should update to version 3.47.

Golo

Theme:
Golo
Theme Slug:
golo
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.5
Severity Score:
High
CVE:
2026-23973
The vulnerability has been patched, so you should update to version 1.7.5.

Gracey

Theme:
Gracey
Theme Slug:
gracey
Vulnerability:
PHP Object Injection
Patched in Version:
1.4
Severity Score:
Medium
CVE:
2026-32509
The vulnerability has been patched, so you should update to version 1.4.

Halstein

Theme:
Halstein
Theme Slug:
halstein
Vulnerability:
PHP Object Injection
Patched in Version:
1.8
Severity Score:
Medium
CVE:
2026-32508
The vulnerability has been patched, so you should update to version 1.8.

IdealAuto

Theme:
IdealAuto
Theme Slug:
idealauto
Vulnerability:
Local File Inclusion
Patched in Version:
3.8.6
Severity Score:
High
CVE:
2026-25382
The vulnerability has been patched, so you should update to version 3.8.6.

Jaroti

Theme:
Jaroti
Theme Slug:
jaroti
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.8
Severity Score:
High
CVE:
2026-25304
The vulnerability has been patched, so you should update to version 1.4.8.

Kamperen

Theme:
Kamperen
Theme Slug:
kamperen
Vulnerability:
PHP Object Injection
Patched in Version:
1.3
Severity Score:
Medium
CVE:
2026-32510
The vulnerability has been patched, so you should update to version 1.3.

Kiddy

Theme:
Kiddy
Theme Slug:
kiddy
Vulnerability:
Local File Inclusion
Patched in Version:
2.0.9
Severity Score:
High
CVE:
2026-32505
The vulnerability has been patched, so you should update to version 2.0.9.

KIDZ

Theme:
KIDZ
Theme Slug:
kidz
Vulnerability:
PHP Object Injection
Patched in Version:
5.25
Severity Score:
Critical
CVE:
2026-25029
The vulnerability has been patched, so you should update to version 5.25.

Kunco

Theme:
Kunco
Theme Slug:
kunco
Vulnerability:
Local File Inclusion
Patched in Version:
1.4.5
Severity Score:
High
CVE:
2026-32531
The vulnerability has been patched, so you should update to version 1.4.5.

Boutique

Theme:
Boutique
Theme Slug:
kute-boutique
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.6
Severity Score:
High
CVE:
2026-25342
The vulnerability has been patched, so you should update to version 2.4.6.

Leroux

Theme:
Leroux
Theme Slug:
leroux
Vulnerability:
PHP Object Injection
Patched in Version:
1.4
Severity Score:
Medium
CVE:
2026-32507
The vulnerability has been patched, so you should update to version 1.4.

Loobek

Theme:
Loobek
Theme Slug:
loobek
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.2
Severity Score:
High
CVE:
2026-25349
The vulnerability has been patched, so you should update to version 1.5.2.

LoveDate

Theme:
LoveDate
Theme Slug:
lovedate
Vulnerability:
Local File Inclusion
Patched in Version:
3.8.6
Severity Score:
High
CVE:
2026-25381
The vulnerability has been patched, so you should update to version 3.8.6.

Meloo

Theme:
Meloo
Theme Slug:
meloo
Vulnerability:
PHP Object Injection
Patched in Version:
2.8.2
Severity Score:
High
CVE:
2026-25358
The vulnerability has been patched, so you should update to version 2.8.2.

MetaMax

Theme:
MetaMax
Theme Slug:
metamax
Vulnerability:
Local File Inclusion
Patched in Version:
1.1.5
Severity Score:
High
CVE:
2026-32500
The vulnerability has been patched, so you should update to version 1.1.5.

Miraculous

Theme:
Miraculous
Theme Slug:
miraculous
Vulnerability:
Broken Access Control
Patched in Version:
2.1.2
Severity Score:
High
CVE:
2026-32515
The vulnerability has been patched, so you should update to version 2.1.2.

Miti

Theme:
Miti
Theme Slug:
miti
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.3
Severity Score:
High
CVE:
2026-25350
The vulnerability has been patched, so you should update to version 1.5.3.

Molla

Theme:
Molla
Theme Slug:
molla
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.19
Severity Score:
High
CVE:
2026-32529
The vulnerability has been patched, so you should update to version 1.5.19.

MyDecor

Theme:
MyDecor
Theme Slug:
mydecor
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.9
Severity Score:
High
CVE:
2026-25352
The vulnerability has been patched, so you should update to version 1.5.9.

MyMedi

Theme:
MyMedi
Theme Slug:
mymedi
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.7
Severity Score:
High
CVE:
2026-25351
The vulnerability has been patched, so you should update to version 1.7.7.

CitiLights

Theme:
CitiLights
Theme Slug:
noo-citilights
Vulnerability:
PHP Object Injection
Patched in Version:
3.7.2
Severity Score:
High
CVE:
2026-24974
The vulnerability has been patched, so you should update to version 3.7.2.

CitiLights

Theme:
CitiLights
Theme Slug:
noo-citilights
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.7.2
Severity Score:
High
CVE:
2026-24973
The vulnerability has been patched, so you should update to version 3.7.2.

Jobmonster

Theme:
Jobmonster
Theme Slug:
noo-jobmonster
Vulnerability:
SQL Injection
Patched in Version:
4.8.4
Severity Score:
Critical
CVE:
2026-25340
The vulnerability has been patched, so you should update to version 4.8.4.

Nooni

Theme:
Nooni
Theme Slug:
nooni
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.1
Severity Score:
High
CVE:
2026-25353
The vulnerability has been patched, so you should update to version 1.5.1.

Pelicula

Theme:
Pelicula
Theme Slug:
pelicula-video-production-and-movie-theme
Vulnerability:
PHP Object Injection
Patched in Version:
1.10
Severity Score:
Critical
CVE:
2026-32512
The vulnerability has been patched, so you should update to version 1.10.

Pendulum

Theme:
Pendulum
Theme Slug:
pendulum
Vulnerability:
PHP Object Injection
Patched in Version:
3.1.5
Severity Score:
High
CVE:
2026-25359
The vulnerability has been patched, so you should update to version 3.1.5.

Reebox

Theme:
Reebox
Theme Slug:
reebox
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.8
Severity Score:
High
CVE:
2026-25354
The vulnerability has been patched, so you should update to version 1.4.8.

Ricky

Theme:
Ricky
Theme Slug:
ricky
Vulnerability:
PHP Object Injection
Patched in Version:
2.31
Severity Score:
Critical
CVE:
2026-25032
The vulnerability has been patched, so you should update to version 2.31.

Riode

Theme:
Riode
Theme Slug:
riode
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.6.29
Severity Score:
High
CVE:
2026-32528
The vulnerability has been patched, so you should update to version 1.6.29.

Sanzo

Theme:
Sanzo
Theme Slug:
sanzo
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.3
Severity Score:
Medium
CVE:
2026-25355
The vulnerability has been patched, so you should update to version 2.4.3.

Scape

Theme:
Scape
Theme Slug:
scape
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.5.16
Severity Score:
High
CVE:
2026-31913
The vulnerability has been patched, so you should update to version 1.5.16.

Stål

Theme:
Stål
Theme Slug:
stal
Vulnerability:
PHP Object Injection
Patched in Version:
1.7
Severity Score:
Medium
CVE:
2026-32511
The vulnerability has been patched, so you should update to version 1.7.

StreamVid

Theme:
StreamVid
Theme Slug:
streamvid
Vulnerability:
Local File Inclusion
Patched in Version:
6.8.6
Severity Score:
High
CVE:
2026-25379
The vulnerability has been patched, so you should update to version 6.8.6.

Tasty Daily

Theme:
Tasty Daily
Theme Slug:
tastydaily
Vulnerability:
PHP Object Injection
Patched in Version:
1.27
Severity Score:
Critical
CVE:
2026-25031
The vulnerability has been patched, so you should update to version 1.27.

Traveler

Theme:
Traveler
Theme Slug:
traveler
Vulnerability:
PHP Object Injection
Patched in Version:
3.2.8.1
Severity Score:
Critical
CVE:
2026-25449
The vulnerability has been patched, so you should update to version 3.2.8.1.

Trendustry

Theme:
Trendustry
Theme Slug:
trendustry
Vulnerability:
Local File Inclusion
Patched in Version:
1.1.5
Severity Score:
High
CVE:
2026-32503
The vulnerability has been patched, so you should update to version 1.1.5.

Vayvo

Theme:
Vayvo
Theme Slug:
vayvo-progression
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.8
Severity Score:
High
CVE:
2026-25373
The vulnerability has been patched, so you should update to version 6.8.

Vex

Theme:
Vex
Theme Slug:
vex
Vulnerability:
PHP Object Injection
Patched in Version:
1.2.9
Severity Score:
High
CVE:
2026-25360
The vulnerability has been patched, so you should update to version 1.2.9.

VintWood

Theme:
VintWood
Theme Slug:
vintwood
Vulnerability:
Local File Inclusion
Patched in Version:
1.1.9
Severity Score:
High
CVE:
2026-32504
The vulnerability has been patched, so you should update to version 1.1.9.

WoodMart

Theme:
WoodMart
Theme Slug:
woodmart
Vulnerability:
PHP Object Injection
Patched in Version:
8.3.9
Severity Score:
High
CVE:
2026-23971
The vulnerability has been patched, so you should update to version 8.3.9.

Yobazar

Theme:
Yobazar
Theme Slug:
yobazar
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.6.7
Severity Score:
High
CVE:
2026-25356
The vulnerability has been patched, so you should update to version 1.6.7.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — March 25, 2026 appeared first on SolidWP.

]]> WordPress Vulnerability Report — March 18, 2026 https://solidwp.com/blog/wordpress-vulnerability-report-march-18-2026/ Wed, 18 Mar 2026 16:00:00 +0000 https://solidwp.com/?p=2553099 Since last week, 159 new vulnerabilities have emerged in the WordPress ecosystem, including 6 in Core, 130 plugins, and 23 themes. Of those, 46 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

The post WordPress Vulnerability Report — March 18, 2026 appeared first on SolidWP.

]]> In this report, 159 vulnerabilities have been publicly disclosed. Security patches for 113 of these Core, plugins, and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 46 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.9.4 is now available, addressing 10 security issues and a bug that affected template file loading on a limited number of sites. Because this is a security release, it is recommended that you update your sites immediately.

Also, WordPress 7.0 Beta 5 is ready for download and testing! As this is a pre-release version, it is intended for testing and development only and should not be installed on production or mission-critical sites. Organizations should use local or staging environments to evaluate compatibility and new features before the final rollout.

WordPress 7.0 is scheduled for release on April 9, 2026.

WordPress Core

Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.9.2
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 6.9.2.

WordPress Core

Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
6.9.2
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 6.9.2.

WordPress Core

Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.9.2
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 6.9.2.

WordPress Core

Vulnerability:
XML External Entity (XXE)
Patched in Version:
6.9.4
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 6.9.4.

WordPress Core

Vulnerability:
Broken Access Control
Patched in Version:
6.9.4
Severity Score:
Medium
CVE:
CVE-2026-3906
The vulnerability has been patched, so you should update to version 6.9.4.

WordPress Core

Vulnerability:
Broken Access Control
Patched in Version:
6.9.2
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 6.9.2.

WordPress Plugins — 100 Patched / 30 Unpatched

Addi – Cuotas que se adaptan a ti

Plugin:
Addi – Cuotas que se adaptan a ti
Plugin Slug:
buy-now-pay-later-addi
Installations
2,000+
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27073
The vulnerability has not been patched. You should deactivate the plugin.

TotalPoll for Polls and Contests

Plugin:
TotalPoll for Polls and Contests
Plugin Slug:
totalpoll-lite
Installations
1,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27044
The vulnerability has not been patched. You should deactivate the plugin.

ViaBill – WooCommerce

Plugin:
ViaBill – WooCommerce
Plugin Slug:
viabill-woocommerce
Installations
500+
Vulnerability:
Settings Change
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-25469
The vulnerability has not been patched. You should deactivate the plugin.

Photo Contest | Competition | Video Contest

Plugin:
Photo Contest | Competition | Video Contest
Plugin Slug:
totalcontest-lite
Installations
300+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-0677
The vulnerability has not been patched. You should deactivate the plugin.

Mobile App Editor – WordPress to Android App Builder

Plugin:
Mobile App Editor – WordPress to Android App Builder
Plugin Slug:
mobile-app-editor
Installations
40+
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27067
The vulnerability has not been patched. You should deactivate the plugin.

Admin Safety Guard — Login Security & 2FA

Plugin:
Admin Safety Guard — Login Security & 2FA
Plugin Slug:
admin-safety-guard
Installations
10+
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25471
The vulnerability has not been patched. You should deactivate the plugin.

ACPT (Pro) – Custom Post Types Plugin for WordPress

Plugin:
ACPT (Pro) – Custom Post Types Plugin for WordPress
Plugin Slug:
advanced-custom-post-type
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-25470
The vulnerability has not been patched. You should deactivate the plugin.

BuilderPress

Plugin:
BuilderPress
Plugin Slug:
builderpress
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27065
The vulnerability has not been patched. You should deactivate the plugin.

Curly Core

Plugin:
Curly Core
Plugin Slug:
curly-core
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27047
The vulnerability has not been patched. You should deactivate the plugin.

Darna Framework

Plugin:
Darna Framework
Plugin Slug:
darna-framework
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27088
The vulnerability has not been patched. You should deactivate the plugin.

DukaPress

Plugin:
DukaPress
Plugin Slug:
dukapress
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2466
The vulnerability has not been patched. You should deactivate the plugin.

Everest Forms Pro

Plugin:
Everest Forms Pro
Plugin Slug:
everest-forms-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27070
The vulnerability has not been patched. You should deactivate the plugin.

Handmade Framework

Plugin:
Handmade Framework
Plugin Slug:
handmade-framework
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22520
The vulnerability has not been patched. You should deactivate the plugin.

Jobica Core

Plugin:
Jobica Core
Plugin Slug:
jobica-core
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27049
The vulnerability has not been patched. You should deactivate the plugin.

Legacy Admin

Plugin:
Legacy Admin
Plugin Slug:
legacy-admin
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22524
The vulnerability has not been patched. You should deactivate the plugin.

MetForm Pro

Plugin:
MetForm Pro
Plugin Slug:
metform-pro
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-24611
The vulnerability has not been patched. You should deactivate the plugin.

Modern Events Calendar

Plugin:
Modern Events Calendar
Plugin Slug:
modern-events-calendar
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-32583
The vulnerability has not been patched. You should deactivate the plugin.

Penci Soledad Data Migrator

Plugin:
Penci Soledad Data Migrator
Plugin Slug:
penci-data-migrator
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27054
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Infinite Scroll

Plugin:
WooCommerce Infinite Scroll
Plugin Slug:
sb-woocommerce-infinite-scroll
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27045
The vulnerability has not been patched. You should deactivate the plugin.

The Aisle Core

Plugin:
The Aisle Core
Plugin Slug:
theaisle-core
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27048
The vulnerability has not been patched. You should deactivate the plugin.

UiPress lite

Plugin:
UiPress lite
Plugin Slug:
uipress-lite
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27091
The vulnerability has not been patched. You should deactivate the plugin.

Ultra WordPress Admin

Plugin:
Ultra WordPress Admin
Plugin Slug:
ultra-admin
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22523
The vulnerability has not been patched. You should deactivate the plugin.

Unlimited Elements for Elementor (Premium)

Plugin:
Unlimited Elements for Elementor (Premium)
Plugin Slug:
unlimited-elements-for-elementor-premium
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27041
The vulnerability has not been patched. You should deactivate the plugin.

Wolverine Framework

Plugin:
Wolverine Framework
Plugin Slug:
wolverine-framework
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27087
The vulnerability has not been patched. You should deactivate the plugin.

WZone

Plugin:
WZone
Plugin Slug:
woozone
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27039
The vulnerability has not been patched. You should deactivate the plugin.

WZone

Plugin:
WZone
Plugin Slug:
woozone
Vulnerability:
Arbitrary File Deletion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27040
The vulnerability has not been patched. You should deactivate the plugin.

WP App Bar

Plugin:
WP App Bar
Plugin Slug:
wp-app-bar
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1074
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce

Plugin:
WooCommerce
Plugin Slug:
woocommerce
Installations
7,000,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
10.5.3
Severity Score:
Medium
CVE:
2026-3589
The vulnerability has been patched, so you should update to version 10.5.3.

MC4WP: Mailchimp for WordPress

Plugin:
MC4WP: Mailchimp for WordPress
Plugin Slug:
mailchimp-for-wp
Installations
1,000,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.12.0
Severity Score:
Medium
CVE:
2026-1781
The vulnerability has been patched, so you should update to version 4.12.0.

The Events Calendar

Plugin:
The Events Calendar
Plugin Slug:
the-events-calendar
Installations
700,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
6.15.17.1
Severity Score:
High
CVE:
2026-3585
The vulnerability has been patched, so you should update to version 6.15.17.1.

Meta Box

Plugin:
Meta Box
Plugin Slug:
meta-box
Installations
500,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
5.11.2
Severity Score:
High
CVE:
2025-14675
The vulnerability has been patched, so you should update to version 5.11.2.

PixelYourSite – Your smart PIXEL (TAG) & API Manager

Plugin:
PixelYourSite – Your smart PIXEL (TAG) & API Manager
Plugin Slug:
pixelyoursite
Installations
500,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
11.2.0.1
Severity Score:
High
CVE:
2026-1841
The vulnerability has been patched, so you should update to version 11.2.0.1.

Ally – Web Accessibility & Usability

Plugin:
Ally – Web Accessibility & Usability
Plugin Slug:
pojo-accessibility
Installations
500,000+
Vulnerability:
SQL Injection
Patched in Version:
4.1.0
Severity Score:
Critical
CVE:
2026-2413
The vulnerability has been patched, so you should update to version 4.1.0.

Checkout Field Editor (Checkout Manager) for WooCommerce

Plugin:
Checkout Field Editor (Checkout Manager) for WooCommerce
Plugin Slug:
woo-checkout-field-editor-pro
Installations
500,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.8
Severity Score:
High
CVE:
2026-3231
The vulnerability has been patched, so you should update to version 2.1.8.

Admin Menu Editor

Plugin:
Admin Menu Editor
Plugin Slug:
admin-menu-editor
Installations
400,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.15
Severity Score:
Medium
CVE:
2026-32456
The vulnerability has been patched, so you should update to version 1.15.

Happy Addons for Elementor

Plugin:
Happy Addons for Elementor
Plugin Slug:
happy-elementor-addons
Installations
400,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
3.21.1
Severity Score:
Medium
CVE:
2026-2917
The vulnerability has been patched, so you should update to version 3.21.1.

Happy Addons for Elementor

Plugin:
Happy Addons for Elementor
Plugin Slug:
happy-elementor-addons
Installations
400,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.21.1
Severity Score:
Medium
CVE:
2026-2918
The vulnerability has been patched, so you should update to version 3.21.1.

Unlimited Elements For Elementor

Plugin:
Unlimited Elements For Elementor
Plugin Slug:
unlimited-elements-for-elementor
Installations
300,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.6
Severity Score:
High
CVE:
2026-2724
The vulnerability has been patched, so you should update to version 2.0.6.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
3.9.5
Severity Score:
Medium
CVE:
2025-32223
The vulnerability has been patched, so you should update to version 3.9.5.

Ultra Addons for Contact Form 7

Plugin:
Ultra Addons for Contact Form 7
Plugin Slug:
ultimate-addons-for-contact-form-7
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.5.37
Severity Score:
Medium
CVE:
2026-32460
The vulnerability has been patched, so you should update to version 3.5.37.

Advanced Product Fields (Product Addons) for WooCommerce

Plugin:
Advanced Product Fields (Product Addons) for WooCommerce
Plugin Slug:
advanced-product-fields-for-woocommerce
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.6.19
Severity Score:
Medium
CVE:
2026-32457
The vulnerability has been patched, so you should update to version 1.6.19.

RTMKit

Plugin:
RTMKit
Plugin Slug:
rometheme-for-elementor
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.0
Severity Score:
High
CVE:
2025-12473
The vulnerability has been patched, so you should update to version 2.0.0.

Calculated Fields Form

Plugin:
Calculated Fields Form
Plugin Slug:
calculated-fields-form
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.4.5.1
Severity Score:
Medium
CVE:
2026-3986
The vulnerability has been patched, so you should update to version 5.4.5.1.

Modular DS: Monitor, update, and backup multiple websites

Plugin:
Modular DS: Monitor, update, and backup multiple websites
Plugin Slug:
modular-connector
Installations
40,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.6.0
Severity Score:
Medium
CVE:
2026-3903
The vulnerability has been patched, so you should update to version 2.6.0.

NextScripts: Social Networks Auto-Poster

Plugin:
NextScripts: Social Networks Auto-Poster
Plugin Slug:
social-networks-auto-poster-facebook-twitter-g
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.4.7
Severity Score:
Medium
CVE:
2026-3228
The vulnerability has been patched, so you should update to version 4.4.7.

Website LLMs.txt

Plugin:
Website LLMs.txt
Plugin Slug:
website-llms-txt
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
8.2.7
Severity Score:
High
CVE:
2026-27068
The vulnerability has been patched, so you should update to version 8.2.7.

