# WordPress Plugin Vulnerability Advisories

Security advisories for WordPress plugins, published by WPSec. Each advisory lists the affected versions and the version that fixes the issue.

- JSON: https://wpsec.com/vuln/advisories.json
- RSS: https://wpsec.com/vuln/feed.xml
- About: https://wpsec.com/vuln/about/
- Updated: 2026-10-23T01:41:18+00:00
- License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Credit WPSec and link to the advisory, or to https://wpsec.com/vuln/ for the whole dataset.

## Advisories

- [WPSEC-2026-1481](https://wpsec.com/vuln/WPSEC-2026-1481/) 2026-10-23: PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Carousel Widget Image URL (fixed in 3.1.2; Medium 6.4)
- [WPSEC-2026-1480](https://wpsec.com/vuln/WPSEC-2026-1480/) 2026-10-23: PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.1 - Authenticated (Contributor+) Sensitive Information Exposure via Posts, Content Ticker and Marquee Widget Filter Settings (fixed in 3.1.2; Medium 4.3)
- [WPSEC-2026-1479](https://wpsec.com/vuln/WPSEC-2026-1479/) 2026-10-23: QA Assistants – Driven by data <= 5.3.0.1 - Unauthenticated Stored Cross-Site Scripting via 'event_ary' Parameter (fixed in 5.3.0.2; High 7.2)
- [WPSEC-2026-1478](https://wpsec.com/vuln/WPSEC-2026-1478/) 2026-10-22: Co-Authors Plus <= 4.1.1 - Authenticated (Editor+) Insecure Direct Object Reference to Post Co-Author Modification (fixed in 4.1.2; Low 3.8)
- [WPSEC-2026-1477](https://wpsec.com/vuln/WPSEC-2026-1477/) 2026-10-22: Overlay Image Divi Module <= 1.5.1 - Authenticated (Contributor+) Server-Side Request Forgery via Overlay Image Module Image URL (fixed in 1.5.3; Medium 6.4)
- [WPSEC-2026-1476](https://wpsec.com/vuln/WPSEC-2026-1476/) 2026-10-22: Sunshine Photo Cart <= 3.7.5 - Unauthenticated Payment Bypass via Square Payment Method (fixed in 3.8; High 7.5)
- [WPSEC-2026-1475](https://wpsec.com/vuln/WPSEC-2026-1475/) 2026-10-22: Sunshine Photo Cart <= 3.7.5 - Unauthenticated Payment Bypass via PayPal (Legacy) IPN (fixed in 3.8; High 7.5)
- [WPSEC-2026-1474](https://wpsec.com/vuln/WPSEC-2026-1474/) 2026-10-22: Sunshine Photo Cart <= 3.7.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Deletion (fixed in 3.8; Medium 6.5)
- [WPSEC-2026-1473](https://wpsec.com/vuln/WPSEC-2026-1473/) 2026-10-22: Paytium: Mollie payment forms & donations <= 5.0.5 - Unauthenticated PHP Object Injection via Payment Form Field Values (fixed in 5.0.6; High 8.1)
- [WPSEC-2026-1472](https://wpsec.com/vuln/WPSEC-2026-1472/) 2026-10-22: Webmention <= 5.10.2 - Unauthenticated Server-Side Request Forgery via Webmention Source URL (fixed in 5.11.0; Medium 5.4)
- [WPSEC-2026-1471](https://wpsec.com/vuln/WPSEC-2026-1471/) 2026-10-22: Timetics – Appointment Booking Calendar & Scheduling <= 1.0.64 - Unauthenticated Booking Disclosure, Cancellation and Rescheduling via Weak 'appointment_token' (fixed in 1.0.65; Medium 5.6)
- [WPSEC-2026-1470](https://wpsec.com/vuln/WPSEC-2026-1470/) 2026-10-22: WooCommerce PayPal Payments <= 4.1.3 - Unauthenticated Missing Authorization to Order Processing via Return URL Endpoint (fixed in 4.2.0; Medium 4.8)
