https://wpsec.com/vuln/ Security advisories for WordPress plugins, published by WPSec. en WPSec. Licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Credit WPSec and link to the advisory, or to https://wpsec.com/vuln/ for the whole dataset. 60 Fri, 23 Oct 2026 01:41:18 +0000 https://wpsec.com/images/socialpic.png https://wpsec.com/vuln/ https://wpsec.com/vuln/WPSEC-2026-1481/ https://wpsec.com/vuln/WPSEC-2026-1481/ Fri, 23 Oct 2026 01:41:18 +0000 WPSec XSSCWE-79 powerpack-lite-for-elementor The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the item image URL of the Info Box Carousel widget in all versions up to, and including, 3.1.1, due to insufficient output escaping of the image URL in the widget's Elementor editor template, where it is printed unescaped inside the img src attribute. Affected: all versions before 3.1.2. Fixed in 3.1.2. Severity: Medium 6.4. https://wpsec.com/vuln/WPSEC-2026-1480/ https://wpsec.com/vuln/WPSEC-2026-1480/ Fri, 23 Oct 2026 01:41:18 +0000 WPSec SENSITIVE DATA DISCLOSURECWE-200 powerpack-lite-for-elementor The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Sensitive Information Exposure via the Posts, Content Ticker and Marquee widgets in all versions up to, and including, 3.1.1. Affected: all versions before 3.1.2. Fixed in 3.1.2. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1479/ https://wpsec.com/vuln/WPSEC-2026-1479/ Fri, 23 Oct 2026 00:41:49 +0000 WPSec XSSCWE-79 qa-heatmap-analytics The QA Assistants – Driven by data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event_ary' parameter of the public behavioral tracking endpoint in all versions up to, and including, 5.3.0.1, due to insufficient input validation of submitted event rows and insufficient output escaping when the recorded event data is embedded in a single-quoted JavaScript string on the… Affected: all versions before 5.3.0.2. Fixed in 5.3.0.2. Severity: High 7.2. https://wpsec.com/vuln/WPSEC-2026-1478/ https://wpsec.com/vuln/WPSEC-2026-1478/ Thu, 22 Oct 2026 22:43:14 +0000 WPSec IDORCWE-639 co-authors-plus The Co-Authors Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference via the coauthors/v1 REST endpoints for reading and updating a post's co-authors and via the bulk edit co-author handler in versions 3.5 up to, and including, 4.1.1. Affected: from 3.5 before 4.1.2. Fixed in 4.1.2. Severity: Low 3.8. https://wpsec.com/vuln/WPSEC-2026-1477/ https://wpsec.com/vuln/WPSEC-2026-1477/ Thu, 22 Oct 2026 22:43:14 +0000 WPSec SSRFCWE-918 overlay-image-divi-module The Overlay Image Divi Module plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'src' (image URL) attribute of the Overlay Image module in all versions up to, and including, 1.5.1, due to the module's render function passing the user-supplied image URL to getimagesize() without validation whenever allow_url_fopen is enabled. Affected: all versions before 1.5.3. Fixed in 1.5.3. Severity: Medium 6.4. https://wpsec.com/vuln/WPSEC-2026-1476/ https://wpsec.com/vuln/WPSEC-2026-1476/ Thu, 22 Oct 2026 20:45:31 +0000 WPSec BYPASSCWE-345 sunshine-photo-cart The Sunshine Photo Cart plugin for WordPress is vulnerable to Payment Bypass via the Square payment method in all versions up to, and including, 3.7.5, due to the checkout trusting the 'square_payment_id' value submitted by the browser without confirming with Square that the payment exists, was completed, and matches the order's amount, currency and reference. Affected: all versions before 3.8. Fixed in 3.8. Severity: High 7.5. https://wpsec.com/vuln/WPSEC-2026-1475/ https://wpsec.com/vuln/WPSEC-2026-1475/ Thu, 22 Oct 2026 20:45:31 +0000 WPSec BYPASSCWE-345 sunshine-photo-cart The Sunshine Photo Cart plugin for WordPress is vulnerable to Payment Bypass via the PayPal (Legacy) IPN handler in all versions up to, and including, 3.7.5, due to the handler completing the order named in the 'custom' field of any PayPal-verified IPN without checking the receiving account, payment status, currency or amount. Affected: all versions before 3.8. Fixed in 3.8. Severity: High 7.5. https://wpsec.com/vuln/WPSEC-2026-1474/ https://wpsec.com/vuln/WPSEC-2026-1474/ Thu, 22 Oct 2026 20:45:31 +0000 WPSec IDORCWE-639 sunshine-photo-cart The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the