Job Postings

Plugin:
Job Postings
Plugin Slug:
job-postings
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.8.1
Severity Score:
High
CVE:
2026-23806
The vulnerability has been patched, so you should update to version 2.8.1.

Lead Form Builder & Contact Form

Plugin:
Lead Form Builder & Contact Form
Plugin Slug:
lead-form-builder
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.2
Severity Score:
High
CVE:
2026-1454
The vulnerability has been patched, so you should update to version 2.0.2.

Subscriptions for WooCommerce

Plugin:
Subscriptions for WooCommerce
Plugin Slug:
subscriptions-for-woocommerce
Installations
10,000+
Vulnerability:
Bypass Vulnerability
Patched in Version:
1.9.0
Severity Score:
High
CVE:
2026-24372
The vulnerability has been patched, so you should update to version 1.9.0.

Xagio SEO – AI Powered SEO

Plugin:
Xagio SEO – AI Powered SEO
Plugin Slug:
xagio-seo
Installations
10,000+
Vulnerability:
Privilege Escalation
Patched in Version:
7.1.0.31
Severity Score:
Critical
CVE:
2026-24968
The vulnerability has been patched, so you should update to version 7.1.0.31.

EventPrime – Events Calendar, Bookings and Tickets

Plugin:
EventPrime – Events Calendar, Bookings and Tickets
Plugin Slug:
eventprime-event-calendar-management
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.2.7.0
Severity Score:
High
CVE:
2025-69358
The vulnerability has been patched, so you should update to version 4.2.7.0.

NEX-Forms – Ultimate Forms Plugin for WordPress

Plugin:
NEX-Forms – Ultimate Forms Plugin for WordPress
Plugin Slug:
nex-forms-express-wp-form-builder
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
9.1.10
Severity Score:
Medium
CVE:
2026-1948
The vulnerability has been patched, so you should update to version 9.1.10.

Reading progressbar

Plugin:
Reading progressbar
Plugin Slug:
reading-progress-bar
Installations
6,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.1
Severity Score:
Medium
CVE:
2026-2687
The vulnerability has been patched, so you should update to version 1.3.1.

Responsive Blocks – Page Builder for Blocks & Patterns

Plugin:
Responsive Blocks – Page Builder for Blocks & Patterns
Plugin Slug:
responsive-block-editor-addons
Installations
4,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.2.1
Severity Score:
Medium
CVE:
2026-32543
The vulnerability has been patched, so you should update to version 2.2.1.

JS Archive List

Plugin:
JS Archive List
Plugin Slug:
jquery-archive-list-widget
Installations
3,000+
Vulnerability:
PHP Object Injection
Patched in Version:
6.2.0
Severity Score:
High
CVE:
2026-2020
The vulnerability has been patched, so you should update to version 6.2.0.

Name Directory

Plugin:
Name Directory
Plugin Slug:
name-directory
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.33.0
Severity Score:
High
CVE:
2026-3178
The vulnerability has been patched, so you should update to version 1.33.0.

Simple Ajax Chat – Add a Fast, Secure Chat Box

Plugin:
Simple Ajax Chat – Add a Fast, Secure Chat Box
Plugin Slug:
simple-ajax-chat
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
20260301
Severity Score:
High
CVE:
2026-2987
The vulnerability has been patched, so you should update to version 20260301.

Flexmls® IDX Plugin

Plugin:
Flexmls® IDX Plugin
Plugin Slug:
flexmls-idx
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.15.10
Severity Score:
High
CVE:
2026-25369
The vulnerability has been patched, so you should update to version 3.15.10.

MDTF – Meta Data and Taxonomies Filter

Plugin:
MDTF – Meta Data and Taxonomies Filter
Plugin Slug:
wp-meta-data-filter-and-taxonomy-filter
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.6
Severity Score:
Medium
CVE:
2026-32455
The vulnerability has been patched, so you should update to version 1.3.6.

Datalogics Ecommerce Delivery – Datalogics

Plugin:
Datalogics Ecommerce Delivery – Datalogics
Plugin Slug:
datalogics
Installations
400+
Vulnerability:
Privilege Escalation
Patched in Version:
2.6.60
Severity Score:
Critical
CVE:
2026-2631
The vulnerability has been patched, so you should update to version 2.6.60.

PitchPrint

Plugin:
PitchPrint
Plugin Slug:
pitchprint
Installations
400+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
11.2.0
Severity Score:
High
CVE:
2026-22448
The vulnerability has been patched, so you should update to version 11.2.0.

Court Reservation – Manage Your Court Bookings Online

Plugin:
Court Reservation – Manage Your Court Bookings Online
Plugin Slug:
court-reservation
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.10.9
Severity Score:
Medium
CVE:
2026-1508
The vulnerability has been patched, so you should update to version 1.10.9.

LearnPress – Sepay Payment

Plugin:
LearnPress – Sepay Payment
Plugin Slug:
learnpress-sepay-payment
Installations
100+
Vulnerability:
Broken Authentication
Patched in Version:
4.0.1
Severity Score:
High
CVE:
2026-25002
The vulnerability has been patched, so you should update to version 4.0.1.

Pix for WooCommerce

Plugin:
Pix for WooCommerce
Plugin Slug:
payment-gateway-pix-for-woocommerce
Installations
100+
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.6.0
Severity Score:
Critical
CVE:
2026-3891
The vulnerability has been patched, so you should update to version 1.6.0.

Primer MyData for Woocommerce

Plugin:
Primer MyData for Woocommerce
Plugin Slug:
primer-mydata
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.2.2
Severity Score:
High
CVE:
2024-11809
The vulnerability has been patched, so you should update to version 4.2.2.

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams

Plugin:
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
Plugin Slug:
ppv-live-webcams
Installations
30+
Vulnerability:
Privilege Escalation
Patched in Version:
7.3.21
Severity Score:
High
CVE:
2025-8899
The vulnerability has been patched, so you should update to version 7.3.21.

ZIP Code Based Content Protection

Plugin:
ZIP Code Based Content Protection
Plugin Slug:
zip-code-based-content-protection
Installations
10+
Vulnerability:
SQL Injection
Patched in Version:
1.0.3
Severity Score:
Critical
CVE:
2025-14353
The vulnerability has been patched, so you should update to version 1.0.3.

Divi Booster

Plugin:
Divi Booster
Plugin Slug:
divi-booster
Vulnerability:
PHP Object Injection
Patched in Version:
5.0.2
Severity Score:
Critical
CVE:
2026-2626
The vulnerability has been patched, so you should update to version 5.0.2.

Elated Listing

Plugin:
Elated Listing
Plugin Slug:
eltd-listing
Vulnerability:
Broken Access Control
Patched in Version:
1.5
Severity Score:
Medium
CVE:
2026-24972
The vulnerability has been patched, so you should update to version 1.5.

Fusion Builder

Plugin:
Fusion Builder
Plugin Slug:
fusion-builder
Vulnerability:
Broken Access Control
Patched in Version:
3.15.0
Severity Score:
Medium
CVE:
2026-32452
The vulnerability has been patched, so you should update to version 3.15.0.

Fusion Builder

Plugin:
Fusion Builder
Plugin Slug:
fusion-builder
Vulnerability:
Broken Access Control
Patched in Version:
3.15.0
Severity Score:
Medium
CVE:
2026-32451
The vulnerability has been patched, so you should update to version 3.15.0.

Avada Core

Plugin:
Avada Core
Plugin Slug:
fusion-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.15.0
Severity Score:
Medium
CVE:
2026-32454
The vulnerability has been patched, so you should update to version 5.15.0.

Avada Core

Plugin:
Avada Core
Plugin Slug:
fusion-core
Vulnerability:
Broken Access Control
Patched in Version:
5.15.0
Severity Score:
Medium
CVE:
2026-32453
The vulnerability has been patched, so you should update to version 5.15.0.

Gravity Forms

Plugin:
Gravity Forms
Plugin Slug:
gravityforms
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.9.29
Severity Score:
Medium
CVE:
2026-3492
The vulnerability has been patched, so you should update to version 2.9.29.

JetBooking

Plugin:
JetBooking
Plugin Slug:
jet-booking
Vulnerability:
SQL Injection
Patched in Version:
4.0.3.1
Severity Score:
Critical
CVE:
2026-3496
The vulnerability has been patched, so you should update to version 4.0.3.1.

Jobica Core

Plugin:
Jobica Core
Plugin Slug:
jobica-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.2
Severity Score:
High
CVE:
2026-24979
The vulnerability has been patched, so you should update to version 1.4.2.

Jobica Core

Plugin:
Jobica Core
Plugin Slug:
jobica-core
Vulnerability:
PHP Object Injection
Patched in Version:
1.4.2
Severity Score:
High
CVE:
2026-24978
The vulnerability has been patched, so you should update to version 1.4.2.

MetForm Pro

Plugin:
MetForm Pro
Plugin Slug:
metform-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.9.7
Severity Score:
High
CVE:
2026-1261
The vulnerability has been patched, so you should update to version 3.9.7.

Organici Library

Plugin:
Organici Library
Plugin Slug:
noo-organici-library
Vulnerability:
SQL Injection
Patched in Version:
2.1.3
Severity Score:
High
CVE:
2026-24977
The vulnerability has been patched, so you should update to version 2.1.3.

Organici Library

Plugin:
Organici Library
Plugin Slug:
noo-organici-library
Vulnerability:
PHP Object Injection
Patched in Version:
2.1.3
Severity Score:
High
CVE:
2026-24976
The vulnerability has been patched, so you should update to version 2.1.3.

Organici Library

Plugin:
Organici Library
Plugin Slug:
noo-organici-library
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.3
Severity Score:
High
CVE:
2026-24975
The vulnerability has been patched, so you should update to version 2.1.3.

Visionary Core

Plugin:
Visionary Core
Plugin Slug:
noo-visionary-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.0
Severity Score:
High
CVE:
2026-24980
The vulnerability has been patched, so you should update to version 1.5.0.

Visionary Core

Plugin:
Visionary Core
Plugin Slug:
noo-visionary-core
Vulnerability:
PHP Object Injection
Patched in Version:
1.5.0
Severity Score:
High
CVE:
2026-24981
The vulnerability has been patched, so you should update to version 1.5.0.

PixelYourSite PRO

Plugin:
PixelYourSite PRO
Plugin Slug:
pixelyoursite-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
12.4.0.3
Severity Score:
High
CVE:
2026-1844
The vulnerability has been patched, so you should update to version 12.4.0.3.

tagDiv Composer

Plugin:
tagDiv Composer
Plugin Slug:
td-composer
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.4.3
Severity Score:
High
CVE:
2025-50001
The vulnerability has been patched, so you should update to version 5.4.3.

tagDiv Opt-In Builder

Plugin:
tagDiv Opt-In Builder
Plugin Slug:
td-subscription
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.4
Severity Score:
High
CVE:
2025-53222
The vulnerability has been patched, so you should update to version 1.7.4.

Tutor LMS Pro

Plugin:
Tutor LMS Pro
Plugin Slug:
tutor-pro
Vulnerability:
Broken Authentication
Patched in Version:
3.9.6
Severity Score:
Critical
CVE:
2026-0953
The vulnerability has been patched, so you should update to version 3.9.6.

WordPress Themes — 7 Patched / 16 Unpatched

Amfissa

Theme:
Amfissa
Theme Slug:
amfissa
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27079
The vulnerability has not been patched. You should switch themes.

Beelove

Theme:
Beelove
Theme Slug:
beelove
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22507
The vulnerability has not been patched. You should switch themes.

Belfort

Theme:
Belfort
Theme Slug:
belfort
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27075
The vulnerability has not been patched. You should switch themes.

Buisson

Theme:
Buisson
Theme Slug:
buisson
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27084
The vulnerability has not been patched. You should switch themes.

Deston

Theme:
Deston
Theme Slug:
deston
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27080
The vulnerability has not been patched. You should switch themes.

Emaurri

Theme:
Emaurri
Theme Slug:
emaurri
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27078
The vulnerability has not been patched. You should switch themes.

Golo

Theme:
Golo
Theme Slug:
golo
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27051
The vulnerability has not been patched. You should switch themes.

Jannah

Theme:
Jannah
Theme Slug:
jannah
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-25464
The vulnerability has not been patched. You should switch themes.

Love Story

Theme:
Love Story
Theme Slug:
lovestory
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27082
The vulnerability has not been patched. You should switch themes.

LuxeDrive

Theme:
LuxeDrive
Theme Slug:
luxedrive
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27076
The vulnerability has not been patched. You should switch themes.

Melody

Theme:
Melody
Theme Slug:
melodyschool
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22510
The vulnerability has not been patched. You should switch themes.

MultiOffice

Theme:
MultiOffice
Theme Slug:
multioffice
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27077
The vulnerability has not been patched. You should switch themes.

Photography

Theme:
Photography
Theme Slug:
photography
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27043
The vulnerability has not been patched. You should switch themes.

Rosebud

Theme:
Rosebud
Theme Slug:
rosebud
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27081
The vulnerability has not been patched. You should switch themes.

Work & Travel Company

Theme:
Work & Travel Company
Theme Slug:
work-travel-company
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27083
The vulnerability has not been patched. You should switch themes.

Zorka

Theme:
Zorka
Theme Slug:
zorka
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69096
The vulnerability has not been patched. You should switch themes.

Astra

Theme:
Astra
Theme Slug:
astra
Downloads
21,720,242
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.12.4
Severity Score:
Medium
CVE:
2026-3534
The vulnerability has been patched, so you should update to version 4.12.4.

News Magazine X

Theme:
News Magazine X
Theme Slug:
news-magazine-x
Downloads
76,558
Vulnerability:
Broken Access Control
Patched in Version:
1.2.51
Severity Score:
High
CVE:
2026-24382
The vulnerability has been patched, so you should update to version 1.2.51.

Energox

Theme:
Energox
Theme Slug:
energox
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.3
Severity Score:
High
CVE:
2026-24970
The vulnerability has been patched, so you should update to version 1.3.

Instant VA

Theme:
Instant VA
Theme Slug:
instantva
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.0.2
Severity Score:
High
CVE:
2026-24969
The vulnerability has been patched, so you should update to version 1.0.2.

CitiLights

Theme:
CitiLights
Theme Slug:
noo-citilights
Vulnerability:
PHP Object Injection
Patched in Version:
3.7.2
Severity Score:
High
CVE:
2026-24974
The vulnerability has been patched, so you should update to version 3.7.2.

CitiLights

Theme:
CitiLights
Theme Slug:
noo-citilights
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.7.2
Severity Score:
High
CVE:
2026-24973
The vulnerability has been patched, so you should update to version 3.7.2.

Search & Go

Theme:
Search & Go
Theme Slug:
searchgo
Vulnerability:
Privilege Escalation
Patched in Version:
2.8.1
Severity Score:
Critical
CVE:
2026-24971
The vulnerability has been patched, so you should update to version 2.8.1.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — March 18, 2026 appeared first on SolidWP.

]]> WordPress Vulnerability Report — March 11, 2026 https://solidwp.com/blog/wordpress-vulnerability-report-march-11-2026/ Wed, 11 Mar 2026 13:33:00 +0000 https://solidwp.com/?p=2553075 Since last week, 209 new vulnerabilities have emerged in the WordPress ecosystem, including 98 plugins and 111 themes. Of those, 134 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

The post WordPress Vulnerability Report — March 11, 2026 appeared first on SolidWP.

]]> In this report, 209 vulnerabilities have been publicly disclosed. Security patches for 75 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 134 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.9.3 is now available and is a mandatory security and maintenance update. This release follows version 6.9.2, which addressed 10 security vulnerabilities but introduced a “blank screen” bug for certain themes. Version 6.9.3 includes all previous security patches while resolving the front-end display issues.

It is recommended that you update your sites to version 6.9.3 immediately to ensure they are protected. For sites supporting automatic background updates, the process will begin shortly. You can find more technical details and the full list of fixes in the official announcement.

The next major release of WordPress will be version 7.0, which is planned for April 9, 2026.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 69 Patched / 29 Unpatched

Bus Ticket Booking with Seat Reservation

Plugin:
Bus Ticket Booking with Seat Reservation
Plugin Slug:
bus-ticket-booking-with-seat-reservation
Installations
900+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27095
The vulnerability has not been patched. You should deactivate the plugin.

My auctions allegro

Plugin:
My auctions allegro
Plugin Slug:
my-auctions-allegro-free-edition
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22491
The vulnerability has not been patched. You should deactivate the plugin.

Carta Online

Plugin:
Carta Online
Plugin Slug:
carta-online
Installations
50+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1071
The vulnerability has not been patched. You should deactivate the plugin.

Secudeal Payments for Ecommerce

Plugin:
Secudeal Payments for Ecommerce
Plugin Slug:
secudeal-payments-for-ecommerce
Installations
10+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22471
The vulnerability has not been patched. You should deactivate the plugin.

Super Stage WP

Plugin:
Super Stage WP
Plugin Slug:
super-stage-wp
Installations
10+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-1542
The vulnerability has not been patched. You should deactivate the plugin.

Consensus Embed

Plugin:
Consensus Embed
Plugin Slug:
consensus-embed
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1823
The vulnerability has not been patched. You should deactivate the plugin.

DA Media GigList

Plugin:
DA Media GigList
Plugin Slug:
damedia-giglist
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1805
The vulnerability has not been patched. You should deactivate the plugin.

EventON

Plugin:
EventON
Plugin Slug:
eventon
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28037
The vulnerability has not been patched. You should deactivate the plugin.

Handmade Framework

Plugin:
Handmade Framework
Plugin Slug:
handmade-framework
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22520
The vulnerability has not been patched. You should deactivate the plugin.

Infomaniak Connect for OpenID

Plugin:
Infomaniak Connect for OpenID
Plugin Slug:
infomaniak-connect-openid
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1824
The vulnerability has not been patched. You should deactivate the plugin.

Lisfinity Core

Plugin:
Lisfinity Core
Plugin Slug:
lisfinity-core
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22484
The vulnerability has not been patched. You should deactivate the plugin.

LMS Elementor Pro

Plugin:
LMS Elementor Pro
Plugin Slug:
lms-elementor-pro
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27983
The vulnerability has not been patched. You should deactivate the plugin.

LotekMedia Popup Form

Plugin:
LotekMedia Popup Form
Plugin Slug:
ltm-popup-form
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2420
The vulnerability has not been patched. You should deactivate the plugin.

Media Library Alt Text Editor

Plugin:
Media Library Alt Text Editor
Plugin Slug:
media-library-alt-text-editor
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1820
The vulnerability has not been patched. You should deactivate the plugin.

My Album Gallery

Plugin:
My Album Gallery
Plugin Slug:
my-album-gallery
Vulnerability:
Arbitrary File Deletion
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-22485
The vulnerability has not been patched. You should deactivate the plugin.

MyQtip – easy qTip2

Plugin:
MyQtip – easy qTip2
Plugin Slug:
myqtip-easy-qtip2
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1574
The vulnerability has not been patched. You should deactivate the plugin.

Purchase Button For Affiliate Link

Plugin:
Purchase Button For Affiliate Link
Plugin Slug:
purchase-button
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1073
The vulnerability has not been patched. You should deactivate the plugin.

True Ranker

Plugin:
True Ranker
Plugin Slug:
seo-local-rank
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1085
The vulnerability has not been patched. You should deactivate the plugin.

Show YouTube video

Plugin:
Show YouTube video
Plugin Slug:
show-youtube-video
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1825
The vulnerability has not been patched. You should deactivate the plugin.

The Guardian News Feed

Plugin:
The Guardian News Feed
Plugin Slug:
the-guardian-news-feed
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1087
The vulnerability has not been patched. You should deactivate the plugin.

Ultimate Addons for WPBakery Page Builder

Plugin:
Ultimate Addons for WPBakery Page Builder
Plugin Slug:
ultimate_vc_addons
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28038
The vulnerability has not been patched. You should deactivate the plugin.

WP App Bar

Plugin:
WP App Bar
Plugin Slug:
wp-app-bar
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1074
The vulnerability has not been patched. You should deactivate the plugin.

WP eMember

Plugin:
WP eMember
Plugin Slug:
wp-eMember
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28073
The vulnerability has not been patched. You should deactivate the plugin.

Font Pairing Preview For Landing Pages

Plugin:
Font Pairing Preview For Landing Pages
Plugin Slug:
wp-font-pairing-preview
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1086
The vulnerability has not been patched. You should deactivate the plugin.

Wueen

Plugin:
Wueen
Plugin Slug:
wueen
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1569
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce

Plugin:
WooCommerce
Plugin Slug:
woocommerce
Installations
7,000,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
10.5.3
Severity Score:
Medium
CVE:
2026-3589
The vulnerability has been patched, so you should update to version 10.5.3.

Enable Media Replace

Plugin:
Enable Media Replace
Plugin Slug:
enable-media-replace
Installations
600,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.1.8
Severity Score:
Medium
CVE:
2026-2732
The vulnerability has been patched, so you should update to version 4.1.8.

Meta Box

Plugin:
Meta Box
Plugin Slug:
meta-box
Installations
500,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
5.11.2
Severity Score:
High
CVE:
2025-14675
The vulnerability has been patched, so you should update to version 5.11.2.

Page Builder by SiteOrigin

Plugin:
Page Builder by SiteOrigin
Plugin Slug:
siteorigin-panels
Installations
500,000+
Vulnerability:
Local File Inclusion
Patched in Version:
2.34.0
Severity Score:
High
CVE:
2026-2448
The vulnerability has been patched, so you should update to version 2.34.0.

WP Mail Logging

Plugin:
WP Mail Logging
Plugin Slug:
wp-mail-logging
Installations
300,000+
Vulnerability:
PHP Object Injection
Patched in Version:
1.16
Severity Score:
Critical
CVE:
2026-2471
The vulnerability has been patched, so you should update to version 1.16.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
SQL Injection
Patched in Version:
3.9.7
Severity Score:
Critical
CVE:
2025-13673
The vulnerability has been patched, so you should update to version 3.9.7.

Database for Contact Form 7, WPforms, Elementor forms

Plugin:
Database for Contact Form 7, WPforms, Elementor forms
Plugin Slug:
contact-form-entries
Installations
70,000+
Vulnerability:
PHP Object Injection
Patched in Version:
1.4.8
Severity Score:
Critical
CVE:
2026-2599
The vulnerability has been patched, so you should update to version 1.4.8.

Greenshift – animation and page builder blocks

Plugin:
Greenshift – animation and page builder blocks
Plugin Slug:
greenshift-animation-and-page-builder-blocks
Installations
70,000+
Vulnerability:
Broken Access Control
Patched in Version:
12.8.4
Severity Score:
Medium
CVE:
2026-2371
The vulnerability has been patched, so you should update to version 12.8.4.

Greenshift – animation and page builder blocks

Plugin:
Greenshift – animation and page builder blocks
Plugin Slug:
greenshift-animation-and-page-builder-blocks
Installations
70,000+
Vulnerability:
Broken Access Control
Patched in Version:
12.8.4
Severity Score:
Medium
CVE:
2026-2589
The vulnerability has been patched, so you should update to version 12.8.4.

Greenshift – animation and page builder blocks

Plugin:
Greenshift – animation and page builder blocks
Plugin Slug:
greenshift-animation-and-page-builder-blocks
Installations
70,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
12.8.6
Severity Score:
Medium
CVE:
2026-2593
The vulnerability has been patched, so you should update to version 12.8.6.

Media Library Assistant

Plugin:
Media Library Assistant
Plugin Slug:
media-library-assistant
Installations
70,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.34
Severity Score:
Medium
CVE:
2026-3072
The vulnerability has been patched, so you should update to version 3.34.

Drag and Drop Multiple File Upload for Contact Form 7

Plugin:
Drag and Drop Multiple File Upload for Contact Form 7
Plugin Slug:
drag-and-drop-multiple-file-upload-contact-form-7
Installations
60,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.3.9.6
Severity Score:
Critical
CVE:
2026-3459
The vulnerability has been patched, so you should update to version 1.3.9.6.

Fast Page & Post Duplicator

Plugin:
Fast Page & Post Duplicator
Plugin Slug:
page-or-post-clone
Installations
60,000+
Vulnerability:
SQL Injection
Patched in Version:
6.4
Severity Score:
High
CVE:
2026-2893
The vulnerability has been patched, so you should update to version 6.4.

Seraphinite Accelerator

Plugin:
Seraphinite Accelerator
Plugin Slug:
seraphinite-accelerator
Installations
60,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.28.15
Severity Score:
Medium
CVE:
2026-3058
The vulnerability has been patched, so you should update to version 2.28.15.

Seraphinite Accelerator

Plugin:
Seraphinite Accelerator
Plugin Slug:
seraphinite-accelerator
Installations
60,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.28.15
Severity Score:
Medium
CVE:
2026-3056
The vulnerability has been patched, so you should update to version 2.28.15.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Privilege Escalation
Patched in Version:
5.1.3
Severity Score:
Critical
CVE:
2026-1492
The vulnerability has been patched, so you should update to version 5.1.3.

OoohBoi Steroids for Elementor

Plugin:
OoohBoi Steroids for Elementor
Plugin Slug:
ooohboi-steroids-for-elementor
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.25
Severity Score:
Medium
CVE:
2026-3034
The vulnerability has been patched, so you should update to version 2.1.25.

WP-Members Membership Plugin

Plugin:
WP-Members Membership Plugin
Plugin Slug:
wp-members
Installations
50,000+
Vulnerability:
SQL Injection
Patched in Version:
3.5.6
Severity Score:
High
CVE:
2026-2363
The vulnerability has been patched, so you should update to version 3.5.6.

All-in-One Video Gallery

Plugin:
All-in-One Video Gallery
Plugin Slug:
all-in-one-video-gallery
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.7.5
Severity Score:
High
CVE:
2026-1706
The vulnerability has been patched, so you should update to version 4.7.5.

My Calendar – Accessible Event Manager

Plugin:
My Calendar – Accessible Event Manager
Plugin Slug:
my-calendar
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.7.4
Severity Score:
Medium
CVE:
2026-2355
The vulnerability has been patched, so you should update to version 3.7.4.

WP Booking System – Booking Calendar

Plugin:
WP Booking System – Booking Calendar
Plugin Slug:
wp-booking-system
Installations
20,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.0.19.13
Severity Score:
Medium
CVE:
2025-68515
The vulnerability has been patched, so you should update to version 2.0.19.13.

WPZOOM Addons for Elementor – Starter Templates & Widgets

Plugin:
WPZOOM Addons for Elementor – Starter Templates & Widgets
Plugin Slug:
wpzoom-elementor-addons
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.5
Severity Score:
High
CVE:
2026-2295
The vulnerability has been patched, so you should update to version 1.3.5.

Membership Plugin – Restrict Content

Plugin:
Membership Plugin – Restrict Content
Plugin Slug:
restrict-content
Installations
10,000+
Vulnerability:
Privilege Escalation
Patched in Version:
3.2.21
Severity Score:
High
CVE:
2026-1321
The vulnerability has been patched, so you should update to version 3.2.21.

JS Help Desk – AI-Powered Support & Ticketing System

Plugin:
JS Help Desk – AI-Powered Support & Ticketing System
Plugin Slug:
js-support-ticket
Installations
8,000+
Vulnerability:
SQL Injection
Patched in Version:
2.8.3
Severity Score:
Critical
CVE:
2023-7337
The vulnerability has been patched, so you should update to version 2.8.3.

ProfileGrid – User Profiles, Groups and Communities

Plugin:
ProfileGrid – User Profiles, Groups and Communities
Plugin Slug:
profilegrid-user-profiles-groups-and-communities
Installations
6,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.9.8.2
Severity Score:
Medium
CVE:
2026-2488
The vulnerability has been patched, so you should update to version 5.9.8.2.

ProfileGrid – User Profiles, Groups and Communities

Plugin:
ProfileGrid – User Profiles, Groups and Communities
Plugin Slug:
profilegrid-user-profiles-groups-and-communities
Installations
6,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
5.9.8.3
Severity Score:
Medium
CVE:
2026-2494
The vulnerability has been patched, so you should update to version 5.9.8.3.

Podlove Web Player

Plugin:
Podlove Web Player
Plugin Slug:
podlove-web-player
Installations
4,000+
Vulnerability:
PHP Object Injection
Patched in Version:
5.9.2
Severity Score:
High
CVE:
2026-24385
The vulnerability has been patched, so you should update to version 5.9.2.

JS Archive List

Plugin:
JS Archive List
Plugin Slug:
jquery-archive-list-widget
Installations
3,000+
Vulnerability:
PHP Object Injection
Patched in Version:
6.2.0
Severity Score:
High
CVE:
2026-2020
The vulnerability has been patched, so you should update to version 6.2.0.

Stock Ticker

Plugin:
Stock Ticker
Plugin Slug:
stock-ticker
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.26.2
Severity Score:
Medium
CVE:
2026-2722
The vulnerability has been patched, so you should update to version 3.26.2.

Easy PHP Settings

Plugin:
Easy PHP Settings
Plugin Slug:
easy-php-settings
Installations
1,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
1.0.5
Severity Score:
High
CVE:
2026-3352
The vulnerability has been patched, so you should update to version 1.0.5.

Morkva UA Shipping

Plugin:
Morkva UA Shipping
Plugin Slug:
morkva-ua-shipping
Installations
800+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.10
Severity Score:
Medium
CVE:
2026-2292
The vulnerability has been patched, so you should update to version 1.7.10.

All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login

Plugin:
All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login
Plugin Slug:
login-with-azure
Installations
600+
Vulnerability:
Bypass Vulnerability
Patched in Version:
2.2.6
Severity Score:
Critical
CVE:
2026-2628
The vulnerability has been patched, so you should update to version 2.2.6.

AI ChatBot with ChatGPT and Content Generator by AYS

Plugin:
AI ChatBot with ChatGPT and Content Generator by AYS
Plugin Slug:
ays-chatgpt-assistant
Installations
500+
Vulnerability:
Broken Access Control
Patched in Version:
2.7.6
Severity Score:
Medium
CVE:
2026-1336
The vulnerability has been patched, so you should update to version 2.7.6.

Apocalypse Meow

Plugin:
Apocalypse Meow
Plugin Slug:
apocalypse-meow
Installations
400+
Vulnerability:
SQL Injection
Patched in Version:
23.0.0
Severity Score:
High
CVE:
2026-3523
The vulnerability has been patched, so you should update to version 23.0.0.

ionCube Tester Plus

Plugin:
ionCube Tester Plus
Plugin Slug:
ioncube-tester-plus
Installations
300+
Vulnerability:
Arbitrary File Download
Patched in Version:
1.4
Severity Score:
High
CVE:
2025-69411
The vulnerability has been patched, so you should update to version 1.4.

MailArchiver

Plugin:
MailArchiver
Plugin Slug:
mailarchiver
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.5.0
Severity Score:
Medium
CVE:
2026-2721
The vulnerability has been patched, so you should update to version 4.5.0.

WP Frontend Profile

Plugin:
WP Frontend Profile
Plugin Slug:
wp-front-end-profile
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.3.9
Severity Score:
Medium
CVE:
2026-1644
The vulnerability has been patched, so you should update to version 1.3.9.

Hammas Calendar

Plugin:
Hammas Calendar
Plugin Slug:
hammas-calendar
Installations
60+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.12
Severity Score:
Medium
CVE:
2026-1902
The vulnerability has been patched, so you should update to version 1.5.12.

MDJM Event Management

Plugin:
MDJM Event Management
Plugin Slug:
mobile-dj-manager
Installations
50+
Vulnerability:
Broken Access Control
Patched in Version:
1.7.8.2
Severity Score:
Medium
CVE:
2026-1650
The vulnerability has been patched, so you should update to version 1.7.8.2.

Community Events

Plugin:
Community Events
Plugin Slug:
community-events
Installations
30+
Vulnerability:
SQL Injection
Patched in Version:
1.5.9
Severity Score:
High
CVE:
2026-2429
The vulnerability has been patched, so you should update to version 1.5.9.

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams

Plugin:
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
Plugin Slug:
ppv-live-webcams
Installations
30+
Vulnerability:
Privilege Escalation
Patched in Version:
7.3.21
Severity Score:
High
CVE:
2025-8899
The vulnerability has been patched, so you should update to version 7.3.21.

WPBookit

Plugin:
WPBookit
Plugin Slug:
wpbookit
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.9
Severity Score:
High
CVE:
2026-1945
The vulnerability has been patched, so you should update to version 1.0.9.

WPBookit

Plugin:
WPBookit
Plugin Slug:
wpbookit
Installations
10+
Vulnerability:
Broken Access Control
Patched in Version:
1.0.9
Severity Score:
Medium
CVE:
2026-1980
The vulnerability has been patched, so you should update to version 1.0.9.

ZIP Code Based Content Protection

Plugin:
ZIP Code Based Content Protection
Plugin Slug:
zip-code-based-content-protection
Installations
10+
Vulnerability:
SQL Injection
Patched in Version:
1.0.3
Severity Score:
Critical
CVE:
2025-14353
The vulnerability has been patched, so you should update to version 1.0.3.

Fluent Forms Pro Add On Pack

Plugin:
Fluent Forms Pro Add On Pack
Plugin Slug:
fluentformpro
Vulnerability:
Arbitrary Content Deletion
Patched in Version:
6.1.18
Severity Score:
High
CVE:
2026-2899
The vulnerability has been patched, so you should update to version 6.1.18.

Fluent Forms Pro Add On Pack

Plugin:
Fluent Forms Pro Add On Pack
Plugin Slug:
fluentformpro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.1.18
Severity Score:
High
CVE:
2026-2365
The vulnerability has been patched, so you should update to version 6.1.18.

Master Addons for Elementor Premium

Plugin:
Master Addons for Elementor Premium
Plugin Slug:
master-addons-pro
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
2.1.4
Severity Score:
High
CVE:
2026-3132
The vulnerability has been patched, so you should update to version 2.1.4.

pixfort Core

Plugin:
pixfort Core
Plugin Slug:
pixfort-core
Vulnerability:
Broken Access Control
Patched in Version:
3.2.26
Severity Score:
Medium
CVE:
2026-28071
The vulnerability has been patched, so you should update to version 3.2.26.

pixfort Core

Plugin:
pixfort Core
Plugin Slug:
pixfort-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.26
Severity Score:
High
CVE:
2026-28072
The vulnerability has been patched, so you should update to version 3.2.26.

WPSubscription

Plugin:
WPSubscription
Plugin Slug:
subscription
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
1.8.11
Severity Score:
High
CVE:
2025-69347
The vulnerability has been patched, so you should update to version 1.8.11.

WordPress Themes — 6 Patched / 105 Unpatched

Estate

Theme:
Estate
Theme Slug:
estate
Downloads
58,132
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22475
The vulnerability has not been patched. You should switch themes.

OsTende

Theme:
OsTende
Theme Slug:
ostende
Downloads
8,317
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27986
The vulnerability has not been patched. You should switch themes.

Agrofood

Theme:
Agrofood
Theme Slug:
agrofood
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27332
The vulnerability has not been patched. You should switch themes.

Aldo

Theme:
Aldo
Theme Slug:
aldo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27993
The vulnerability has not been patched. You should switch themes.

Amoli

Theme:
Amoli
Theme Slug:
amoli
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22506
The vulnerability has not been patched. You should switch themes.

Askka

Theme:
Askka
Theme Slug:
askka
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22456
The vulnerability has not been patched. You should switch themes.

Au Pair Agency – Babysitting & Nanny Theme

Theme:
Au Pair Agency – Babysitting & Nanny Theme
Theme Slug:
au-pair-agency
Vulnerability:
Deserialization of untrusted data
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27098
The vulnerability has not been patched. You should switch themes.

Avventure

Theme:
Avventure
Theme Slug:
avventure
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27991
The vulnerability has not been patched. You should switch themes.

Beelove

Theme:
Beelove
Theme Slug:
beelove
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22507
The vulnerability has not been patched. You should switch themes.

Berger

Theme:
Berger
Theme Slug:
berger
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-53335
The vulnerability has not been patched. You should switch themes.

Bonbon

Theme:
Bonbon
Theme Slug:
bonbon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28030
The vulnerability has not been patched. You should switch themes.

BuddyApp

Theme:
BuddyApp
Theme Slug:
buddyapp
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22465
The vulnerability has not been patched. You should switch themes.

Car Zone

Theme:
Car Zone
Theme Slug:
carzone
Vulnerability:
Deserialization of untrusted data
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27338
The vulnerability has not been patched. You should switch themes.

CasaMia | Property Rental Real Estate WordPress Theme

Theme:
CasaMia | Property Rental Real Estate WordPress Theme
Theme Slug:
casamia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27097
The vulnerability has not been patched. You should switch themes.

Chroma

Theme:
Chroma
Theme Slug:
chroma
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28020
The vulnerability has not been patched. You should switch themes.

Classter

Theme:
Classter
Theme Slug:
classter
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-54001
The vulnerability has not been patched. You should switch themes.

Coinpress

Theme:
Coinpress
Theme Slug:
coinpress
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28007
The vulnerability has not been patched. You should switch themes.

ColorFolio – Freelance Designer WordPress Theme

Theme:
ColorFolio – Freelance Designer WordPress Theme
Theme Slug:
colorfolio
Vulnerability:
Deserialization of untrusted data
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27096
The vulnerability has not been patched. You should switch themes.

ConFix

Theme:
ConFix
Theme Slug:
confix
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27990
The vulnerability has not been patched. You should switch themes.

Cookiteer

Theme:
Cookiteer
Theme Slug:
cookiteer
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68886
The vulnerability has not been patched. You should switch themes.

Craftis

Theme:
Craftis
Theme Slug:
craftis
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28021
The vulnerability has not been patched. You should switch themes.

DeepDigital

Theme:
DeepDigital
Theme Slug:
deepdigital
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22467
The vulnerability has not been patched. You should switch themes.

Dental Clinic

Theme:
Dental Clinic
Theme Slug:
dental
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22473
The vulnerability has not been patched. You should switch themes.

Dentalux

Theme:
Dentalux
Theme Slug:
dentalux
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22508
The vulnerability has not been patched. You should switch themes.

Don Peppe

Theme:
Don Peppe
Theme Slug:
donpeppe
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22449
The vulnerability has not been patched. You should switch themes.

DroneX

Theme:
DroneX
Theme Slug:
dronex
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28009
The vulnerability has not been patched. You should switch themes.

Edifice

Theme:
Edifice
Theme Slug:
edifice
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28033
The vulnerability has not been patched. You should switch themes.

EmojiNation

Theme:
EmojiNation
Theme Slug:
emojination
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28029
The vulnerability has not been patched. You should switch themes.

Equadio

Theme:
Equadio
Theme Slug:
equadio
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27988
The vulnerability has not been patched. You should switch themes.

Equestrian Centre

Theme:
Equestrian Centre
Theme Slug:
equestrian-centre
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22474
The vulnerability has not been patched. You should switch themes.

Etchy

Theme:
Etchy
Theme Slug:
etchy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22476
The vulnerability has not been patched. You should switch themes.

Felizia

Theme:
Felizia
Theme Slug:
felizia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22477
The vulnerability has not been patched. You should switch themes.

FindAll

Theme:
FindAll
Theme Slug:
findall
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22478
The vulnerability has not been patched. You should switch themes.

FlashMart

Theme:
FlashMart
Theme Slug:
flashmart
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28048
The vulnerability has not been patched. You should switch themes.

Foodie

Theme:
Foodie
Theme Slug:
foodie
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28022
The vulnerability has not been patched. You should switch themes.

Gaspard

Theme:
Gaspard
Theme Slug:
gaspard
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22493
The vulnerability has not been patched. You should switch themes.

Gioia

Theme:
Gioia
Theme Slug:
gioia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22509
The vulnerability has not been patched. You should switch themes.

Global Logistics

Theme:
Global Logistics
Theme Slug:
globallogistics
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28018
The vulnerability has not been patched. You should switch themes.

Good Homes

Theme:
Good Homes
Theme Slug:
good-homes
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22494
The vulnerability has not been patched. You should switch themes.

Grand Wedding

Theme:
Grand Wedding
Theme Slug:
grandwedding
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22417
The vulnerability has not been patched. You should switch themes.

Green Thumb

Theme:
Green Thumb
Theme Slug:
greenthumb
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28017
The vulnerability has not been patched. You should switch themes.

Greenville

Theme:
Greenville
Theme Slug:
greenville
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22495
The vulnerability has not been patched. You should switch themes.

Gridiron

Theme:
Gridiron
Theme Slug:
gridiron
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28012
The vulnerability has not been patched. You should switch themes.

Grit

Theme:
Grit
Theme Slug:
grit
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28041
The vulnerability has not been patched. You should switch themes.

Handyman

Theme:
Handyman
Theme Slug:
handyman-services
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22451
The vulnerability has not been patched. You should switch themes.

Healer – Doctor, Clinic & Medical WordPress Theme

Theme:
Healer – Doctor, Clinic & Medical WordPress Theme
Theme Slug:
healer
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-28043
The vulnerability has not been patched. You should switch themes.

Helion

Theme:
Helion
Theme Slug:
helion
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28024
The vulnerability has not been patched. You should switch themes.

Hoverex

Theme:
Hoverex
Theme Slug:
hoverex
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22452
The vulnerability has not been patched. You should switch themes.

Humanum

Theme:
Humanum
Theme Slug:
humanum
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27985
The vulnerability has not been patched. You should switch themes.

Hypnotherapy

Theme:
Hypnotherapy
Theme Slug:
hypnotherapy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22496
The vulnerability has not been patched. You should switch themes.

Invetex

Theme:
Invetex
Theme Slug:
invetex
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28031
The vulnerability has not been patched. You should switch themes.

Jardi

Theme:
Jardi
Theme Slug:
jardi
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22497
The vulnerability has not been patched. You should switch themes.

Justitia

Theme:
Justitia
Theme Slug:
justitia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27995
The vulnerability has not been patched. You should switch themes.

Kayon

Theme:
Kayon
Theme Slug:
kayon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28027
The vulnerability has not been patched. You should switch themes.

Kratz

Theme:
Kratz
Theme Slug:
kratz
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28013
The vulnerability has not been patched. You should switch themes.