Stripe hosted checkout and PayPal (Legacy) cancel handlers in all versions up to, and including, 3.7.5, due to the cancel nonce using one action for every order (and so being the same for all logged-out visitors) and the handlers not checking that the supplied order b… Affected: all versions before 3.8. Fixed in 3.8. Severity: Medium 6.5. https://wpsec.com/vuln/WPSEC-2026-1473/ https://wpsec.com/vuln/WPSEC-2026-1473/ Thu, 22 Oct 2026 19:48:10 +0000 WPSec OBJECT INJECTIONCWE-502 paytium The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to PHP Object Injection via the pt_form_field payment form parameters (checkbox fields and the pt-uploaded-files key) in all versions up to, and including, 5.0.5, due to deserialization of untrusted input with maybe_unserialize() without restricting allowed classes. Affected: all versions before 5.0.6. Fixed in 5.0.6. Severity: High 8.1. https://wpsec.com/vuln/WPSEC-2026-1472/ https://wpsec.com/vuln/WPSEC-2026-1472/ Thu, 22 Oct 2026 19:48:10 +0000 WPSec SSRFCWE-918 webmention The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery via the webmention endpoint's source URL in all versions up to, and including, 5.10.2. Affected: all versions before 5.11.0. Fixed in 5.11.0. Severity: Medium 5.4. https://wpsec.com/vuln/WPSEC-2026-1471/ https://wpsec.com/vuln/WPSEC-2026-1471/ Thu, 22 Oct 2026 19:48:10 +0000 WPSec AUTHBYPASSCWE-331 timetics The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to authorization bypass via the 'appointment_token' parameter of the /timetics/v1/bookings/{id} REST API endpoint in all versions up to, and including, 1.0.64, due to insufficient entropy in the per-booking security token generated by the generate_security_token() function. Affected: all versions before 1.0.65. Fixed in 1.0.65. Severity: Medium 5.6. https://wpsec.com/vuln/WPSEC-2026-1470/ https://wpsec.com/vuln/WPSEC-2026-1470/ Thu, 22 Oct 2026 16:48:21 +0000 WPSec NO AUTHORISATIONCWE-862 woocommerce-paypal-payments The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Missing Authorization via the PayPal return URL endpoint (wc-ajax=ppc-return-url) in all versions up to, and including, 4.1.3, due to the endpoint loading the PayPal order from the 'token' query parameter and running payment processing for the WooCommerce order named in its custom_id without checking that the request came from… Affected: all versions before 4.2.0. Fixed in 4.2.0. Severity: Medium 4.8. https://wpsec.com/vuln/WPSEC-2026-1469/ https://wpsec.com/vuln/WPSEC-2026-1469/ Thu, 22 Oct 2026 16:48:21 +0000 WPSec SENSITIVE DATA DISCLOSURECWE-200 page-and-post-restriction The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure via comment feeds and front-end comment lists in all versions up to, and including, 1.6.0. Affected: all versions before 1.6.1. Fixed in 1.6.1. Severity: Medium 5.3. https://wpsec.com/vuln/WPSEC-2026-1468/ https://wpsec.com/vuln/WPSEC-2026-1468/ Thu, 22 Oct 2026 16:48:21 +0000 WPSec AUTHBYPASSCWE-863 page-and-post-restriction The Page and Post Restriction plugin for WordPress is vulnerable to an access restriction bypass in all versions up to, and including, 1.6.0. Affected: all versions before 1.6.1. Fixed in 1.6.1. Severity: Low 3.7. https://wpsec.com/vuln/WPSEC-2026-1467/ https://wpsec.com/vuln/WPSEC-2026-1467/ Thu, 22 Oct 2026 16:48:21 +0000 WPSec SENSITIVE DATA DISCLOSURECWE-200 page-and-post-restriction The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure via the oEmbed endpoint in all versions up to, and including, 1.6.0. Affected: all versions before 1.6.1. Fixed in 1.6.1. Severity: Medium 5.3. https://wpsec.com/vuln/WPSEC-2026-1466/ https://wpsec.com/vuln/WPSEC-2026-1466/ Thu, 22 Oct 2026 16:48:21 +0000 WPSec AUTHBYPASSCWE-863 page-and-post-restriction The Page and Post Restriction plugin for WordPress is vulnerable to an access restriction bypass via the REST API in all versions up to, and including, 1.6.0. Affected: all versions before 1.6.1. Fixed in 1.6.1. Severity: Medium 5.3. https://wpsec.com/vuln/WPSEC-2026-1465/ https://wpsec.com/vuln/WPSEC-2026-1465/ Thu, 22 Oct 2026 16:48:21 +0000 WPSec NO AUTHORISATIONCWE-862 go-fetch-jobs-wp-job-manager The Go Fetch Jobs (for WP Job Manager) plugin for WordPress is vulnerable