Laurent

Theme:
Laurent
Theme Slug:
laurent
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22498
The vulnerability has not been patched. You should switch themes.

Law Office

Theme:
Law Office
Theme Slug:
law-office
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28046
The vulnerability has not been patched. You should switch themes.

Lella

Theme:
Lella
Theme Slug:
lella
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22499
The vulnerability has not been patched. You should switch themes.

Lingvico

Theme:
Lingvico
Theme Slug:
lingvico
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27996
The vulnerability has not been patched. You should switch themes.

Listify

Theme:
Listify
Theme Slug:
listify
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28042
The vulnerability has not been patched. You should switch themes.

Luxury Wine

Theme:
Luxury Wine
Theme Slug:
luxury-wine
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28016
The vulnerability has not been patched. You should switch themes.

m2 | Construction and Tools Store

Theme:
m2 | Construction and Tools Store
Theme Slug:
m2-ce
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22500
The vulnerability has not been patched. You should switch themes.

Manoir

Theme:
Manoir
Theme Slug:
manoir
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28019
The vulnerability has not been patched. You should switch themes.

Maxify

Theme:
Maxify
Theme Slug:
maxify
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27997
The vulnerability has not been patched. You should switch themes.

Meals & Wheels

Theme:
Meals & Wheels
Theme Slug:
meals-wheels
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27992
The vulnerability has not been patched. You should switch themes.

Melody

Theme:
Melody
Theme Slug:
melodyschool
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22510
The vulnerability has not been patched. You should switch themes.

MoneyFlow

Theme:
MoneyFlow
Theme Slug:
moneyflow
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28028
The vulnerability has not been patched. You should switch themes.

Morning Records

Theme:
Morning Records
Theme Slug:
morning-records
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22505
The vulnerability has not been patched. You should switch themes.

Motorix

Theme:
Motorix
Theme Slug:
motorix
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28026
The vulnerability has not been patched. You should switch themes.

Mounthood

Theme:
Mounthood
Theme Slug:
mounthood
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22501
The vulnerability has not been patched. You should switch themes.

Mr. Cobbler

Theme:
Mr. Cobbler
Theme Slug:
mr-cobbler
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22502
The vulnerability has not been patched. You should switch themes.

N7 | Golf Club Sports & Events

Theme:
N7 | Golf Club Sports & Events
Theme Slug:
n7-golf-club
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28045
The vulnerability has not been patched. You should switch themes.

Nelson

Theme:
Nelson
Theme Slug:
nelson
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22503
The vulnerability has not been patched. You should switch themes.

NeoBeat

Theme:
NeoBeat
Theme Slug:
neobeat
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22511
The vulnerability has not been patched. You should switch themes.

Nuts

Theme:
Nuts
Theme Slug:
nuts
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28023
The vulnerability has not been patched. You should switch themes.

Pets Club

Theme:
Pets Club
Theme Slug:
petclub
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22453
The vulnerability has not been patched. You should switch themes.

Printy

Theme:
Printy
Theme Slug:
printy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28035
The vulnerability has not been patched. You should switch themes.

Progress

Theme:
Progress
Theme Slug:
progress
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28034
The vulnerability has not been patched. You should switch themes.

ProLingua

Theme:
ProLingua
Theme Slug:
prolingua
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22504
The vulnerability has not been patched. You should switch themes.

Prowess

Theme:
Prowess
Theme Slug:
prowess
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22446
The vulnerability has not been patched. You should switch themes.

Quanzo

Theme:
Quanzo
Theme Slug:
quanzo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27989
The vulnerability has not been patched. You should switch themes.

Ratatouille

Theme:
Ratatouille
Theme Slug:
ratatouille
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28036
The vulnerability has not been patched. You should switch themes.

Roisin

Theme:
Roisin
Theme Slug:
roisin
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22512
The vulnerability has not been patched. You should switch themes.

Scientia

Theme:
Scientia
Theme Slug:
scientia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28010
The vulnerability has not been patched. You should switch themes.

ShiftCV

Theme:
ShiftCV
Theme Slug:
shift-cv
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28015
The vulnerability has not been patched. You should switch themes.

Solaris

Theme:
Solaris
Theme Slug:
solaris
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22454
The vulnerability has not been patched. You should switch themes.

Stargaze

Theme:
Stargaze
Theme Slug:
stargaze
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28025
The vulnerability has not been patched. You should switch themes.

Tediss

Theme:
Tediss
Theme Slug:
tediss
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27994
The vulnerability has not been patched. You should switch themes.

The Qlean

Theme:
The Qlean
Theme Slug:
the-qlean
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27987
The vulnerability has not been patched. You should switch themes.

Thebe

Theme:
Thebe
Theme Slug:
thebe
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22455
The vulnerability has not been patched. You should switch themes.

TheBi

Theme:
TheBi
Theme Slug:
thebi
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22438
The vulnerability has not been patched. You should switch themes.

Thecs

Theme:
Thecs
Theme Slug:
thecs
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22440
The vulnerability has not been patched. You should switch themes.

Translogic

Theme:
Translogic
Theme Slug:
translogic
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28014
The vulnerability has not been patched. You should switch themes.

Triompher

Theme:
Triompher
Theme Slug:
triompher
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22513
The vulnerability has not been patched. You should switch themes.

Tripgo

Theme:
Tripgo
Theme Slug:
tripgo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27093
The vulnerability has not been patched. You should switch themes.

Tuning

Theme:
Tuning
Theme Slug:
tuning
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28032
The vulnerability has not been patched. You should switch themes.

Unica

Theme:
Unica
Theme Slug:
unica
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22514
The vulnerability has not been patched. You should switch themes.

VegaDays

Theme:
VegaDays
Theme Slug:
vegadays
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22515
The vulnerability has not been patched. You should switch themes.

Victo

Theme:
Victo
Theme Slug:
victo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28047
The vulnerability has not been patched. You should switch themes.

Vixus

Theme:
Vixus
Theme Slug:
vixus
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27998
The vulnerability has not been patched. You should switch themes.

Wanderland

Theme:
Wanderland
Theme Slug:
wanderland
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22457
The vulnerability has not been patched. You should switch themes.

AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme

Theme:
AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme
Theme Slug:
window-ac-services
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27326
The vulnerability has not been patched. You should switch themes.

Wizor’s

Theme:
Wizor’s
Theme Slug:
wizors-investments
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22516
The vulnerability has not been patched. You should switch themes.

Yottis

Theme:
Yottis
Theme Slug:
yottis
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28011
The vulnerability has not been patched. You should switch themes.

Yungen

Theme:
Yungen
Theme Slug:
yungen
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28006
The vulnerability has not been patched. You should switch themes.

Blocksy

Theme:
Blocksy
Theme Slug:
blocksy
Downloads
6,399,494
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.31
Severity Score:
Medium
CVE:
2026-2583
The vulnerability has been patched, so you should update to version 2.1.31.

Charety

Theme:
Charety
Theme Slug:
charety
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.0.2
Severity Score:
Critical
CVE:
2026-24960
The vulnerability has been patched, so you should update to version 2.0.2.

Keenarch

Theme:
Keenarch
Theme Slug:
keenarch
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.0.1
Severity Score:
Critical
CVE:
2025-68554
The vulnerability has been patched, so you should update to version 2.0.1.

Lendiz

Theme:
Lendiz
Theme Slug:
lendiz
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.0.1
Severity Score:
Critical
CVE:
2025-68553
The vulnerability has been patched, so you should update to version 2.0.1.

Nutrie

Theme:
Nutrie
Theme Slug:
nutrie
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.0.1
Severity Score:
Critical
CVE:
2025-68555
The vulnerability has been patched, so you should update to version 2.0.1.

Remons

Theme:
Remons
Theme Slug:
remons
Vulnerability:
Local File Inclusion
Patched in Version:
1.3.5
Severity Score:
High
CVE:
2025-69090
The vulnerability has been patched, so you should update to version 1.3.5.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — March 11, 2026 appeared first on SolidWP.

]]> WordPress Vulnerability Report — March 4, 2026 https://solidwp.com/blog/wordpress-vulnerability-report-march-4-2026/ Wed, 04 Mar 2026 14:20:21 +0000 https://solidwp.com/?p=2553051 Since last week, 281 new vulnerabilities have emerged in the WordPress ecosystem, including 108 plugins and 173 themes. Of those, 225 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

The post WordPress Vulnerability Report — March 4, 2026 appeared first on SolidWP.

]]> In this report, 281 vulnerabilities have been publicly disclosed. Security patches for 56 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 225 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 7.0 Beta 2 is now available for testing. As this is a pre-release version, it is intended for testing and development only and should not be installed on production or mission-critical sites. Organizations should use local or staging environments to evaluate compatibility and new features before the final rollout.

The full release of WordPress 7.0 is currently scheduled for April 9, 2026. You can find the complete release schedule and technical testing details in the official announcement.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 50 Patched / 58 Unpatched

W3 Total Cache

Plugin:
W3 Total Cache
Plugin Slug:
w3-total-cache
Installations
900,000+
Vulnerability:
Arbitrary Code Execution
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27384
The vulnerability has not been patched. You should deactivate the plugin.

SiteGuard WP Plugin

Plugin:
SiteGuard WP Plugin
Plugin Slug:
siteguard
Installations
600,000+
Vulnerability:
Bypass Vulnerability
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27411
The vulnerability has not been patched. You should deactivate the plugin.

NextScripts: Social Networks Auto-Poster

Plugin:
NextScripts: Social Networks Auto-Poster
Plugin Slug:
social-networks-auto-poster-facebook-twitter-g
Installations
30,000+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27379
The vulnerability has not been patched. You should deactivate the plugin.

Builderall for WordPress

Plugin:
Builderall for WordPress
Plugin Slug:
builderall-cheetah-for-wp
Installations
1,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22390
The vulnerability has not been patched. You should deactivate the plugin.

Directory Listings WordPress plugin – uListing

Plugin:
Directory Listings WordPress plugin – uListing
Plugin Slug:
ulisting
Installations
1,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28078
The vulnerability has not been patched. You should deactivate the plugin.

Filr – Secure document library

Plugin:
Filr – Secure document library
Plugin Slug:
filr-protection
Installations
800+
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28133
The vulnerability has not been patched. You should deactivate the plugin.

Scientific and Interactive Blocks – inseri core

Plugin:
Scientific and Interactive Blocks – inseri core
Plugin Slug:
inseri-core
Installations
80+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27344
The vulnerability has not been patched. You should deactivate the plugin.

Site Suggest

Plugin:
Site Suggest
Plugin Slug:
site-suggest
Installations
30+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28104
The vulnerability has not been patched. You should deactivate the plugin.

Super Stage WP

Plugin:
Super Stage WP
Plugin Slug:
super-stage-wp
Installations
10+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-1542
The vulnerability has not been patched. You should deactivate the plugin.

WP Attractive Donations System – Easy Stripe & Paypal donations

Plugin:
WP Attractive Donations System – Easy Stripe & Paypal donations
Plugin Slug:
WP_AttractiveDonationsSystem
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-28115
The vulnerability has not been patched. You should deactivate the plugin.

AllInOne – Banner Rotator

Plugin:
AllInOne – Banner Rotator
Plugin Slug:
all-in-one-bannerRotator
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28112
The vulnerability has not been patched. You should deactivate the plugin.

LambertGroup – AllInOne – Banner with Playlist

Plugin:
LambertGroup – AllInOne – Banner with Playlist
Plugin Slug:
all-in-one-bannerWithPlaylist
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28110
The vulnerability has not been patched. You should deactivate the plugin.

LambertGroup – AllInOne – Content Slider

Plugin:
LambertGroup – AllInOne – Content Slider
Plugin Slug:
all-in-one-contentSlider
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28109
The vulnerability has not been patched. You should deactivate the plugin.

LambertGroup – AllInOne – Banner with Thumbnails

Plugin:
LambertGroup – AllInOne – Banner with Thumbnails
Plugin Slug:
all-in-one-thumbnailsBanner
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28108
The vulnerability has not been patched. You should deactivate the plugin.

Awa Plugins

Plugin:
Awa Plugins
Plugin Slug:
awa-plugins
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27359
The vulnerability has not been patched. You should deactivate the plugin.

Cost Calculator Pro

Plugin:
Cost Calculator Pro
Plugin Slug:
cost-calculator
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2506
The vulnerability has not been patched. You should deactivate the plugin.
Plugin:
Custom Logo
Plugin Slug:
custom-logo
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2499
The vulnerability has not been patched. You should deactivate the plugin.

DesignThemes Booking Manager

Plugin:
DesignThemes Booking Manager
Plugin Slug:
designthemes-booking-manager
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27388
The vulnerability has not been patched. You should deactivate the plugin.

DesignThemes Directory Addon

Plugin:
DesignThemes Directory Addon
Plugin Slug:
designthemes-directory-addon
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27386
The vulnerability has not been patched. You should deactivate the plugin.

DesignThemes Portfolio

Plugin:
DesignThemes Portfolio
Plugin Slug:
designthemes-portfolio
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27385
The vulnerability has not been patched. You should deactivate the plugin.

Directory Pro

Plugin:
Directory Pro
Plugin Slug:
directory-pro
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27396
The vulnerability has not been patched. You should deactivate the plugin.

Eagle Booking

Plugin:
Eagle Booking
Plugin Slug:
eagle-booking
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27428
The vulnerability has not been patched. You should deactivate the plugin.

Easy Author Image

Plugin:
Easy Author Image
Plugin Slug:
easy-author-image
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1373
The vulnerability has not been patched. You should deactivate the plugin.

Electric Enquiries

Plugin:
Electric Enquiries
Plugin Slug:
electric-enquiries
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14142
The vulnerability has not been patched. You should deactivate the plugin.

EventON

Plugin:
EventON
Plugin Slug:
eventon
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28037
The vulnerability has not been patched. You should deactivate the plugin.

Ultimate Learning Pro

Plugin:
Ultimate Learning Pro
Plugin Slug:
indeed-learning-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28113
The vulnerability has not been patched. You should deactivate the plugin.

iXML

Plugin:
iXML
Plugin Slug:
ixml
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-14076
The vulnerability has not been patched. You should deactivate the plugin.

Lawyer Directory

Plugin:
Lawyer Directory
Plugin Slug:
lawyer-directory
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28127
The vulnerability has not been patched. You should deactivate the plugin.

LBG Zoominoutslider

Plugin:
LBG Zoominoutslider
Plugin Slug:
lbg_zoominoutslider
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28103
The vulnerability has not been patched. You should deactivate the plugin.

ListingPro

Plugin:
ListingPro
Plugin Slug:
listingpro-plugin
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28122
The vulnerability has not been patched. You should deactivate the plugin.

LMS Elementor Pro

Plugin:
LMS Elementor Pro
Plugin Slug:
lms-elementor-pro
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27983
The vulnerability has not been patched. You should deactivate the plugin.

OVRI Payment

Plugin:
OVRI Payment
Plugin Slug:
moneytigo
Vulnerability:
Backdoor
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-10938
The vulnerability has not been patched. You should deactivate the plugin.

Profile Builder Pro

Plugin:
Profile Builder Pro
Plugin Slug:
profile-builder-pro
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27413
The vulnerability has not been patched. You should deactivate the plugin.

Responsive Posts Carousel Pro

Plugin:
Responsive Posts Carousel Pro
Plugin Slug:
responsive-posts-carousel-pro
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27361
The vulnerability has not been patched. You should deactivate the plugin.

RH Frontend Publishing Pro

Plugin:
RH Frontend Publishing Pro
Plugin Slug:
rh-frontend
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28126
The vulnerability has not been patched. You should deactivate the plugin.

Rise Blocks

Plugin:
Rise Blocks
Plugin Slug:
rise-blocks
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1614
The vulnerability has not been patched. You should deactivate the plugin.

TP2WP Importer

Plugin:
TP2WP Importer
Plugin Slug:
tp2wp-importer
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2489
The vulnerability has not been patched. You should deactivate the plugin.

UberSlider Classic

Plugin:
UberSlider Classic
Plugin Slug:
uberSlider_classic
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28102
The vulnerability has not been patched. You should deactivate the plugin.

UberSlider MouseInteraction

Plugin:
UberSlider MouseInteraction
Plugin Slug:
uberSlider_mouseinteraction
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28101
The vulnerability has not been patched. You should deactivate the plugin.

UberSlider PerpetuumMobile

Plugin:
UberSlider PerpetuumMobile
Plugin Slug:
uberSlider_perpetuummobile
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28100
The vulnerability has not been patched. You should deactivate the plugin.

UberSlider Ultra

Plugin:
UberSlider Ultra
Plugin Slug:
uberSlider_ultra
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28099
The vulnerability has not been patched. You should deactivate the plugin.

Ultimate Addons for WPBakery Page Builder

Plugin:
Ultimate Addons for WPBakery Page Builder
Plugin Slug:
ultimate_vc_addons
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28038
The vulnerability has not been patched. You should deactivate the plugin.

WP Bakery Autoresponder Addon

Plugin:
WP Bakery Autoresponder Addon
Plugin Slug:
vc-autoresponder-addon
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27362
The vulnerability has not been patched. You should deactivate the plugin.

WP Bakery Autoresponder Addon

Plugin:
WP Bakery Autoresponder Addon
Plugin Slug:
vc-autoresponder-addon
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27363
The vulnerability has not been patched. You should deactivate the plugin.

WeDesignTech Ultimate Booking Addon

Plugin:
WeDesignTech Ultimate Booking Addon
Plugin Slug:
wedesigntech-ultimate-booking-addon
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27389
The vulnerability has not been patched. You should deactivate the plugin.

WeDesignTech Ultimate Booking Addon

Plugin:
WeDesignTech Ultimate Booking Addon
Plugin Slug:
wedesigntech-ultimate-booking-addon
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27390
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Coming Soon Product with Countdown

Plugin:
WooCommerce Coming Soon Product with Countdown
Plugin Slug:
woo-coming-soon-product
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27354
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Order Details

Plugin:
WooCommerce Order Details
Plugin Slug:
woocommerce-order-details
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27374
The vulnerability has not been patched. You should deactivate the plugin.

Worry Proof Backup

Plugin:
Worry Proof Backup
Plugin Slug:
worry-proof-backup
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1311
The vulnerability has not been patched. You should deactivate the plugin.

WP Ad Guru

Plugin:
WP Ad Guru
Plugin Slug:
wp-ad-guru
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-12411
The vulnerability has not been patched. You should deactivate the plugin.

Conditional CAPTCHA

Plugin:
Conditional CAPTCHA
Plugin Slug:
wp-conditional-captcha
Vulnerability:
Open Redirection
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1369
The vulnerability has not been patched. You should deactivate the plugin.

WP eMember

Plugin:
WP eMember
Plugin Slug:
wp-eMember
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28073
The vulnerability has not been patched. You should deactivate the plugin.

WP Responsive Images

Plugin:
WP Responsive Images
Plugin Slug:
wp-responsive-images
Vulnerability:
Arbitrary File Download
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1557
The vulnerability has not been patched. You should deactivate the plugin.

WP Social Meta

Plugin:
WP Social Meta
Plugin Slug:
wp-social-meta
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2498
The vulnerability has not been patched. You should deactivate the plugin.

xmlrpc attacks blocker

Plugin:
xmlrpc attacks blocker
Plugin Slug:
xmlrpc-attacks-blocker
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2502
The vulnerability has not been patched. You should deactivate the plugin.

The Events Calendar

Plugin:
The Events Calendar
Plugin Slug:
the-events-calendar
Installations
700,000+
Vulnerability:
Broken Access Control
Patched in Version:
6.15.16.1
Severity Score:
Medium
CVE:
2026-2694
The vulnerability has been patched, so you should update to version 6.15.16.1.

Page Builder by SiteOrigin

Plugin:
Page Builder by SiteOrigin
Plugin Slug:
siteorigin-panels
Installations
500,000+
Vulnerability:
Local File Inclusion
Patched in Version:
2.34.0
Severity Score:
High
CVE:
2026-2448
The vulnerability has been patched, so you should update to version 2.34.0.

WP Mail Logging

Plugin:
WP Mail Logging
Plugin Slug:
wp-mail-logging
Installations
300,000+
Vulnerability:
PHP Object Injection
Patched in Version:
1.16
Severity Score:
Critical
CVE:
2026-2471
The vulnerability has been patched, so you should update to version 1.16.

Post Duplicator

Plugin:
Post Duplicator
Plugin Slug:
post-duplicator
Installations
200,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.0.9
Severity Score:
Medium
CVE:
2026-2301
The vulnerability has been patched, so you should update to version 3.0.9.

Disable Admin Notices – Hide Dashboard Notifications

Plugin:
Disable Admin Notices – Hide Dashboard Notifications
Plugin Slug:
disable-admin-notices
Installations
100,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.4.3
Severity Score:
Medium
CVE:
2026-2410
The vulnerability has been patched, so you should update to version 1.4.3.

Responsive Lightbox & Gallery

Plugin:
Responsive Lightbox & Gallery
Plugin Slug:
responsive-lightbox
Installations
100,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
2.7.2
Severity Score:
Medium
CVE:
2026-2479
The vulnerability has been patched, so you should update to version 2.7.2.

Responsive Lightbox & Gallery

Plugin:
Responsive Lightbox & Gallery
Plugin Slug:
responsive-lightbox
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.6.1
Severity Score:
High
CVE:
2025-15386
The vulnerability has been patched, so you should update to version 2.6.1.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
SQL Injection
Patched in Version:
3.9.7
Severity Score:
Critical
CVE:
2025-13673
The vulnerability has been patched, so you should update to version 3.9.7.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.9.6
Severity Score:
Medium
CVE:
2026-23799
The vulnerability has been patched, so you should update to version 3.9.6.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Broken Authentication
Patched in Version:
5.1.3
Severity Score:
High
CVE:
2026-1779
The vulnerability has been patched, so you should update to version 5.1.3.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
5.1.3
Severity Score:
Medium
CVE:
2026-2356
The vulnerability has been patched, so you should update to version 5.1.3.

WP Accessibility

Plugin:
WP Accessibility
Plugin Slug:
wp-accessibility
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.2
Severity Score:
Medium
CVE:
2026-2362
The vulnerability has been patched, so you should update to version 2.3.2.

WP Recipe Maker

Plugin:
WP Recipe Maker
Plugin Slug:
wp-recipe-maker
Installations
50,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
10.3.3
Severity Score:
Medium
CVE:
2026-1558
The vulnerability has been patched, so you should update to version 10.3.3.

WP Recipe Maker

Plugin:
WP Recipe Maker
Plugin Slug:
wp-recipe-maker
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
10.3.0
Severity Score:
Medium
CVE:
2025-14742
The vulnerability has been patched, so you should update to version 10.3.0.

Simple Membership

Plugin:
Simple Membership
Plugin Slug:
simple-membership
Installations
40,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.7.1
Severity Score:
Medium
CVE:
2026-1461
The vulnerability has been patched, so you should update to version 4.7.1.

PowerPress Podcasting plugin by Blubrry

Plugin:
PowerPress Podcasting plugin by Blubrry
Plugin Slug:
powerpress
Installations
30,000+
Vulnerability:
PHP Object Injection
Patched in Version:
11.15.11
Severity Score:
High
CVE:
2026-23798
The vulnerability has been patched, so you should update to version 11.15.11.

Xpro Addons — 140+ Widgets for Elementor

Plugin:
Xpro Addons — 140+ Widgets for Elementor
Plugin Slug:
xpro-elementor-addons
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.25
Severity Score:
Medium
CVE:
2025-14149
The vulnerability has been patched, so you should update to version 1.4.25.

Secure Copy Content Protection and Content Locking

Plugin:
Secure Copy Content Protection and Content Locking
Plugin Slug:
secure-copy-content-protection
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.0.2
Severity Score:
Medium
CVE:
2026-2367
The vulnerability has been patched, so you should update to version 5.0.2.

Simple Download Monitor

Plugin:
Simple Download Monitor
Plugin Slug:
simple-download-monitor
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.0.6
Severity Score:
Medium
CVE:
2026-2383
The vulnerability has been patched, so you should update to version 4.0.6.

WP Customer Reviews

Plugin:
WP Customer Reviews
Plugin Slug:
wp-customer-reviews
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.7.6
Severity Score:
High
CVE:
2025-14452
The vulnerability has been patched, so you should update to version 3.7.6.

WPZOOM Addons for Elementor – Starter Templates & Widgets

Plugin:
WPZOOM Addons for Elementor – Starter Templates & Widgets
Plugin Slug:
wpzoom-elementor-addons
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.5
Severity Score:
High
CVE:
2026-2295
The vulnerability has been patched, so you should update to version 1.3.5.

Japanized for WooCommerce

Plugin:
Japanized for WooCommerce
Plugin Slug:
woocommerce-for-japan
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.8.5
Severity Score:
Medium
CVE:
2026-1305
The vulnerability has been patched, so you should update to version 2.8.5.

Analytics Cat – Google Analytics Made Easy

Plugin:
Analytics Cat – Google Analytics Made Easy
Plugin Slug:
analytics-cat
Installations
7,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.3
Severity Score:
High
CVE:
2024-12072
The vulnerability has been patched, so you should update to version 1.1.3.

Geo Mashup

Plugin:
Geo Mashup
Plugin Slug:
geo-mashup
Installations
2,000+
Vulnerability:
SQL Injection
Patched in Version:
1.13.18
Severity Score:
Critical
CVE:
2026-2416
The vulnerability has been patched, so you should update to version 1.13.18.

WPGSI: Spreadsheet Integration

Plugin:
WPGSI: Spreadsheet Integration
Plugin Slug:
wpgsi
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.8.4
Severity Score:
High
CVE:
2026-1916
The vulnerability has been patched, so you should update to version 3.8.4.

Ebook Store

Plugin:
Ebook Store
Plugin Slug:
ebook-store
Installations
900+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.8002
Severity Score:
High
CVE:
2024-12262
The vulnerability has been patched, so you should update to version 5.8002.

My Tickets – Accessible Event Ticketing

Plugin:
My Tickets – Accessible Event Ticketing
Plugin Slug:
my-tickets
Installations
700+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.1.1
Severity Score:
High
CVE:
2026-27406
The vulnerability has been patched, so you should update to version 2.1.1.

Theater for WordPress

Plugin:
Theater for WordPress
Plugin Slug:
theatre
Installations
600+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.19.1
Severity Score:
Medium
CVE:
2025-69343
The vulnerability has been patched, so you should update to version 0.19.1.

AI ChatBot with ChatGPT and Content Generator by AYS

Plugin:
AI ChatBot with ChatGPT and Content Generator by AYS
Plugin Slug:
ays-chatgpt-assistant
Installations
500+
Vulnerability:
Broken Access Control
Patched in Version:
2.7.6
Severity Score:
Medium
CVE:
2026-1336
The vulnerability has been patched, so you should update to version 2.7.6.

MailArchiver

Plugin:
MailArchiver
Plugin Slug:
mailarchiver
Installations
100+
Vulnerability:
SQL Injection
Patched in Version:
4.5.1
Severity Score:
High
CVE:
2026-2831
The vulnerability has been patched, so you should update to version 4.5.1.

PKT1 Centro de envios

Plugin:
PKT1 Centro de envios
Plugin Slug:
pkt1-centro-de-envios
Installations
40+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.2.2
Severity Score:
High
CVE:
2024-11806
The vulnerability has been patched, so you should update to version 1.2.2.

Planaday API

Plugin:
Planaday API
Plugin Slug:
planaday-api
Installations
30+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
11.5
Severity Score:
High
CVE:
2024-11804
The vulnerability has been patched, so you should update to version 11.5.

Fluent Forms Pro Add On Pack

Plugin:
Fluent Forms Pro Add On Pack
Plugin Slug:
fluentformpro
Vulnerability:
Broken Access Control
Patched in Version:
6.1.18
Severity Score:
High
CVE:
2026-2428
The vulnerability has been patched, so you should update to version 6.1.18.

WooCommerce License Manager

Plugin:
WooCommerce License Manager
Plugin Slug:
fs-license-manager
Vulnerability:
Arbitrary File Upload
Patched in Version:
7.0.7
Severity Score:
Critical
CVE:
2026-28114
The vulnerability has been patched, so you should update to version 7.0.7.

JetEngine

Plugin:
JetEngine
Plugin Slug:
jet-engine
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
3.8.1.2
Severity Score:
High
CVE:
2026-28134
The vulnerability has been patched, so you should update to version 3.8.1.2.

pixfort Core

Plugin:
pixfort Core
Plugin Slug:
pixfort-core
Vulnerability:
Broken Access Control
Patched in Version:
3.2.26
Severity Score:
Medium
CVE:
2026-28071
The vulnerability has been patched, so you should update to version 3.2.26.

pixfort Core

Plugin:
pixfort Core
Plugin Slug:
pixfort-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.26
Severity Score:
High
CVE:
2026-28072
The vulnerability has been patched, so you should update to version 3.2.26.

Really Simple Security Pro

Plugin:
Really Simple Security Pro
Plugin Slug:
really-simple-ssl-pro
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
9.5.4.1
Severity Score:
Medium
CVE:
2026-27397
The vulnerability has been patched, so you should update to version 9.5.4.1.

Riode Core

Plugin:
Riode Core
Plugin Slug:
riode-core
Vulnerability:
SQL Injection
Patched in Version:
1.6.27
Severity Score:
Critical
CVE:
2025-69338
The vulnerability has been patched, so you should update to version 1.6.27.

WeDesignTech Ultimate Booking Addon

Plugin:
WeDesignTech Ultimate Booking Addon
Plugin Slug:
wedesigntech-ultimate-booking-addon
Vulnerability:
Broken Access Control
Patched in Version:
1.0.4
Severity Score:
High
CVE:
2025-69340
The vulnerability has been patched, so you should update to version 1.0.4.

WordPress Themes — 6 Patched / 167 Unpatched

Nirvana

Theme:
Nirvana
Theme Slug:
nirvana
Downloads
773,853
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28119
The vulnerability has not been patched. You should switch themes.

OsTende

Theme:
OsTende
Theme Slug:
ostende
Downloads
8,315
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27986
The vulnerability has not been patched. You should switch themes.

Alchemists

Theme:
Alchemists
Theme Slug:
alchemists
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27334
The vulnerability has not been patched. You should switch themes.

Aldo

Theme:
Aldo
Theme Slug:
aldo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27993
The vulnerability has not been patched. You should switch themes.

Alliance

Theme:
Alliance
Theme Slug:
alliance
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22443
The vulnerability has not been patched. You should switch themes.

Anderson

Theme:
Anderson
Theme Slug:
andersonclinic
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28121
The vulnerability has not been patched. You should switch themes.

Aora

Theme:
Aora
Theme Slug:
aora
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27381
The vulnerability has not been patched. You should switch themes.

Apollo | Night Club, DJ Event WordPress Theme

Theme:
Apollo | Night Club, DJ Event WordPress Theme
Theme Slug:
apollo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27340
The vulnerability has not been patched. You should switch themes.

Aqualots

Theme:
Aqualots
Theme Slug:
aqualots
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28088
The vulnerability has not been patched. You should switch themes.

Architecturer

Theme:
Architecturer
Theme Slug:
architecturer
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27358
The vulnerability has not been patched. You should switch themes.

Artrium

Theme:
Artrium
Theme Slug:
artrium
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28097
The vulnerability has not been patched. You should switch themes.

Asia Garden

Theme:
Asia Garden
Theme Slug:
asia-garden
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28063
The vulnerability has not been patched. You should switch themes.

Aviana

Theme:
Aviana
Theme Slug:
aviana
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22387
The vulnerability has not been patched. You should switch themes.

Avventure

Theme:
Avventure
Theme Slug:
avventure
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27991
The vulnerability has not been patched. You should switch themes.

Bassein

Theme:
Bassein
Theme Slug:
bassein
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28067
The vulnerability has not been patched. You should switch themes.

Bazinga

Theme:
Bazinga
Theme Slug:
bazinga
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28084
The vulnerability has not been patched. You should switch themes.

Beacon

Theme:
Beacon
Theme Slug:
beacon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28050
The vulnerability has not been patched. You should switch themes.

Bonbon

Theme:
Bonbon
Theme Slug:
bonbon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28030
The vulnerability has not been patched. You should switch themes.

Buzz Stone | Magazine & Viral Blog WordPress Theme

Theme:
Buzz Stone | Magazine & Viral Blog WordPress Theme
Theme Slug:
buzzstone
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27339
The vulnerability has not been patched. You should switch themes.

Celeste

Theme:
Celeste
Theme Slug:
celeste
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27369
The vulnerability has not been patched. You should switch themes.

Miller

Theme:
Miller
Theme Slug:
christine-miller
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28053
The vulnerability has not been patched. You should switch themes.

Chroma

Theme:
Chroma
Theme Slug:
chroma
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28020
The vulnerability has not been patched. You should switch themes.

Chronicle – Lifestyle Magazine & Blog WordPress Theme

Theme:
Chronicle – Lifestyle Magazine & Blog WordPress Theme
Theme Slug:
chronicle
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27337
The vulnerability has not been patched. You should switch themes.

Claue – Clean, Minimal Elementor WooCommerce Theme

Theme:
Claue – Clean, Minimal Elementor WooCommerce Theme
Theme Slug:
claue
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27376
The vulnerability has not been patched. You should switch themes.

CloudMe

Theme:
CloudMe
Theme Slug:
cloudme
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22433
The vulnerability has not been patched. You should switch themes.

Cocco

Theme:
Cocco
Theme Slug:
cocco
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22389
The vulnerability has not been patched. You should switch themes.

Coinpress

Theme:
Coinpress
Theme Slug:
coinpress
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28007
The vulnerability has not been patched. You should switch themes.

Coleo

Theme:
Coleo
Theme Slug:
coleo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28091
The vulnerability has not been patched. You should switch themes.

ConFix

Theme:
ConFix
Theme Slug:
confix
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27990
The vulnerability has not been patched. You should switch themes.

Conquerors

Theme:
Conquerors
Theme Slug:
conquerors
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28079
The vulnerability has not been patched. You should switch themes.

Consultor | Consulting, Accounting & Legal Counsel WordPress Theme

Theme:
Consultor | Consulting, Accounting & Legal Counsel WordPress Theme
Theme Slug:
consultor
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27336
The vulnerability has not been patched. You should switch themes.

Cortex

Theme:
Cortex
Theme Slug:
cortex
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22392
The vulnerability has not been patched. You should switch themes.

Craftis

Theme:
Craftis
Theme Slug:
craftis
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28021
The vulnerability has not been patched. You should switch themes.

Crown Art

Theme:
Crown Art
Theme Slug:
crown-art
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22434
The vulnerability has not been patched. You should switch themes.

Daiquiri

Theme:
Daiquiri
Theme Slug:
daiquiri
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28089
The vulnerability has not been patched. You should switch themes.

Dentario

Theme:
Dentario
Theme Slug:
dentario
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27439
The vulnerability has not been patched. You should switch themes.

Dermatology Clinic

Theme:
Dermatology Clinic
Theme Slug:
dermatology-clinic
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28059
The vulnerability has not been patched. You should switch themes.

Dixon

Theme:
Dixon
Theme Slug:
dixon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28058
The vulnerability has not been patched. You should switch themes.

Dolcino

Theme:
Dolcino
Theme Slug:
dolcino
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22410
The vulnerability has not been patched. You should switch themes.

Dr.Patterson

Theme:
Dr.Patterson
Theme Slug:
dr-patterson
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28120
The vulnerability has not been patched. You should switch themes.

DroneX

Theme:
DroneX
Theme Slug:
dronex
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28009
The vulnerability has not been patched. You should switch themes.

Edge Decor

Theme:
Edge Decor
Theme Slug:
edge-decor
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28064
The vulnerability has not been patched. You should switch themes.

Edifice

Theme:
Edifice
Theme Slug:
edifice
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28033
The vulnerability has not been patched. You should switch themes.

Eject

Theme:
Eject
Theme Slug:
eject
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28065
The vulnerability has not been patched. You should switch themes.

Ekoterra – NonProfit, Green Energy & Ecology Theme

Theme:
Ekoterra – NonProfit, Green Energy & Ecology Theme
Theme Slug:
ekoterra
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27335
The vulnerability has not been patched. You should switch themes.

ElectroServ

Theme:
ElectroServ
Theme Slug:
electroserv
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22435
The vulnerability has not been patched. You should switch themes.

EmojiNation

Theme:
EmojiNation
Theme Slug:
emojination
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28029
The vulnerability has not been patched. You should switch themes.

Eona

Theme:
Eona
Theme Slug:
eona
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22412
The vulnerability has not been patched. You should switch themes.

Equadio

Theme:
Equadio
Theme Slug:
equadio
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27988
The vulnerability has not been patched. You should switch themes.

Evently

Theme:
Evently
Theme Slug:
evently
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22394
The vulnerability has not been patched. You should switch themes.

Filmax

Theme:
Filmax
Theme Slug:
filmax
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28087
The vulnerability has not been patched. You should switch themes.

Fiorello

Theme:
Fiorello
Theme Slug:
fiorello
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22395
The vulnerability has not been patched. You should switch themes.

FixTeam

Theme:
FixTeam
Theme Slug:
fixteam
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22416
The vulnerability has not been patched. You should switch themes.

FlashMart

Theme:
FlashMart
Theme Slug:
flashmart
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28048
The vulnerability has not been patched. You should switch themes.

Fleur

Theme:
Fleur
Theme Slug:
fleur
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22397
The vulnerability has not been patched. You should switch themes.

Foodie

Theme:
Foodie
Theme Slug:
foodie
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28022
The vulnerability has not been patched. You should switch themes.

Gamezone

Theme:
Gamezone
Theme Slug:
gamezone
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28090
The vulnerability has not been patched. You should switch themes.

Gecko

Theme:
Gecko
Theme Slug:
gecko
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27375
The vulnerability has not been patched. You should switch themes.

Global Logistics

Theme:
Global Logistics
Theme Slug:
globallogistics
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28018
The vulnerability has not been patched. You should switch themes.

Good Energy

Theme:
Good Energy
Theme Slug:
goodenergy
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-28105
The vulnerability has not been patched. You should switch themes.

GoTravel

Theme:
GoTravel
Theme Slug:
gotravel
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22427
The vulnerability has not been patched. You should switch themes.

Grand News

Theme:
Grand News
Theme Slug:
grandnews
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27353
The vulnerability has not been patched. You should switch themes.

Great Lotus

Theme:
Great Lotus
Theme Slug:
great-lotus
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22418
The vulnerability has not been patched. You should switch themes.

Green Planet

Theme:
Green Planet
Theme Slug:
green-planet
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22439
The vulnerability has not been patched. You should switch themes.

Green Thumb

Theme:
Green Thumb
Theme Slug:
greenthumb
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28017
The vulnerability has not been patched. You should switch themes.

Gridiron

Theme:
Gridiron
Theme Slug:
gridiron
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28012
The vulnerability has not been patched. You should switch themes.

Grit

Theme:
Grit
Theme Slug:
grit
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28041
The vulnerability has not been patched. You should switch themes.

Guff

Theme:
Guff
Theme Slug:
guff
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28076
The vulnerability has not been patched. You should switch themes.

Happy Baby

Theme:
Happy Baby
Theme Slug:
happy-baby
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28062
The vulnerability has not been patched. You should switch themes.

Healer – Doctor, Clinic & Medical WordPress Theme

Theme:
Healer – Doctor, Clinic & Medical WordPress Theme
Theme Slug:
healer
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-28043
The vulnerability has not been patched. You should switch themes.

Helion

Theme:
Helion
Theme Slug:
helion
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28024
The vulnerability has not been patched. You should switch themes.

Helvig

Theme:
Helvig
Theme Slug:
helvig
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22436
The vulnerability has not been patched. You should switch themes.

Holmes

Theme:
Holmes
Theme Slug:
holmes
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22399
The vulnerability has not been patched. You should switch themes.

Honor

Theme:
Honor
Theme Slug:
honor
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22419
The vulnerability has not been patched. You should switch themes.

Horizon

Theme:
Horizon
Theme Slug:
horizon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22420
The vulnerability has not been patched. You should switch themes.

Humanum

Theme:
Humanum
Theme Slug:
humanum
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27985
The vulnerability has not been patched. You should switch themes.

Innovio

Theme:
Innovio
Theme Slug:
innovio
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22403
The vulnerability has not been patched. You should switch themes.

Invetex

Theme:
Invetex
Theme Slug:
invetex
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28031
The vulnerability has not been patched. You should switch themes.

Justicia

Theme:
Justicia
Theme Slug:
justicia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22408
The vulnerability has not been patched. You should switch themes.

Justitia

Theme:
Justitia
Theme Slug:
justitia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27995
The vulnerability has not been patched. You should switch themes.

Kayon

Theme:
Kayon
Theme Slug:
kayon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28027
The vulnerability has not been patched. You should switch themes.

Kingler

Theme:
Kingler
Theme Slug:
kingler
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27438
The vulnerability has not been patched. You should switch themes.

Kratz

Theme:
Kratz
Theme Slug:
kratz
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28013
The vulnerability has not been patched. You should switch themes.

Law Office

Theme:
Law Office
Theme Slug:
law-office
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28046
The vulnerability has not been patched. You should switch themes.

Legal Stone

Theme:
Legal Stone
Theme Slug:
legal-stone
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28054
The vulnerability has not been patched. You should switch themes.

Legrand

Theme:
Legrand
Theme Slug:
legrand
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28066
The vulnerability has not been patched. You should switch themes.

Le Truffe

Theme:
Le Truffe
Theme Slug:
letruffe
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28069
The vulnerability has not been patched. You should switch themes.

Lingvico

Theme:
Lingvico
Theme Slug:
lingvico
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27996
The vulnerability has not been patched. You should switch themes.

Listify

Theme:
Listify
Theme Slug:
listify
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28042
The vulnerability has not been patched. You should switch themes.

Little Birdies

Theme:
Little Birdies
Theme Slug:
little-birdies
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28129
The vulnerability has not been patched. You should switch themes.

Luxury Wine

Theme:
Luxury Wine
Theme Slug:
luxury-wine
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28016
The vulnerability has not been patched. You should switch themes.

Mahogany

Theme:
Mahogany
Theme Slug:
mahogany
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28085
The vulnerability has not been patched. You should switch themes.