to unauthorized access via several AJAX actions (goft_wpjm_load_template_content, goft_wpjm_update_templates_list, goft_wpjm_load_provider_info, goft_wpjm_import_feed and goft_wpjm_toggle_settings) in all versions up to, and including, 1.8.5.2, due to a missing capability check. Affected: all versions before 2.0.2.1. Fixed in 2.0.2.1. Severity: Medium 5.4. https://wpsec.com/vuln/WPSEC-2026-1464/ https://wpsec.com/vuln/WPSEC-2026-1464/ Thu, 22 Oct 2026 16:48:21 +0000 WPSec UNKNOWNCWE-94 advanced-form-integration The Advanced Form Integration plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via form submission values in all versions up to, and including, 2.10.3. Affected: all versions before 2.10.4. Fixed in 2.10.4. Severity: High 7.3. https://wpsec.com/vuln/WPSEC-2026-1463/ https://wpsec.com/vuln/WPSEC-2026-1463/ Thu, 22 Oct 2026 15:43:48 +0000 WPSec NO AUTHORISATIONCWE-915 geodirectory The GeoDirectory plugin for WordPress is vulnerable to unauthorized modification of listing data via the frontend listing auto-save and save AJAX handlers in all versions up to, and including, 2.8.194, due to the plugin passing the raw request to wp_update_post() and the listing save routine without removing protected fields such as 'post_status', 'featured', 'expire_date' and 'package_id' for no… Affected: all versions before 2.8.195. Fixed in 2.8.195. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1462/ https://wpsec.com/vuln/WPSEC-2026-1462/ Thu, 22 Oct 2026 15:43:48 +0000 WPSec XSSCWE-79 geodirectory The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' and 'cta' attributes of the gd_post_badge shortcode in all versions up to, and including, 2.8.194, due to insufficient output escaping. Affected: all versions before 2.8.195. Fixed in 2.8.195. Severity: Medium 6.4. https://wpsec.com/vuln/WPSEC-2026-1461/ https://wpsec.com/vuln/WPSEC-2026-1461/ Thu, 22 Oct 2026 14:52:34 +0000 WPSec IDORCWE-639 woo-add-to-quote The B2B Request a Quote plugin for WordPress is vulnerable to Insecure Direct Object Reference via the My Account 'my-quotes' endpoint in all versions up to, and including, 1.5.7, due to the quote details view rendering any quote by its user-supplied ID without verifying that the current user owns the quote. Affected: all versions before 1.5.8. Fixed in 1.5.8. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1460/ https://wpsec.com/vuln/WPSEC-2026-1460/ Thu, 22 Oct 2026 14:52:34 +0000 WPSec NO AUTHORISATIONCWE-862 post-to-google-my-business The Post to Google My Business (Google Business Profile) plugin for WordPress is vulnerable to unauthorized access via the bundled Freemius SDK's _install_with_new_user() opt-in handler in all versions up to, and including, 3.4.4, due to a missing capability check. Affected: all versions before 3.5.4. Fixed in 3.5.4. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1459/ https://wpsec.com/vuln/WPSEC-2026-1459/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec AUTHBYPASSCWE-330 easy-appointments The Easy Appointments plugin for WordPress is vulnerable to authentication bypass via the email action links (confirm/cancel) in version 4.0.3, due to a backward-compatible token fallback in validate_token() that accepts an MD5 hash of a salt hardcoded in the plugin, the appointment's creation timestamp and the action, with no limit on failed attempts. Affected: from 4.0.3 before 4.0.4. Fixed in 4.0.4. Severity: Low 3.7. https://wpsec.com/vuln/WPSEC-2026-1458/ https://wpsec.com/vuln/WPSEC-2026-1458/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec IDORCWE-639 easy-appointments The Easy Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference via the ea_get_customer_detail and ea_search_customers AJAX actions in all versions up to, and including, 4.0.3. Affected: all versions before 4.0.4. Fixed in 4.0.4. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1457/ https://wpsec.com/vuln/WPSEC-2026-1457/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec IDORCWE-639 contact-forms The Contact Forms by Cimatti plugin for WordPress is vulnerable to Insecure Direct Object Reference via the accua_forms_download_submitted_file AJAX action in all versions up to, and including, 2.3.6, due to downloads being authorized by a generic 'accua_forms_download_nonce' nonce instead of the submission's own secret token. Affected: all versions before 2.3.32. Fixed in 2.3.32. Severity: Medium 5.9. https://wpsec.com/vuln/WPSEC-2026-1456/ https://wpsec.com/vuln/WPSEC-2026-1456/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec SENSITIVE DATA DISCLOSURECWE-200 post-carousel The Smart Post plugin for WordPress is vulnerable to Sensitive Information Exposure via the [smart_post] saved template shortcode in all versions from 4.0.0 up to, and including, 4.0.8. Affected: from 4.0.0 before 4.0.9. Fixed in 4.0.9. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1455/ https://wpsec.com/vuln/WPSEC-2026-1455/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec SENSITIVE DATA DISCLOSURECWE-200 post-carousel The Smart Post plugin for WordPress is vulnerable to Sensitive Information Exposure via the sp_smart_post_block_all_post_query AJAX action in all versions from 4.0.0 up to, and including, 4.0.8. Affected: from 4.0.0 before 4.0.9. Fixed in 4.0.9. Severity: Medium 5.3. https://wpsec.com/vuln/WPSEC-2026-1454/ https://wpsec.com/vuln/WPSEC-2026-1454/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec SENSITIVE DATA DISCLOSURECWE-200 post-carousel The Smart Post plugin for WordPress is vulnerable to Sensitive Information Exposure via the sps-blocks/v2/smart-search REST endpoint and the sp_smart_post_block_post_query AJAX action in all versions from 4.0.0 up to, and including, 4.0.8. Affected: from 4.0.0 before 4.0.9. Fixed in 4.0.9. Severity: Medium 5.3. https://wpsec.com/vuln/WPSEC-2026-1453/ https://wpsec.com/vuln/WPSEC-2026-1453/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec IDORCWE-639 mycred The myCred plugin for WordPress is vulnerable to Insecure Direct Object Reference via the buyCRED pending payment cancellation handler in all versions up to, and including, 3.2.6, due to the 'buycred-cancel' value being checked only against a generic nonce that is not tied to a specific payment, with no check that the current user owns the referenced payment and no check of its post type. Affected: all versions before 4.0.0. Fixed in 4.0.0. Severity: Medium 5.4. https://wpsec.com/vuln/WPSEC-2026-1452/ https://wpsec.com/vuln/WPSEC-2026-1452/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec NO AUTHORISATIONCWE-862 fattura24 The Fattura24 plugin for WordPress is vulnerable to unauthorized access via the Support tab ticket handler in all versions up to, and including, 8.2.0, due to a missing capability check (and missing nonce) in the fatt_24_get_ticket_data function. Affected: all versions before 8.2.1. Fixed in 8.2.1. Severity: Medium 5.3. https://wpsec.com/vuln/WPSEC-2026-1451/ https://wpsec.com/vuln/WPSEC-2026-1451/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec SENSITIVE DATA DISCLOSURECWE-377 fattura24 The Fattura24 plugin for WordPress is vulnerable to Sensitive Information Exposure via the support ticket attachment in all versions up to, and including, 8.2.0, due to the fatt_24_send_ticket function writing the ticket content into the web-accessible plugin directory under a predictable name (source, account ID and timestamp). Affected: all versions before 8.2.1. Fixed in 8.2.1. Severity: Medium 5.9. https://wpsec.com/vuln/WPSEC-2026-1450/ https://wpsec.com/vuln/WPSEC-2026-1450/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec CSRFCWE-352 wallet-system-for-woocommerce The Wallet System for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery via the wps_wallet_refund_partial_payment AJAX action in all versions up to, and including, 2.8.1, due to missing nonce validation and no check on whether an order's partial payment was already refunded. Affected: all versions before 2.8.2. Fixed in 2.8.2. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1449/ https://wpsec.com/vuln/WPSEC-2026-1449/ Thu, 22 Oct 2026 13:52:08 +0000 WPSec BYPASSCWE-840 wallet-system-for-woocommerce The Wallet System for WooCommerce plugin for WordPress is vulnerable to a business logic flaw via the comment (product review) wallet reward feature in all versions up to, and including, 2.8.1. Affected: all versions before 2.8.2. Fixed in 2.8.2. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1448/ https://wpsec.com/vuln/WPSEC-2026-1448/ Thu, 22 Oct 2026 12:44:26 +0000 WPSec NO AUTHORISATIONCWE-862 wordpress-popup The Hustle plugin for WordPress is vulnerable to unauthorized access and modification of data via several integration AJAX actions in all versions up to, and including, 7.8.14.3, due to missing capability checks in get_addons, get_form_addons, refresh_email_lists, form_settings, form_deactivate, insert_local_list, is_on_module and the migrate_* provider migration handlers. Affected: all versions before 7.8.14.4. Fixed in 7.8.14.4. Severity: Low 3.8. https://wpsec.com/vuln/WPSEC-2026-1447/ https://wpsec.com/vuln/WPSEC-2026-1447/ Thu, 22 Oct 2026 12:44:26 +0000 WPSec XSSCWE-79 wordpress-popup The Hustle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the module CTA button label and the module title in all versions up to, and including, 7.8.14.3, due to stripcslashes() being applied to the CTA label after it was sanitized with wp_kses, and to the module title being placed in the wrapper aria-label attribute without escaping. Affected: all versions before 7.8.14.4. Fixed in 7.8.14.4. Severity: Medium 5.5. https://wpsec.com/vuln/WPSEC-2026-1446/ https://wpsec.com/vuln/WPSEC-2026-1446/ Thu, 22 Oct 2026 12:44:26 +0000 WPSec OBJECT INJECTIONCWE-502 profilegrid-user-profiles-groups-and-communities The User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.0.0.4 due to deserialization of user-controlled profile field meta values with maybe_unserialize() when profiles and custom fields are rendered. Affected: all versions before 6.0.0.5. Fixed in 6.0.0.5. Severity: High 7.5. https://wpsec.com/vuln/WPSEC-2026-1445/ https://wpsec.com/vuln/WPSEC-2026-1445/ Thu, 22 Oct 2026 11:46:43 +0000 WPSec XSSCWE-79 zoho-crm-forms The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via mapped Contact Form 7 form titles in all versions up to, and including, 1.8.2.4 due to insufficient output escaping. Affected: all versions before 1.8.2.5. Fixed in 1.8.2.5. Severity: Medium 4.0. https://wpsec.com/vuln/WPSEC-2026-1444/ https://wpsec.com/vuln/WPSEC-2026-1444/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec XSSCWE-79 events-manager The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event_rsvp_date' parameter in all versions up to, and including, 7.4.8 due to insufficient input sanitization (only wp_kses_data was applied) and missing output escaping when the value is printed into an input attribute of the event bookings form. Affected: all versions before 7.4.9. Fixed in 7.4.9. Severity: Medium 6.4. https://wpsec.com/vuln/WPSEC-2026-1443/ https://wpsec.com/vuln/WPSEC-2026-1443/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec XSSCWE-79 events-manager The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tags_label', 'tag_label', 'categories_label' and 'category_label' attributes of the event_search_form (events_search) shortcode in versions 6.4.7 up to, and including, 7.4.8. Affected: from 6.4.7 before 7.4.9. Fixed in 7.4.9. Severity: Medium 6.4. https://wpsec.com/vuln/WPSEC-2026-1442/ https://wpsec.com/vuln/WPSEC-2026-1442/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec BYPASSCWE-915 events-manager The Events Manager plugin for WordPress is vulnerable to improperly controlled modification of object attributes via the 'booking_id' parameter in all versions up to, and including, 7.4.8. Affected: all versions before 7.4.9. Fixed in 7.4.9. Severity: Medium 5.3. https://wpsec.com/vuln/WPSEC-2026-1441/ https://wpsec.com/vuln/WPSEC-2026-1441/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec IDORCWE-639 monei The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the order-received redirect handler in all versions up to, and including, 7.3.5, due to the save_payment_token() function trusting the 'orderId' and MONEI payment 'id' query parameters without checking that the payment was created for that order or that the URL carries the order key. Affected: all versions before 7.3.6. Fixed in 7.3.6. Severity: Medium 5.3. https://wpsec.com/vuln/WPSEC-2026-1440/ https://wpsec.com/vuln/WPSEC-2026-1440/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec NO AUTHORISATIONCWE-862 monei The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Missing Authorization via the add-payment-method