Malgré

Theme:
Malgré
Theme Slug:
malgre
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22413
The vulnerability has not been patched. You should switch themes.

Mandala

Theme:
Mandala
Theme Slug:
mandala
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28057
The vulnerability has not been patched. You should switch themes.

Manoir

Theme:
Manoir
Theme Slug:
manoir
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28019
The vulnerability has not been patched. You should switch themes.

Marcell

Theme:
Marcell
Theme Slug:
marcell
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28095
The vulnerability has not been patched. You should switch themes.

Marra

Theme:
Marra
Theme Slug:
marra
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22414
The vulnerability has not been patched. You should switch themes.

Maxify

Theme:
Maxify
Theme Slug:
maxify
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27997
The vulnerability has not been patched. You should switch themes.

MCKinney’s Politics

Theme:
MCKinney’s Politics
Theme Slug:
mckinney-politics
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28056
The vulnerability has not been patched. You should switch themes.

Meals & Wheels

Theme:
Meals & Wheels
Theme Slug:
meals-wheels
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27992
The vulnerability has not been patched. You should switch themes.

MediCenter – Health Medical Clinic

Theme:
MediCenter – Health Medical Clinic
Theme Slug:
medicenter
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28137
The vulnerability has not been patched. You should switch themes.

Metro

Theme:
Metro
Theme Slug:
metro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27382
The vulnerability has not been patched. You should switch themes.

Metro

Theme:
Metro
Theme Slug:
metro
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27383
The vulnerability has not been patched. You should switch themes.

Midi

Theme:
Midi
Theme Slug:
midi
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28125
The vulnerability has not been patched. You should switch themes.

MoneyFlow

Theme:
MoneyFlow
Theme Slug:
moneyflow
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28028
The vulnerability has not been patched. You should switch themes.

Motorix

Theme:
Motorix
Theme Slug:
motorix
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28026
The vulnerability has not been patched. You should switch themes.

Musico

Theme:
Musico
Theme Slug:
musico
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27367
The vulnerability has not been patched. You should switch themes.

Muzicon

Theme:
Muzicon
Theme Slug:
muzicon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28107
The vulnerability has not been patched. You should switch themes.

N7 | Golf Club Sports & Events

Theme:
N7 | Golf Club Sports & Events
Theme Slug:
n7-golf-club
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28045
The vulnerability has not been patched. You should switch themes.

Notarius

Theme:
Notarius
Theme Slug:
notarius
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28124
The vulnerability has not been patched. You should switch themes.

Nuts

Theme:
Nuts
Theme Slug:
nuts
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28023
The vulnerability has not been patched. You should switch themes.

Overton

Theme:
Overton
Theme Slug:
overton
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22405
The vulnerability has not been patched. You should switch themes.

Ozisti

Theme:
Ozisti
Theme Slug:
ozisti
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28093
The vulnerability has not been patched. You should switch themes.

Peter Mason

Theme:
Peter Mason
Theme Slug:
petermason
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28052
The vulnerability has not been patched. You should switch themes.

Photography

Theme:
Photography
Theme Slug:
photography
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27348
The vulnerability has not been patched. You should switch themes.

Pizza House

Theme:
Pizza House
Theme Slug:
pizzahouse
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-28074
The vulnerability has not been patched. You should switch themes.

Playa

Theme:
Playa
Theme Slug:
playa
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22437
The vulnerability has not been patched. You should switch themes.

Police Department

Theme:
Police Department
Theme Slug:
police-department
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28049
The vulnerability has not been patched. You should switch themes.

Porto

Theme:
Porto
Theme Slug:
porto
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28075
The vulnerability has not been patched. You should switch themes.

Printy

Theme:
Printy
Theme Slug:
printy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28035
The vulnerability has not been patched. You should switch themes.

Progress

Theme:
Progress
Theme Slug:
progress
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28034
The vulnerability has not been patched. You should switch themes.

Quantum

Theme:
Quantum
Theme Slug:
quantum
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22421
The vulnerability has not been patched. You should switch themes.

Quanzo

Theme:
Quanzo
Theme Slug:
quanzo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27989
The vulnerability has not been patched. You should switch themes.

Ratatouille

Theme:
Ratatouille
Theme Slug:
ratatouille
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28036
The vulnerability has not been patched. You should switch themes.

RexCoin

Theme:
RexCoin
Theme Slug:
rexcoin
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28094
The vulnerability has not been patched. You should switch themes.

Rhythmo

Theme:
Rhythmo
Theme Slug:
rhythmo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28068
The vulnerability has not been patched. You should switch themes.

Run Gran

Theme:
Run Gran
Theme Slug:
run-gran
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28086
The vulnerability has not been patched. You should switch themes.

Save Life

Theme:
Save Life
Theme Slug:
save-life
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28098
The vulnerability has not been patched. You should switch themes.

Scientia

Theme:
Scientia
Theme Slug:
scientia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28010
The vulnerability has not been patched. You should switch themes.

SetSail

Theme:
SetSail
Theme Slug:
setsail
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22423
The vulnerability has not been patched. You should switch themes.

Shaha

Theme:
Shaha
Theme Slug:
shaha
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22424
The vulnerability has not been patched. You should switch themes.

ShiftCV

Theme:
ShiftCV
Theme Slug:
shift-cv
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28015
The vulnerability has not been patched. You should switch themes.

smart SEO

Theme:
smart SEO
Theme Slug:
smartSEO
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28117
The vulnerability has not been patched. You should switch themes.

Sounder

Theme:
Sounder
Theme Slug:
sounder
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28092
The vulnerability has not been patched. You should switch themes.

Stargaze

Theme:
Stargaze
Theme Slug:
stargaze
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28025
The vulnerability has not been patched. You should switch themes.

Starto

Theme:
Starto
Theme Slug:
starto
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27352
The vulnerability has not been patched. You should switch themes.

S.King

Theme:
S.King
Theme Slug:
stephanie-king
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28060
The vulnerability has not been patched. You should switch themes.

Sweet Jane

Theme:
Sweet Jane
Theme Slug:
sweetjane
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22425
The vulnerability has not been patched. You should switch themes.

Tediss

Theme:
Tediss
Theme Slug:
tediss
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27994
The vulnerability has not been patched. You should switch themes.

Tennis Club

Theme:
Tennis Club
Theme Slug:
tennis-sportclub
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27437
The vulnerability has not been patched. You should switch themes.

The Mounty

Theme:
The Mounty
Theme Slug:
the-mounty
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22415
The vulnerability has not been patched. You should switch themes.

The Qlean

Theme:
The Qlean
Theme Slug:
the-qlean
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27987
The vulnerability has not been patched. You should switch themes.

Tiger Claw

Theme:
Tiger Claw
Theme Slug:
tiger-claw
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28061
The vulnerability has not been patched. You should switch themes.

Tooth Fairy

Theme:
Tooth Fairy
Theme Slug:
tooth-fairy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22428
The vulnerability has not been patched. You should switch themes.

TopFit – Fitness and Gym WordPress Theme

Theme:
TopFit – Fitness and Gym WordPress Theme
Theme Slug:
topfit
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27342
The vulnerability has not been patched. You should switch themes.

TopScorer – Sports WordPress Theme

Theme:
TopScorer – Sports WordPress Theme
Theme Slug:
topscorer
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27341
The vulnerability has not been patched. You should switch themes.

Translogic

Theme:
Translogic
Theme Slug:
translogic
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28014
The vulnerability has not been patched. You should switch themes.

Tribe

Theme:
Tribe
Theme Slug:
tribe
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22442
The vulnerability has not been patched. You should switch themes.

Tuning

Theme:
Tuning
Theme Slug:
tuning
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28032
The vulnerability has not been patched. You should switch themes.

UDesign

Theme:
UDesign
Theme Slug:
u-design
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28130
The vulnerability has not been patched. You should switch themes.

Vapester

Theme:
Vapester
Theme Slug:
vapester
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28077
The vulnerability has not been patched. You should switch themes.

Veil

Theme:
Veil
Theme Slug:
veil
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28123
The vulnerability has not been patched. You should switch themes.

Verdure

Theme:
Verdure
Theme Slug:
verdure
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22429
The vulnerability has not been patched. You should switch themes.

Verse

Theme:
Verse
Theme Slug:
verse
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28128
The vulnerability has not been patched. You should switch themes.

Victo

Theme:
Victo
Theme Slug:
victo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28047
The vulnerability has not been patched. You should switch themes.

Vixus

Theme:
Vixus
Theme Slug:
vixus
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27998
The vulnerability has not been patched. You should switch themes.

Wabi-Sabi

Theme:
Wabi-Sabi
Theme Slug:
wabi-sabi
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22431
The vulnerability has not been patched. You should switch themes.

WealthCo

Theme:
WealthCo
Theme Slug:
wealthco
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28096
The vulnerability has not been patched. You should switch themes.

Welldone

Theme:
Welldone
Theme Slug:
welldone
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28118
The vulnerability has not been patched. You should switch themes.

M.Williamson

Theme:
M.Williamson
Theme Slug:
williamson
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28055
The vulnerability has not been patched. You should switch themes.

Windsor

Theme:
Windsor
Theme Slug:
windsor
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28081
The vulnerability has not been patched. You should switch themes.

Wolmart

Theme:
Wolmart
Theme Slug:
wolmart
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22385
The vulnerability has not been patched. You should switch themes.

Woopy

Theme:
Woopy
Theme Slug:
woopy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22432
The vulnerability has not been patched. You should switch themes.

Yacht Rental

Theme:
Yacht Rental
Theme Slug:
yacht-rental
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28051
The vulnerability has not been patched. You should switch themes.

Yottis

Theme:
Yottis
Theme Slug:
yottis
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28011
The vulnerability has not been patched. You should switch themes.

Yungen

Theme:
Yungen
Theme Slug:
yungen
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28006
The vulnerability has not been patched. You should switch themes.

Zentrum

Theme:
Zentrum
Theme Slug:
zentrum
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22441
The vulnerability has not been patched. You should switch themes.

Blocksy

Theme:
Blocksy
Theme Slug:
blocksy
Downloads
6,306,227
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.31
Severity Score:
Medium
CVE:
2026-2583
The vulnerability has been patched, so you should update to version 2.1.31.

Automotive Car Dealership Business

Theme:
Automotive Car Dealership Business
Theme Slug:
automotive
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
13.4.2
Severity Score:
Medium
CVE:
2025-14040
The vulnerability has been patched, so you should update to version 13.4.2.

Listee

Theme:
Listee
Theme Slug:
listee
Vulnerability:
Privilege Escalation
Patched in Version:
1.1.7
Severity Score:
Critical
CVE:
2025-12981
The vulnerability has been patched, so you should update to version 1.1.7.

Molla

Theme:
Molla
Theme Slug:
molla
Vulnerability:
Local File Inclusion
Patched in Version:
1.5.17
Severity Score:
High
CVE:
2025-69339
The vulnerability has been patched, so you should update to version 1.5.17.

Sweet Date

Theme:
Sweet Date
Theme Slug:
sweetdate
Vulnerability:
PHP Object Injection
Patched in Version:
4.0.1
Severity Score:
Critical
CVE:
2026-27417
The vulnerability has been patched, so you should update to version 4.0.1.

The Issue

Theme:
The Issue
Theme Slug:
theissue
Vulnerability:
Local File Inclusion
Patched in Version:
1.6.12
Severity Score:
High
CVE:
2026-23801
The vulnerability has been patched, so you should update to version 1.6.12.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — March 4, 2026 appeared first on SolidWP.

]]> The Sites List, Reimagined: A More Effective Way to Manage Your WordPress Sites https://solidwp.com/blog/solid-central-sites-list-redesign/ Thu, 26 Feb 2026 14:52:27 +0000 https://solidwp.com/?p=2552987 The new Sites List in Solid Central is here. With faster performance, at-a-glance insights, and a streamlined interface, it’s the first step in modernizing your workflow.

The post The Sites List, Reimagined: A More Effective Way to Manage Your WordPress Sites appeared first on SolidWP.

]]> We’ve just rolled out a major update to the Sites List in Solid Central.

If you’ve ever managed more than a handful of WordPress sites, you know how important visibility and speed are. The old Sites List in Solid Central did the job—but it didn’t keep up with what WordPress professionals need today.

That’s why we’ve rebuilt it.

The Problem: Too Many Clicks, Not Enough Clarity

The original Sites List had limitations:

  • Key data, like updates, vulnerabilities, downtime, and backups were scattered across multiple views
  • Managing large site portfolios often led to “tab fatigue”
  • Performance slowed as more sites were added
  • The UI felt dated and didn’t reflect the rest of the modern WordPress experience

Whether you were managing 5 sites or 50, the workflow was slower and less intuitive than it needed to be.

The Solution: A Smarter, Cleaner Sites List

We’ve reimagined the Sites List from the ground up—starting with a modern frontend built on the same React dataview library used in WordPress Core.

Here’s what’s new:

  • A cleaner, faster interface built for scale and clarity
  • Pop-up detail views for more in-depth updates, vulnerability,  downtime, and backup insights
  • Consolidated site actions menu puts site management tools a click away
  • Improved site refresh logic for better performance with fewer API calls
  • More visibility at-a-glance, including filterable and sortable columns for updates, vulnerabilities, downtime, and backups
New Sites List UI overview with integrated update, risk, and backup indicators.

From a List to a Command Center

This update turns the Sites List into more than just a directory. It’s now the central command hub for your portfolio—whether you’re managing 10 sites or 100.

By surfacing key data points and eliminating unnecessary page loads, Solid Central now puts actionable insights front and center.

You’ll spend less time hunting for issues and more time getting ahead of them.

Interactive modals provide quick context without leaving the page.

What This Means for You

Whether you’re using Central Free or part of the full Solid Suite, this is a win for your workflow:

  • For freelancers and agency owners: Fewer support calls, clearer reporting, and faster visibility across client sites.
  • For developers and site managers: Less jumping between plugins or panels. More doing.
  • For everyone: A modernized experience that meets the expectations of today’s WordPress pros.

This update is part of a broader redesign coming to Solid Central. It’s the first step—but a big one.

Ready to Upgrade Your Workflow?

If you’re not already using Solid Central, now’s the time.

Get faster updates, better visibility, and streamlined site management—built for WordPress pros who don’t have time to waste.

Get Solid Central Free Upgrade to Pro

Effective site management starts with a stronger foundation—and this is just the beginning.

The post The Sites List, Reimagined: A More Effective Way to Manage Your WordPress Sites appeared first on SolidWP.

]]> WordPress Vulnerability Report — February 25, 2026 https://solidwp.com/blog/wordpress-vulnerability-report-february-25-2026/ Wed, 25 Feb 2026 14:25:48 +0000 https://solidwp.com/?p=2553011 Since last week, 244 new vulnerabilities have emerged in the WordPress ecosystem, including 205 plugins and 39 themes. Of those, 80 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

The post WordPress Vulnerability Report — February 25, 2026 appeared first on SolidWP.

]]> In this report, 244 vulnerabilities have been publicly disclosed. Security patches for 164 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 80 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 7.0 Beta 1 is now available for testing. As this is a pre-release version, it is intended for testing and development only and should not be installed on production or mission-critical sites. Organizations should use local or staging environments to evaluate compatibility and new features before the final rollout.

The full release of WordPress 7.0 is currently scheduled for April 9, 2026. You can find the complete release schedule and technical testing details in the official announcement.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 156 Patched / 49 Unpatched

SiteGuard WP Plugin

Plugin:
SiteGuard WP Plugin
Plugin Slug:
siteguard
Installations
500,000+
Vulnerability:
Bypass Vulnerability
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27411
The vulnerability has not been patched. You should deactivate the plugin.

Link Whisper Free

Plugin:
Link Whisper Free
Plugin Slug:
link-whisper
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22357
The vulnerability has not been patched. You should deactivate the plugin.

Frontend File Manager Plugin

Plugin:
Frontend File Manager Plugin
Plugin Slug:
nmedia-user-file-uploader
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-0829
The vulnerability has not been patched. You should deactivate the plugin.

Premmerce

Plugin:
Premmerce
Plugin Slug:
premmerce
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-0555
The vulnerability has not been patched. You should deactivate the plugin.

Prodigy Commerce

Plugin:
Prodigy Commerce
Plugin Slug:
prodigy-commerce
Installations
100+
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-0926
The vulnerability has not been patched. You should deactivate the plugin.

TalkJS

Plugin:
TalkJS
Plugin Slug:
talkjs
Installations
50+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1055
The vulnerability has not been patched. You should deactivate the plugin.

Filestack

Plugin:
Filestack
Plugin Slug:
filepicker-media-uploader
Installations
20+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-13959
The vulnerability has not been patched. You should deactivate the plugin.

Address Bar Ads

Plugin:
Address Bar Ads
Plugin Slug:
address-bar-ads
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1795
The vulnerability has not been patched. You should deactivate the plugin.

Advance Block Extend

Plugin:
Advance Block Extend
Plugin Slug:
advance-block-extend
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1646
The vulnerability has not been patched. You should deactivate the plugin.

Applay – Shortcodes

Plugin:
Applay – Shortcodes
Plugin Slug:
applay-shortcodes
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22384
The vulnerability has not been patched. You should deactivate the plugin.

BlueSnap Payment Gateway for WooCommerce

Plugin:
BlueSnap Payment Gateway for WooCommerce
Plugin Slug:
bluesnap-payment-gateway-for-woocommerce
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-0692
The vulnerability has not been patched. You should deactivate the plugin.

Clasifico Listing

Plugin:
Clasifico Listing
Plugin Slug:
clasifico-listing
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-12882
The vulnerability has not been patched. You should deactivate the plugin.

Country Blocker for AdSense

Plugin:
Country Blocker for AdSense
Plugin Slug:
country-blocker-for-adsense
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-13413
The vulnerability has not been patched. You should deactivate the plugin.

Dealia – Request a quote

Plugin:
Dealia – Request a quote
Plugin Slug:
dealia-request-a-quote
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2718
The vulnerability has not been patched. You should deactivate the plugin.

Dealia – Request a quote

Plugin:
Dealia – Request a quote
Plugin Slug:
dealia-request-a-quote
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2504
The vulnerability has not been patched. You should deactivate the plugin.

DesignThemes Booking Manager

Plugin:
DesignThemes Booking Manager
Plugin Slug:
designthemes-booking-manager
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27388
The vulnerability has not been patched. You should deactivate the plugin.

DesignThemes Directory Addon

Plugin:
DesignThemes Directory Addon
Plugin Slug:
designthemes-directory-addon
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27386
The vulnerability has not been patched. You should deactivate the plugin.

Directory Pro

Plugin:
Directory Pro
Plugin Slug:
directory-pro
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27396
The vulnerability has not been patched. You should deactivate the plugin.

Eagle Booking

Plugin:
Eagle Booking
Plugin Slug:
eagle-booking
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27428
The vulnerability has not been patched. You should deactivate the plugin.

Easy Author Image

Plugin:
Easy Author Image
Plugin Slug:
easy-author-image
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1373
The vulnerability has not been patched. You should deactivate the plugin.

Geo Widget

Plugin:
Geo Widget
Plugin Slug:
geowidget
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1792
The vulnerability has not been patched. You should deactivate the plugin.

iXML

Plugin:
iXML
Plugin Slug:
ixml
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-14076
The vulnerability has not been patched. You should deactivate the plugin.

MP-Ukagaka

Plugin:
MP-Ukagaka
Plugin Slug:
mp-ukagaka
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1643
The vulnerability has not been patched. You should deactivate the plugin.

News Element Elementor Blog Magazine

Plugin:
News Element Elementor Blog Magazine
Plugin Slug:
news-element
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2284
The vulnerability has not been patched. You should deactivate the plugin.

Page Title, Description & Open Graph Updater

Plugin:
Page Title, Description & Open Graph Updater
Plugin Slug:
page-title-description-open-graph-updater
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-13438
The vulnerability has not been patched. You should deactivate the plugin.

personal-authors-category

Plugin:
personal-authors-category
Plugin Slug:
personal-authors-category
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1754
The vulnerability has not been patched. You should deactivate the plugin.

Profile Builder Pro

Plugin:
Profile Builder Pro
Plugin Slug:
profile-builder-pro
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27413
The vulnerability has not been patched. You should deactivate the plugin.

Really Simple Security Pro

Plugin:
Really Simple Security Pro
Plugin Slug:
really-simple-ssl-pro
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27397
The vulnerability has not been patched. You should deactivate the plugin.

Remove Post Type Slug

Plugin:
Remove Post Type Slug
Plugin Slug:
remove-post-type-slug
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14167
The vulnerability has not been patched. You should deactivate the plugin.

salavat counter

Plugin:
salavat counter
Plugin Slug:
salavat-counter
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1047
The vulnerability has not been patched. You should deactivate the plugin.

Slider Future

Plugin:
Slider Future
Plugin Slug:
slider-future
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-1405
The vulnerability has not been patched. You should deactivate the plugin.

Slidorion

Plugin:
Slidorion
Plugin Slug:
slidorion
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2282
The vulnerability has not been patched. You should deactivate the plugin.

StyleBidet

Plugin:
StyleBidet
Plugin Slug:
stylebidet
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1796
The vulnerability has not been patched. You should deactivate the plugin.

Subitem AL Slider

Plugin:
Subitem AL Slider
Plugin Slug:
subitem-al-slider
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1634
The vulnerability has not been patched. You should deactivate the plugin.

Super Simple Contact Form

Plugin:
Super Simple Contact Form
Plugin Slug:
super-simple-contact-form
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-0753
The vulnerability has not been patched. You should deactivate the plugin.

Tennis Court Bookings

Plugin:
Tennis Court Bookings
Plugin Slug:
tennis-court-bookings
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1044
The vulnerability has not been patched. You should deactivate the plugin.

Toret Manager

Plugin:
Toret Manager
Plugin Slug:
toret-manager
Vulnerability:
Settings Change
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-0912
The vulnerability has not been patched. You should deactivate the plugin.

WeDesignTech Ultimate Booking Addon

Plugin:
WeDesignTech Ultimate Booking Addon
Plugin Slug:
wedesigntech-ultimate-booking-addon
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27389
The vulnerability has not been patched. You should deactivate the plugin.

WeDesignTech Ultimate Booking Addon

Plugin:
WeDesignTech Ultimate Booking Addon
Plugin Slug:
wedesigntech-ultimate-booking-addon
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27390
The vulnerability has not been patched. You should deactivate the plugin.

Whatsiplus Scheduled Notification for Woocommerce

Plugin:
Whatsiplus Scheduled Notification for Woocommerce
Plugin Slug:
whatsiplus-scheduled-notification-for-woocommerce
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1455
The vulnerability has not been patched. You should deactivate the plugin.

Woocommerce Wholesale Lead Capture

Plugin:
Woocommerce Wholesale Lead Capture
Plugin Slug:
woocommerce-wholesale-lead-capture
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27542
The vulnerability has not been patched. You should deactivate the plugin.

Woocommerce Wholesale Lead Capture

Plugin:
Woocommerce Wholesale Lead Capture
Plugin Slug:
woocommerce-wholesale-lead-capture
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27540
The vulnerability has not been patched. You should deactivate the plugin.

WP AUDIO GALLERY

Plugin:
WP AUDIO GALLERY
Plugin Slug:
wp-audio-gallery
Vulnerability:
Arbitrary File Download
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-13603
The vulnerability has not been patched. You should deactivate the plugin.

Client Testimonial Slider

Plugin:
Client Testimonial Slider
Plugin Slug:
wp-client-testimonial
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2716
The vulnerability has not been patched. You should deactivate the plugin.

LiquidPoll

Plugin:
LiquidPoll
Plugin Slug:
wp-poll
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-7134
The vulnerability has not been patched. You should deactivate the plugin.

xmlrpc attacks blocker

Plugin:
xmlrpc attacks blocker
Plugin Slug:
xmlrpc-attacks-blocker
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2502
The vulnerability has not been patched. You should deactivate the plugin.

XO Event Calendar

Plugin:
XO Event Calendar
Plugin Slug:
xo-event-calendar
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-0556
The vulnerability has not been patched. You should deactivate the plugin.

Complianz – GDPR/CCPA Cookie Consent

Plugin:
Complianz – GDPR/CCPA Cookie Consent
Plugin Slug:
complianz-gdpr
Installations
1,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.4.4
Severity Score:
Medium
CVE:
2025-11185
The vulnerability has been patched, so you should update to version 7.4.4.

Breadcrumb NavXT

Plugin:
Breadcrumb NavXT
Plugin Slug:
breadcrumb-navxt
Installations
800,000+
Vulnerability:
Broken Access Control
Patched in Version:
7.5.1
Severity Score:
Medium
CVE:
2025-13842
The vulnerability has been patched, so you should update to version 7.5.1.

Easy Table of Contents

Plugin:
Easy Table of Contents
Plugin Slug:
easy-table-of-contents
Installations
600,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.79
Severity Score:
Medium
CVE:
2025-13738
The vulnerability has been patched, so you should update to version 2.0.79.

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

Plugin:
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Plugin Slug:
kadence-blocks
Installations
600,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
3.6.2
Severity Score:
Medium
CVE:
2026-1857
The vulnerability has been patched, so you should update to version 3.6.2.

BackWPup – WordPress Backup & Restore Plugin

Plugin:
BackWPup – WordPress Backup & Restore Plugin
Plugin Slug:
backwpup
Installations
500,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.6.3
Severity Score:
High
CVE:
2025-15041
The vulnerability has been patched, so you should update to version 5.6.3.

PixelYourSite – Your smart PIXEL (TAG) & API Manager

Plugin:
PixelYourSite – Your smart PIXEL (TAG) & API Manager
Plugin Slug:
pixelyoursite
Installations
500,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
11.2.0.2
Severity Score:
High
CVE:
2026-27072
The vulnerability has been patched, so you should update to version 11.2.0.2.

PixelYourSite – Your smart PIXEL (TAG) & API Manager

Plugin:
PixelYourSite – Your smart PIXEL (TAG) & API Manager
Plugin Slug:
pixelyoursite
Installations
500,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
11.2.0.1
Severity Score:
High
CVE:
2026-1841
The vulnerability has been patched, so you should update to version 11.2.0.1.

Converter for Media – Optimize images | Convert WebP & AVIF

Plugin:
Converter for Media – Optimize images | Convert WebP & AVIF
Plugin Slug:
webp-converter-for-media
Installations
500,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
6.5.2
Severity Score:
High
CVE:
2026-1356
The vulnerability has been patched, so you should update to version 6.5.2.

Ally – Web Accessibility & Usability

Plugin:
Ally – Web Accessibility & Usability
Plugin Slug:
pojo-accessibility
Installations
400,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.0.3
Severity Score:
Medium
CVE:
2026-25386
The vulnerability has been patched, so you should update to version 4.0.3.

SiteOrigin Widgets Bundle

Plugin:
SiteOrigin Widgets Bundle
Plugin Slug:
so-widgets-bundle
Installations
400,000+
Vulnerability:
Content Injection
Patched in Version:
1.71.0
Severity Score:
Medium
CVE:
2026-2127
The vulnerability has been patched, so you should update to version 1.71.0.

PDF Invoices & Packing Slips for WooCommerce

Plugin:
PDF Invoices & Packing Slips for WooCommerce
Plugin Slug:
woocommerce-pdf-invoices-packing-slips
Installations
300,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.7.0
Severity Score:
Medium
CVE:
2026-1906
The vulnerability has been patched, so you should update to version 5.7.0.

Advanced Ads – Ad Manager & AdSense

Plugin:
Advanced Ads – Ad Manager & AdSense
Plugin Slug:
advanced-ads
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.0.15
Severity Score:
Medium
CVE:
2025-12884
The vulnerability has been patched, so you should update to version 2.0.15.

Advanced Custom Fields: Font Awesome Field

Plugin:
Advanced Custom Fields: Font Awesome Field
Plugin Slug:
advanced-custom-fields-font-awesome
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.0.2
Severity Score:
Medium
CVE:
2025-14983
The vulnerability has been patched, so you should update to version 5.0.2.

Aruba HiSpeed Cache

Plugin:
Aruba HiSpeed Cache
Plugin Slug:
aruba-hispeed-cache
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.0.3
Severity Score:
Medium
CVE:
2025-11725
The vulnerability has been patched, so you should update to version 3.0.3.

Aruba HiSpeed Cache

Plugin:
Aruba HiSpeed Cache
Plugin Slug:
aruba-hispeed-cache
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.3
Severity Score:
High
CVE:
2025-11706
The vulnerability has been patched, so you should update to version 3.0.3.

Aruba HiSpeed Cache

Plugin:
Aruba HiSpeed Cache
Plugin Slug:
aruba-hispeed-cache
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.0.5
Severity Score:
Medium
CVE:
2026-23545
The vulnerability has been patched, so you should update to version 3.0.5.

Backup Migration

Plugin:
Backup Migration
Plugin Slug:
backup-backup
Installations
100,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
1.4.0
Severity Score:
High
CVE:
2023-7002
The vulnerability has been patched, so you should update to version 1.4.0.

Download Manager

Plugin:
Download Manager
Plugin Slug:
download-manager
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.3.47
Severity Score:
High
CVE:
2026-1666
The vulnerability has been patched, so you should update to version 3.3.47.

Brevo – Email, SMS, Web Push, Chat, and more.

Plugin:
Brevo – Email, SMS, Web Push, Chat, and more.
Plugin Slug:
mailin
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.3.1
Severity Score:
Medium
CVE:
2025-14799
The vulnerability has been patched, so you should update to version 3.3.1.

VK All in One Expansion Unit

Plugin:
VK All in One Expansion Unit
Plugin Slug:
vk-all-in-one-expansion-unit
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
9.112.4
Severity Score:
Medium
CVE:
2025-11737
The vulnerability has been patched, so you should update to version 9.112.4.

Razorpay for WooCommerce

Plugin:
Razorpay for WooCommerce
Plugin Slug:
woo-razorpay
Installations
90,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.7.9
Severity Score:
Medium
CVE:
2025-14294
The vulnerability has been patched, so you should update to version 4.7.9.

Checkout Field Manager (Checkout Manager) for WooCommerce

Plugin:
Checkout Field Manager (Checkout Manager) for WooCommerce
Plugin Slug:
woocommerce-checkout-manager
Installations
90,000+
Vulnerability:
Arbitrary Content Deletion
Patched in Version:
7.8.6
Severity Score:
High
CVE:
2025-13930
The vulnerability has been patched, so you should update to version 7.8.6.

Checkout Field Manager (Checkout Manager) for WooCommerce

Plugin:
Checkout Field Manager (Checkout Manager) for WooCommerce
Plugin Slug:
woocommerce-checkout-manager
Installations
90,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
7.8.2
Severity Score:
Medium
CVE:
2025-12500
The vulnerability has been patched, so you should update to version 7.8.2.

Customer Reviews for WooCommerce

Plugin:
Customer Reviews for WooCommerce
Plugin Slug:
customer-reviews-woocommerce
Installations
80,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.98.0
Severity Score:
High
CVE:
2026-1316
The vulnerability has been patched, so you should update to version 5.98.0.

StatCounter – Free Real Time Visitor Stats

Plugin:
StatCounter – Free Real Time Visitor Stats
Plugin Slug:
official-statcounter-plugin-for-wordpress
Installations
70,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.1
Severity Score:
Medium
CVE:
2025-13048
The vulnerability has been patched, so you should update to version 2.1.1.

Mailchimp List Subscribe Form

Plugin:
Mailchimp List Subscribe Form
Plugin Slug:
mailchimp
Installations
60,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.0.1
Severity Score:
Medium
CVE:
2025-12172
The vulnerability has been patched, so you should update to version 2.0.1.

Mesmerize Companion

Plugin:
Mesmerize Companion
Plugin Slug:
mesmerize-companion
Installations
60,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.6.162
Severity Score:
Medium
CVE:
2025-12027
The vulnerability has been patched, so you should update to version 1.6.162.

ACF Photo Gallery Field

Plugin:
ACF Photo Gallery Field
Plugin Slug:
navz-photo-gallery
Installations
60,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.1
Severity Score:
Medium
CVE:
2025-12081
The vulnerability has been patched, so you should update to version 3.1.

Zarinpal Gateway

Plugin:
Zarinpal Gateway
Plugin Slug:
zarinpal-woocommerce-payment-gateway
Installations
60,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.0.17
Severity Score:
High
CVE:
2026-2592
The vulnerability has been patched, so you should update to version 5.0.17.

Auto Featured Image (Auto Post Thumbnail)

Plugin:
Auto Featured Image (Auto Post Thumbnail)
Plugin Slug:
auto-post-thumbnail
Installations
50,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
4.2.0
Severity Score:
Medium
CVE:
2023-7073
The vulnerability has been patched, so you should update to version 4.2.0.

Blog2Social: Social Media Auto Post & Scheduler

Plugin:
Blog2Social: Social Media Auto Post & Scheduler
Plugin Slug:
blog2social
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
8.7.5
Severity Score:
Medium
CVE:
2026-1942
The vulnerability has been patched, so you should update to version 8.7.5.

Booking Calendar

Plugin:
Booking Calendar
Plugin Slug:
booking
Installations
50,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
10.14.15
Severity Score:
Medium
CVE:
2026-2230
The vulnerability has been patched, so you should update to version 10.14.15.

Printful Integration for WooCommerce

Plugin:
Printful Integration for WooCommerce
Plugin Slug:
printful-shipping-for-woocommerce
Installations
50,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
2.2.12
Severity Score:
Medium
CVE:
2025-12375
The vulnerability has been patched, so you should update to version 2.2.12.

Advanced AJAX Product Filters

Plugin:
Advanced AJAX Product Filters
Plugin Slug:
woocommerce-ajax-filters
Installations
50,000+
Vulnerability:
PHP Object Injection
Patched in Version:
3.1.9.7
Severity Score:
High
CVE:
2026-1426
The vulnerability has been patched, so you should update to version 3.1.9.7.

Super Page Cache

Plugin:
Super Page Cache
Plugin Slug:
wp-cloudflare-page-cache
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.2.3
Severity Score:
High
CVE:
2026-1843
The vulnerability has been patched, so you should update to version 5.2.3.

WP-Members Membership Plugin

Plugin:
WP-Members Membership Plugin
Plugin Slug:
wp-members
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.4.9
Severity Score:
Medium
CVE:
2023-6733
The vulnerability has been patched, so you should update to version 3.4.9.

YayMail – WooCommerce Email Customizer

Plugin:
YayMail – WooCommerce Email Customizer
Plugin Slug:
yaymail
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.3.3
Severity Score:
Low
CVE:
2026-1938
The vulnerability has been patched, so you should update to version 4.3.3.

YayMail – WooCommerce Email Customizer

Plugin:
YayMail – WooCommerce Email Customizer
Plugin Slug:
yaymail
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.3.3
Severity Score:
Low
CVE:
2026-1831
The vulnerability has been patched, so you should update to version 4.3.3.

YayMail – WooCommerce Email Customizer

Plugin:
YayMail – WooCommerce Email Customizer
Plugin Slug:
yaymail
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.3.3
Severity Score:
Medium
CVE:
2026-1943
The vulnerability has been patched, so you should update to version 4.3.3.

YayMail – WooCommerce Email Customizer

Plugin:
YayMail – WooCommerce Email Customizer
Plugin Slug:
yaymail
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.3.3
Severity Score:
High
CVE:
2026-1937
The vulnerability has been patched, so you should update to version 4.3.3.

Calculated Fields Form

Plugin:
Calculated Fields Form
Plugin Slug:
calculated-fields-form
Installations
40,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.4.4.2
Severity Score:
Medium
CVE:
2026-25368
The vulnerability has been patched, so you should update to version 5.4.4.2.

Easy SVG Support

Plugin:
Easy SVG Support
Plugin Slug:
easy-svg
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.1
Severity Score:
Medium
CVE:
2025-12451
The vulnerability has been patched, so you should update to version 4.1.

OneClick Chat to Order

Plugin:
OneClick Chat to Order
Plugin Slug:
oneclick-whatsapp-order
Installations
40,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.1.0
Severity Score:
Low
CVE:
2025-14270
The vulnerability has been patched, so you should update to version 1.1.0.

Simple Membership

Plugin:
Simple Membership
Plugin Slug:
simple-membership
Installations
40,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.7.1
Severity Score:
Medium
CVE:
2026-1461
The vulnerability has been patched, so you should update to version 4.7.1.

Image Hotspot by DevVN

Plugin:
Image Hotspot by DevVN
Plugin Slug:
devvn-image-hotspot
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.0
Severity Score:
Medium
CVE:
2025-14445
The vulnerability has been patched, so you should update to version 1.3.0.

SEO Plugin by Squirrly SEO

Plugin:
SEO Plugin by Squirrly SEO
Plugin Slug:
squirrly-seo
Installations
30,000+
Vulnerability:
Broken Access Control
Patched in Version:
12.4.15
Severity Score:
Medium
CVE:
2025-14342
The vulnerability has been patched, so you should update to version 12.4.15.

WP 404 Auto Redirect to Similar Post

Plugin:
WP 404 Auto Redirect to Similar Post
Plugin Slug:
wp-404-auto-redirect-to-similar-post
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.6
Severity Score:
Medium
CVE:
2025-12037
The vulnerability has been patched, so you should update to version 1.0.6.

Apollo13 Framework Extensions

Plugin:
Apollo13 Framework Extensions
Plugin Slug:
apollo13-framework-extensions
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.9.9
Severity Score:
Medium
CVE:
2025-13617
The vulnerability has been patched, so you should update to version 1.9.9.

Image Photo Gallery Final Tiles Grid

Plugin:
Image Photo Gallery Final Tiles Grid
Plugin Slug:
final-tiles-grid-gallery-lite
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.6.11
Severity Score:
Medium
CVE:
2026-25375
The vulnerability has been patched, so you should update to version 3.6.11.

Kali Forms — Contact Form & Drag-and-Drop Builder

Plugin:
Kali Forms — Contact Form & Drag-and-Drop Builder
Plugin Slug:
kali-forms
Installations
20,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.4.9
Severity Score:
Medium
CVE:
2026-1860
The vulnerability has been patched, so you should update to version 2.4.9.

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar

Plugin:
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Plugin Slug:
mp3-music-player-by-sonaar
Installations
20,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
5.11
Severity Score:
Medium
CVE:
2026-1219
The vulnerability has been patched, so you should update to version 5.11.

Quiz Maker

Plugin:
Quiz Maker
Plugin Slug:
quiz-maker
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.7.1.8
Severity Score:
Medium
CVE:
2026-2384
The vulnerability has been patched, so you should update to version 6.7.1.8.

Secure Copy Content Protection and Content Locking

Plugin:
Secure Copy Content Protection and Content Locking
Plugin Slug:
secure-copy-content-protection
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.9.9
Severity Score:
High
CVE:
2026-1320
The vulnerability has been patched, so you should update to version 4.9.9.

Smartsupp – live chat, AI shopping assistant and chatbots

Plugin:
Smartsupp – live chat, AI shopping assistant and chatbots
Plugin Slug:
smartsupp-live-chat
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.9.2
Severity Score:
Medium
CVE:
2025-12448
The vulnerability has been patched, so you should update to version 3.9.2.

Video Conferencing with Zoom

Plugin:
Video Conferencing with Zoom
Plugin Slug:
video-conferencing-with-zoom-api
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.6.6
Severity Score:
High
CVE:
2026-1368
The vulnerability has been patched, so you should update to version 4.6.6.

WP Customer Reviews

Plugin:
WP Customer Reviews
Plugin Slug:
wp-customer-reviews
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.7.6
Severity Score:
High
CVE:
2025-14452
The vulnerability has been patched, so you should update to version 3.7.6.

WP Import – Ultimate CSV XML Importer for WordPress

Plugin:
WP Import – Ultimate CSV XML Importer for WordPress
Plugin Slug:
wp-ultimate-csv-importer
Installations
20,000+
Vulnerability:
SQL Injection
Patched in Version:
7.38
Severity Score:
High
CVE:
2026-1317
The vulnerability has been patched, so you should update to version 7.38.

wpForo Forum

Plugin:
wpForo Forum
Plugin Slug:
wpforo
Installations
20,000+
Vulnerability:
SQL Injection
Patched in Version:
2.4.15
Severity Score:
Critical
CVE:
2026-1581
The vulnerability has been patched, so you should update to version 2.4.15.

wpForo Forum

Plugin:
wpForo Forum
Plugin Slug:
wpforo
Installations
20,000+
Vulnerability:
PHP Object Injection
Patched in Version:
2.4.14
Severity Score:
High
CVE:
2026-0910
The vulnerability has been patched, so you should update to version 2.4.14.

Web Accessibility by accessiBe

Plugin:
Web Accessibility by accessiBe
Plugin Slug:
accessibe
Installations
10,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.12
Severity Score:
Medium
CVE:
2025-13113
The vulnerability has been patched, so you should update to version 2.12.

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent

Plugin:
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent
Plugin Slug:
gdpr-cookie-consent
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.1.3
Severity Score:
High
CVE:
2025-11754
The vulnerability has been patched, so you should update to version 4.1.3.

Groups

Plugin:
Groups
Plugin Slug:
groups
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.11.0
Severity Score:
Medium
CVE:
2026-0549
The vulnerability has been patched, so you should update to version 3.11.0.

Open User Map

Plugin:
Open User Map
Plugin Slug:
open-user-map
Installations
10,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
1.4.17
Severity Score:
Medium
CVE:
2025-68002
The vulnerability has been patched, so you should update to version 1.4.17.

Membership Plugin – Restrict Content

Plugin:
Membership Plugin – Restrict Content
Plugin Slug:
restrict-content
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.19
Severity Score:
Medium
CVE:
2026-1304
The vulnerability has been patched, so you should update to version 3.2.19.

Two Factor (2FA) Authentication via Email

Plugin:
Two Factor (2FA) Authentication via Email
Plugin Slug:
two-factor-2fa-via-email
Installations
10,000+
Vulnerability:
Broken Authentication
Patched in Version:
1.9.9
Severity Score:
Medium
CVE:
2025-13587
The vulnerability has been patched, so you should update to version 1.9.9.