and order-received redirect handlers in all versions up to, and including, 7.3.5, due to a missing check that the MONEI payment named in the 'id' query parameter was started by the current user or belongs to the order. Affected: all versions before 7.3.6. Fixed in 7.3.6. Severity: Medium 4.2. https://wpsec.com/vuln/WPSEC-2026-1439/ https://wpsec.com/vuln/WPSEC-2026-1439/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec IDORCWE-639 monei The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the subscription order-received and payment-method-change redirect handlers in all versions up to, and including, 7.3.5, due to the subscriptions_save_sequence_id() and subscriptions_save_sequence_id_on_payment_method_change() functions using an order ID from the request without checking… Affected: all versions before 7.3.6. Fixed in 7.3.6. Severity: Medium 5.3. https://wpsec.com/vuln/WPSEC-2026-1438/ https://wpsec.com/vuln/WPSEC-2026-1438/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec XSSCWE-79 jetformbuilder The JetFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field preset values in all versions up to, and including, 3.6.7, due to field default values filled from a preset source (such as stored form records, post or user meta, or URL query variables) being treated as calculated formulas when they contain macro syntax and evaluated as JavaScript by the frontend… Affected: all versions before 3.6.7.1. Fixed in 3.6.7.1. Severity: High 7.2. https://wpsec.com/vuln/WPSEC-2026-1437/ https://wpsec.com/vuln/WPSEC-2026-1437/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec XSSCWE-79 off-canvas-sidebars The Off-Canvas Sidebars & Menus (Slidebars) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocs_trigger' shortcode in all versions up to, and including, 0.5.9. Affected: all versions before 0.5.9.1. Fixed in 0.5.9.1. Severity: Medium 6.4. https://wpsec.com/vuln/WPSEC-2026-1436/ https://wpsec.com/vuln/WPSEC-2026-1436/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec XSSCWE-79 responsive-add-ons The Responsive Starter Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive-ready-sites-elementor_page_import_process' AJAX action in versions 2.7.3 up to, and including, 3.5.4. Affected: from 2.7.3 before 3.5.5. Fixed in 3.5.5. Severity: Medium 6.4. https://wpsec.com/vuln/WPSEC-2026-1435/ https://wpsec.com/vuln/WPSEC-2026-1435/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec IDORCWE-639 responsive-add-ons The Responsive Starter Templates plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'responsive-ready-sites-elementor_page_import_process' AJAX action in versions 2.7.3 up to, and including, 3.5.4. Affected: from 2.7.3 before 3.5.5. Fixed in 3.5.5. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1434/ https://wpsec.com/vuln/WPSEC-2026-1434/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec CSRFCWE-352 vikbooking The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.17 due to missing nonce validation when the booking edit view applies submitted changes and in the sendcustomsms and sendcustomemail tasks. Affected: all versions before 1.8.18. Fixed in 1.8.18. Severity: Medium 4.3. https://wpsec.com/vuln/WPSEC-2026-1433/ https://wpsec.com/vuln/WPSEC-2026-1433/ Thu, 22 Oct 2026 10:48:20 +0000 WPSec SENSITIVE DATA DISCLOSURECWE-532 vikbooking The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Sensitive Information Exposure via the U-tec door access webhook endpoint in versions 1.8.7 up to, and including, 1.8.17, due to the U-tec webhook handler writing the raw request body, request parameters and server variables to a webhook_debug.txt file inside the plugin directory, where the web server can serve it. Affected: from 1.8.7 before 1.8.18. Fixed in 1.8.18. Severity: Low 3.7. https://wpsec.com/vuln/WPSEC-2026-1432/ https://wpsec.com/vuln/WPSEC-2026-1432/ Thu, 22 Oct 2026 09:43:07 +0000 WPSec BYPASSCWE-307 customer-email-verification-for-woocommerce The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification Bypass via the 'verify_otp' AJAX action in all versions up to, and including, 2.8.2, due to the absence of any limit on incorrect signup OTP guesses per email address. Affected: from 2.3 before 2.8.3. Fixed in 2.8.3. Severity: Medium 5.3.