URL Shortify – Simple and Easy URL Shortener

Plugin:
URL Shortify – Simple and Easy URL Shortener
Plugin Slug:
url-shortify
Installations
10,000+
Vulnerability:
Open Redirection
Patched in Version:
1.12.2
Severity Score:
Medium
CVE:
2026-1277
The vulnerability has been patched, so you should update to version 1.12.2.

URL Shortify – Simple and Easy URL Shortener

Plugin:
URL Shortify – Simple and Easy URL Shortener
Plugin Slug:
url-shortify
Installations
10,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
1.12.4
Severity Score:
Medium
CVE:
2026-25385
The vulnerability has been patched, so you should update to version 1.12.4.

Product Table and List Builder for WooCommerce Lite

Plugin:
Product Table and List Builder for WooCommerce Lite
Plugin Slug:
wc-product-table-lite
Installations
10,000+
Vulnerability:
SQL Injection
Patched in Version:
4.6.3
Severity Score:
Critical
CVE:
2026-2232
The vulnerability has been patched, so you should update to version 4.6.3.

WP Compress – Instant Performance & Speed Optimization

Plugin:
WP Compress – Instant Performance & Speed Optimization
Plugin Slug:
wp-compress-image-optimizer
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
6.60.29
Severity Score:
Medium
CVE:
2026-25370
The vulnerability has been patched, so you should update to version 6.60.29.

YaMaps for WordPress Plugin

Plugin:
YaMaps for WordPress Plugin
Plugin Slug:
yamaps
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.6.41
Severity Score:
Medium
CVE:
2025-14851
The vulnerability has been patched, so you should update to version 0.6.41.

Album and Image Gallery Plus Lightbox

Plugin:
Album and Image Gallery Plus Lightbox
Plugin Slug:
album-and-image-gallery-plus-lightbox
Installations
9,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.8
Severity Score:
Medium
CVE:
2025-13612
The vulnerability has been patched, so you should update to version 2.1.8.

EventPrime – Events Calendar, Bookings and Tickets

Plugin:
EventPrime – Events Calendar, Bookings and Tickets
Plugin Slug:
eventprime-event-calendar-management
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.2.8.5
Severity Score:
Medium
CVE:
2026-1655
The vulnerability has been patched, so you should update to version 4.2.8.5.

EventPrime – Events Calendar, Bookings and Tickets

Plugin:
EventPrime – Events Calendar, Bookings and Tickets
Plugin Slug:
eventprime-event-calendar-management
Installations
7,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
4.2.8.4
Severity Score:
Medium
CVE:
2026-25389
The vulnerability has been patched, so you should update to version 4.2.8.4.

EventPrime – Events Calendar, Bookings and Tickets

Plugin:
EventPrime – Events Calendar, Bookings and Tickets
Plugin Slug:
eventprime-event-calendar-management
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.2.8.5
Severity Score:
Medium
CVE:
2026-1657
The vulnerability has been patched, so you should update to version 4.2.8.5.

Event Booking Manager for WooCommerce

Plugin:
Event Booking Manager for WooCommerce
Plugin Slug:
mage-eventpress
Installations
7,000+
Vulnerability:
PHP Object Injection
Patched in Version:
5.1.2
Severity Score:
Critical
CVE:
2026-23549
The vulnerability has been patched, so you should update to version 5.1.2.

Cart All In One For WooCommerce

Plugin:
Cart All In One For WooCommerce
Plugin Slug:
woo-cart-all-in-one
Installations
6,000+
Vulnerability:
Content Injection
Patched in Version:
1.1.22
Severity Score:
High
CVE:
2026-2019
The vulnerability has been patched, so you should update to version 1.1.22.

Popup Box – Easily Create WordPress Popups

Plugin:
Popup Box – Easily Create WordPress Popups
Plugin Slug:
popup-box
Installations
5,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.13
Severity Score:
Medium
CVE:
2025-12122
The vulnerability has been patched, so you should update to version 3.2.13.

Import Eventbrite Events

Plugin:
Import Eventbrite Events
Plugin Slug:
import-eventbrite-events
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.5
Severity Score:
High
CVE:
2024-12422
The vulnerability has been patched, so you should update to version 1.7.5.

Paytium: Mollie payment forms & donations

Plugin:
Paytium: Mollie payment forms & donations
Plugin Slug:
paytium
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4
Severity Score:
Medium
CVE:
2023-7287
The vulnerability has been patched, so you should update to version 4.4.

Paytium: Mollie payment forms & donations

Plugin:
Paytium: Mollie payment forms & donations
Plugin Slug:
paytium
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4
Severity Score:
Medium
CVE:
2023-7288
The vulnerability has been patched, so you should update to version 4.4.

Paytium: Mollie payment forms & donations

Plugin:
Paytium: Mollie payment forms & donations
Plugin Slug:
paytium
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4
Severity Score:
Medium
CVE:
2023-7289
The vulnerability has been patched, so you should update to version 4.4.

Paytium: Mollie payment forms & donations

Plugin:
Paytium: Mollie payment forms & donations
Plugin Slug:
paytium
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4
Severity Score:
Medium
CVE:
2023-7290
The vulnerability has been patched, so you should update to version 4.4.

Paytium: Mollie payment forms & donations

Plugin:
Paytium: Mollie payment forms & donations
Plugin Slug:
paytium
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4
Severity Score:
High
CVE:
2023-7291
The vulnerability has been patched, so you should update to version 4.4.

Paytium: Mollie payment forms & donations

Plugin:
Paytium: Mollie payment forms & donations
Plugin Slug:
paytium
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4
Severity Score:
Medium
CVE:
2023-7292
The vulnerability has been patched, so you should update to version 4.4.

Paytium: Mollie payment forms & donations

Plugin:
Paytium: Mollie payment forms & donations
Plugin Slug:
paytium
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4
Severity Score:
Medium
CVE:
2023-7293
The vulnerability has been patched, so you should update to version 4.4.

Paytium: Mollie payment forms & donations

Plugin:
Paytium: Mollie payment forms & donations
Plugin Slug:
paytium
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4
Severity Score:
High
CVE:
2023-7294
The vulnerability has been patched, so you should update to version 4.4.

Tickera – Sell Tickets & Manage Events

Plugin:
Tickera – Sell Tickets & Manage Events
Plugin Slug:
tickera-event-ticketing-system
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.5.6.5
Severity Score:
Medium
CVE:
2025-12356
The vulnerability has been patched, so you should update to version 3.5.6.5.

WP-DownloadManager

Plugin:
WP-DownloadManager
Plugin Slug:
wp-downloadmanager
Installations
3,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.69.1
Severity Score:
Medium
CVE:
2026-2426
The vulnerability has been patched, so you should update to version 1.69.1.

WP-DownloadManager

Plugin:
WP-DownloadManager
Plugin Slug:
wp-downloadmanager
Installations
3,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
1.69.1
Severity Score:
Low
CVE:
2026-2419
The vulnerability has been patched, so you should update to version 1.69.1.

IMGspider – ????????

Plugin:
IMGspider – ????????
Plugin Slug:
imgspider
Installations
2,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.3.11
Severity Score:
Critical
CVE:
2024-6318
The vulnerability has been patched, so you should update to version 2.3.11.

Simple Ajax Chat – Add a Fast, Secure Chat Box

Plugin:
Simple Ajax Chat – Add a Fast, Secure Chat Box
Plugin Slug:
simple-ajax-chat
Installations
2,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
20260217
Severity Score:
Medium
CVE:
2026-3075
The vulnerability has been patched, so you should update to version 20260217.

Virusdie – One-click website security

Plugin:
Virusdie – One-click website security
Plugin Slug:
virusdie
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.1.8
Severity Score:
Medium
CVE:
2025-14864
The vulnerability has been patched, so you should update to version 1.1.8.

WP-Lister Lite for eBay

Plugin:
WP-Lister Lite for eBay
Plugin Slug:
wp-lister-for-ebay
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.8.6
Severity Score:
Medium
CVE:
2026-25384
The vulnerability has been patched, so you should update to version 3.8.6.

WowRevenue – Product Bundles & Bulk Discounts

Plugin:
WowRevenue – Product Bundles & Bulk Discounts
Plugin Slug:
revenue
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.1.4
Severity Score:
High
CVE:
2026-2001
The vulnerability has been patched, so you should update to version 2.1.4.

Taskbuilder – Project & Task Management with Kanban

Plugin:
Taskbuilder – Project & Task Management with Kanban
Plugin Slug:
taskbuilder
Installations
800+
Vulnerability:
Broken Access Control
Patched in Version:
5.0.3
Severity Score:
Medium
CVE:
2026-1640
The vulnerability has been patched, so you should update to version 5.0.3.

Dam Spam

Plugin:
Dam Spam
Plugin Slug:
dam-spam
Installations
700+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.9
Severity Score:
Medium
CVE:
2026-2112
The vulnerability has been patched, so you should update to version 1.0.9.

My Tickets – Accessible Event Ticketing

Plugin:
My Tickets – Accessible Event Ticketing
Plugin Slug:
my-tickets
Installations
700+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.1.1
Severity Score:
High
CVE:
2026-27406
The vulnerability has been patched, so you should update to version 2.1.1.

WP Plugin Info Card

Plugin:
WP Plugin Info Card
Plugin Slug:
wp-plugin-info-card
Installations
600+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
6.3.0
Severity Score:
Medium
CVE:
2026-2023
The vulnerability has been patched, so you should update to version 6.3.0.

Build App Online

Plugin:
Build App Online
Plugin Slug:
build-app-online
Installations
500+
Vulnerability:
Privilege Escalation
Patched in Version:
1.0.23
Severity Score:
High
CVE:
2023-7264
The vulnerability has been patched, so you should update to version 1.0.23.

Library Management System

Plugin:
Library Management System
Plugin Slug:
library-management-system
Installations
300+
Vulnerability:
SQL Injection
Patched in Version:
3.3
Severity Score:
Critical
CVE:
2025-12707
The vulnerability has been patched, so you should update to version 3.3.

Order Splitter for WooCommerce

Plugin:
Order Splitter for WooCommerce
Plugin Slug:
woo-order-splitter
Installations
300+
Vulnerability:
Broken Access Control
Patched in Version:
5.3.6
Severity Score:
Medium
CVE:
2025-12075
The vulnerability has been patched, so you should update to version 5.3.6.

Bookster – WordPress Appointment Booking Plugin

Plugin:
Bookster – WordPress Appointment Booking Plugin
Plugin Slug:
bookster
Installations
200+
Vulnerability:
SQL Injection
Patched in Version:
2.2.0
Severity Score:
High
CVE:
2025-8781
The vulnerability has been patched, so you should update to version 2.2.0.

Display During Conditional Shortcode

Plugin:
Display During Conditional Shortcode
Plugin Slug:
display-during-conditional-shortcode
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3
Severity Score:
Medium
CVE:
2025-6460
The vulnerability has been patched, so you should update to version 1.3.

Video Share VOD – Turnkey Video Site Builder Script

Plugin:
Video Share VOD – Turnkey Video Site Builder Script
Plugin Slug:
video-share-vod
Installations
80+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.7.12
Severity Score:
Medium
CVE:
2025-13727
The vulnerability has been patched, so you should update to version 2.7.12.

Private Comment

Plugin:
Private Comment
Plugin Slug:
private-comment
Installations
60+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.0.5
Severity Score:
Medium
CVE:
2026-2281
The vulnerability has been patched, so you should update to version 0.0.5.

Frontend User Notes

Plugin:
Frontend User Notes
Plugin Slug:
frontend-user-notes
Installations
50+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
2.1.1
Severity Score:
Medium
CVE:
2025-12071
The vulnerability has been patched, so you should update to version 2.1.1.

Activity Log for WordPress

Plugin:
Activity Log for WordPress
Plugin Slug:
winterlock
Installations
50+
Vulnerability:
Broken Access Control
Patched in Version:
1.2.9
Severity Score:
Medium
CVE:
2026-1671
The vulnerability has been patched, so you should update to version 1.2.9.

Community Events

Plugin:
Community Events
Plugin Slug:
community-events
Installations
30+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.8
Severity Score:
Medium
CVE:
2026-1649
The vulnerability has been patched, so you should update to version 1.5.8.

Keybase.io Verification

Plugin:
Keybase.io Verification
Plugin Slug:
wp-keybase-verification
Installations
30+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.4.6
Severity Score:
Medium
CVE:
2026-1072
The vulnerability has been patched, so you should update to version 1.4.6.

InteractiveCalculator for WordPress

Plugin:
InteractiveCalculator for WordPress
Plugin Slug:
interactivecalculator
Installations
20+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.4
Severity Score:
Medium
CVE:
2026-1807
The vulnerability has been patched, so you should update to version 1.0.4.

Rent Fetch

Plugin:
Rent Fetch
Plugin Slug:
rentfetch
Installations
20+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.32.7
Severity Score:
High
CVE:
2026-1931
The vulnerability has been patched, so you should update to version 0.32.7.

Ads Pro

Plugin:
Ads Pro
Plugin Slug:
ap-plugin-scripteo
Vulnerability:
Broken Access Control
Patched in Version:
5.1
Severity Score:
Medium
CVE:
2026-25388
The vulnerability has been patched, so you should update to version 5.1.

ARForms Form Builder

Plugin:
ARForms Form Builder
Plugin Slug:
arforms-form-builder
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.9
Severity Score:
High
CVE:
2023-6828
The vulnerability has been patched, so you should update to version 1.5.9.

Lizza LMS Pro

Plugin:
Lizza LMS Pro
Plugin Slug:
lizza-lms-pro
Vulnerability:
Privilege Escalation
Patched in Version:
1.0.4
Severity Score:
Critical
CVE:
2025-13563
The vulnerability has been patched, so you should update to version 1.0.4.

tagDiv Composer

Plugin:
tagDiv Composer
Plugin Slug:
td-composer
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.1
Severity Score:
High
CVE:
2024-5212
The vulnerability has been patched, so you should update to version 5.1.

Truelysell Core

Plugin:
Truelysell Core
Plugin Slug:
truelysell-core
Vulnerability:
Privilege Escalation
Patched in Version:
1.8.8
Severity Score:
Critical
CVE:
2025-8572
The vulnerability has been patched, so you should update to version 1.8.8.

Uni CPO (Premium)

Plugin:
Uni CPO (Premium)
Plugin Slug:
uni-woo-custom-product-options-premium
Vulnerability:
Broken Access Control
Patched in Version:
4.9.61
Severity Score:
Medium
CVE:
2025-13391
The vulnerability has been patched, so you should update to version 4.9.61.

Wolmart Core

Plugin:
Wolmart Core
Plugin Slug:
wolmart-core
Vulnerability:
SQL Injection
Patched in Version:
1.9.7
Severity Score:
Critical
CVE:
2025-69337
The vulnerability has been patched, so you should update to version 1.9.7.

WordPress Themes — 8 Patched / 31 Unpatched

Drift

Theme:
Drift
Theme Slug:
drift
Downloads
30,869
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-12116
The vulnerability has not been patched. You should switch themes.

Mega Store Woocommerce

Theme:
Mega Store Woocommerce
Theme Slug:
mega-store-woocommerce
Downloads
42,273
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14357
The vulnerability has not been patched. You should switch themes.

NewsBlogger

Theme:
NewsBlogger
Theme Slug:
newsblogger
Downloads
155,250
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-12821
The vulnerability has not been patched. You should switch themes.

Renden

Theme:
Renden
Theme Slug:
renden
Downloads
328,852
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-12117
The vulnerability has not been patched. You should switch themes.

A-Mart

Theme:
A-Mart
Theme Slug:
a-mart
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22361
The vulnerability has not been patched. You should switch themes.

Blabber

Theme:
Blabber
Theme Slug:
blabber
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22378
The vulnerability has not been patched. You should switch themes.

Buyent

Theme:
Buyent
Theme Slug:
buyent
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-13851
The vulnerability has not been patched. You should switch themes.

Coworking

Theme:
Coworking
Theme Slug:
coworking
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22367
The vulnerability has not been patched. You should switch themes.

Dentario

Theme:
Dentario
Theme Slug:
dentario
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27439
The vulnerability has not been patched. You should switch themes.

Fooddy

Theme:
Fooddy
Theme Slug:
fooddy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22373
The vulnerability has not been patched. You should switch themes.

Gustavo

Theme:
Gustavo
Theme Slug:
gustavo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22371
The vulnerability has not been patched. You should switch themes.

Impacto Patronus

Theme:
Impacto Patronus
Theme Slug:
impacto-patronus
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22375
The vulnerability has not been patched. You should switch themes.

Ironfit

Theme:
Ironfit
Theme Slug:
ironfit
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22369
The vulnerability has not been patched. You should switch themes.

Isida

Theme:
Isida
Theme Slug:
isida
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22372
The vulnerability has not been patched. You should switch themes.

Jude

Theme:
Jude
Theme Slug:
jude
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22366
The vulnerability has not been patched. You should switch themes.

Kingler

Theme:
Kingler
Theme Slug:
kingler
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27438
The vulnerability has not been patched. You should switch themes.

Marveland

Theme:
Marveland
Theme Slug:
marveland
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22370
The vulnerability has not been patched. You should switch themes.

Netmix

Theme:
Netmix
Theme Slug:
netmix
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22379
The vulnerability has not been patched. You should switch themes.

Parkivia

Theme:
Parkivia
Theme Slug:
parkivia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22376
The vulnerability has not been patched. You should switch themes.

PawFriends – Pet Shop and Veterinary WordPress Theme

Theme:
PawFriends – Pet Shop and Veterinary WordPress Theme
Theme Slug:
pawfriends
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22383
The vulnerability has not been patched. You should switch themes.

PawFriends – Pet Shop and Veterinary WordPress Theme

Theme:
PawFriends – Pet Shop and Veterinary WordPress Theme
Theme Slug:
pawfriends
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22381
The vulnerability has not been patched. You should switch themes.

Photolia

Theme:
Photolia
Theme Slug:
photolia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22362
The vulnerability has not been patched. You should switch themes.

Redy

Theme:
Redy
Theme Slug:
redy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22368
The vulnerability has not been patched. You should switch themes.

Rhodos

Theme:
Rhodos
Theme Slug:
rhodos
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22363
The vulnerability has not been patched. You should switch themes.

Saveo

Theme:
Saveo
Theme Slug:
saveo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22377
The vulnerability has not been patched. You should switch themes.

SevenTrees

Theme:
SevenTrees
Theme Slug:
seventrees
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22364
The vulnerability has not been patched. You should switch themes.

Soleng

Theme:
Soleng
Theme Slug:
soleng
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22365
The vulnerability has not been patched. You should switch themes.

Tennis Club

Theme:
Tennis Club
Theme Slug:
tennis-sportclub
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27437
The vulnerability has not been patched. You should switch themes.

UnlimHost

Theme:
UnlimHost
Theme Slug:
unlimhost
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22380
The vulnerability has not been patched. You should switch themes.

Valenti

Theme:
Valenti
Theme Slug:
valenti
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-23544
The vulnerability has not been patched. You should switch themes.

Zio Alberto

Theme:
Zio Alberto
Theme Slug:
zioalberto
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22374
The vulnerability has not been patched. You should switch themes.

Context Blog

Theme:
Context Blog
Theme Slug:
context-blog
Downloads
84,231
Vulnerability:
Sensitive Data Exposure
Patched in Version:
1.2.6
Severity Score:
Medium
CVE:
2025-12074
The vulnerability has been patched, so you should update to version 1.2.6.

Shopire

Theme:
Shopire
Theme Slug:
shopire
Downloads
89,293
Vulnerability:
Broken Access Control
Patched in Version:
1.0.58
Severity Score:
Medium
CVE:
2025-13091
The vulnerability has been patched, so you should update to version 1.0.58.

Spa and Salon

Theme:
Spa and Salon
Theme Slug:
spa-and-salon
Downloads
165,530
Vulnerability:
Broken Access Control
Patched in Version:
1.3.3
Severity Score:
Medium
CVE:
2026-25374
The vulnerability has been patched, so you should update to version 1.3.3.

Grand Restaurant

Theme:
Grand Restaurant
Theme Slug:
grandrestaurant
Vulnerability:
PHP Object Injection
Patched in Version:
7.0.11
Severity Score:
Critical
CVE:
2026-23542
The vulnerability has been patched, so you should update to version 7.0.11.

Ippsum

Theme:
Ippsum
Theme Slug:
ippsum
Vulnerability:
PHP Object Injection
Patched in Version:
1.2.1
Severity Score:
Critical
CVE:
2025-68541
The vulnerability has been patched, so you should update to version 1.2.1.

CitiLights

Theme:
CitiLights
Theme Slug:
noo-citilights
Vulnerability:
Broken Access Control
Patched in Version:
3.7.2
Severity Score:
Medium
CVE:
2026-25367
The vulnerability has been patched, so you should update to version 3.7.2.

Sweet Date

Theme:
Sweet Date
Theme Slug:
sweetdate
Vulnerability:
PHP Object Injection
Patched in Version:
4.0.1
Severity Score:
Critical
CVE:
2026-27417
The vulnerability has been patched, so you should update to version 4.0.1.

Wiguard

Theme:
Wiguard
Theme Slug:
wiguard
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.0.1
Severity Score:
Critical
CVE:
2025-68549
The vulnerability has been patched, so you should update to version 2.0.1.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — February 25, 2026 appeared first on SolidWP.

]]>