- [WPSEC-2026-1469](https://wpsec.com/vuln/WPSEC-2026-1469/) 2026-10-22: Page and Post Restriction <= 1.6.0 - Unauthenticated Sensitive Information Exposure via Comment Feeds and Comment Lists (fixed in 1.6.1; Medium 5.3)
- [WPSEC-2026-1468](https://wpsec.com/vuln/WPSEC-2026-1468/) 2026-10-22: Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via Role-Restricted Pages and Posts (fixed in 1.6.1; Low 3.7)
- [WPSEC-2026-1467](https://wpsec.com/vuln/WPSEC-2026-1467/) 2026-10-22: Page and Post Restriction <= 1.6.0 - Unauthenticated Sensitive Information Exposure via oEmbed Endpoint (fixed in 1.6.1; Medium 5.3)
- [WPSEC-2026-1466](https://wpsec.com/vuln/WPSEC-2026-1466/) 2026-10-22: Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via REST API 'id' Parameter (fixed in 1.6.1; Medium 5.3)
- [WPSEC-2026-1465](https://wpsec.com/vuln/WPSEC-2026-1465/) 2026-10-22: Go Fetch Jobs (for WP Job Manager) <= 1.8.5.2 - Authenticated (Subscriber+) Missing Authorization to Feed Import and Template Actions (fixed in 2.0.2.1; Medium 5.4)
- [WPSEC-2026-1464](https://wpsec.com/vuln/WPSEC-2026-1464/) 2026-10-22: Advanced Form Integration <= 2.10.3 - Unauthenticated Arbitrary Shortcode Execution via Form Submission Values (fixed in 2.10.4; High 7.3)
- [WPSEC-2026-1463](https://wpsec.com/vuln/WPSEC-2026-1463/) 2026-10-22: GeoDirectory <= 2.8.194 - Authenticated (Subscriber+) Missing Authorization to Listing Status, Featured Flag, Expiry and Package Modification (fixed in 2.8.195; Medium 4.3)
- [WPSEC-2026-1462](https://wpsec.com/vuln/WPSEC-2026-1462/) 2026-10-22: GeoDirectory <= 2.8.194 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Badge Shortcode 'cta' and 'link' Attributes (fixed in 2.8.195; Medium 6.4)
- [WPSEC-2026-1461](https://wpsec.com/vuln/WPSEC-2026-1461/) 2026-10-22: Quote for WooCommerce Lite <= 1.5.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quote Details Disclosure (fixed in 1.5.8; Medium 4.3)
- [WPSEC-2026-1460](https://wpsec.com/vuln/WPSEC-2026-1460/) 2026-10-22: Post to Google My Business (Google Business Profile) <= 3.4.4 - Authenticated (Subscriber+) Missing Authorization to Freemius Opt-In (fixed in 3.5.4; Medium 4.3)
- [WPSEC-2026-1459](https://wpsec.com/vuln/WPSEC-2026-1459/) 2026-10-22: Easy Appointments <= 4.0.3 - Unauthenticated Authentication Bypass via Forgeable Legacy Appointment Action Token (fixed in 4.0.4; Low 3.7)
- [WPSEC-2026-1458](https://wpsec.com/vuln/WPSEC-2026-1458/) 2026-10-22: Easy Appointments <= 4.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Customer Data Exposure via Booking Email (fixed in 4.0.4; Medium 4.3)
- [WPSEC-2026-1457](https://wpsec.com/vuln/WPSEC-2026-1457/) 2026-10-22: WordPress Contact Forms by Cimatti <= 2.3.6 - Unauthenticated Insecure Direct Object Reference to Submitted File Download (fixed in 2.3.32; Medium 5.9)
- [WPSEC-2026-1456](https://wpsec.com/vuln/WPSEC-2026-1456/) 2026-10-22: Post Carousel <= 4.0.8 - Authenticated (Contributor+) Sensitive Information Exposure via Saved Template Shortcode (fixed in 4.0.9; Medium 4.3)
- [WPSEC-2026-1455](https://wpsec.com/vuln/WPSEC-2026-1455/) 2026-10-22: Post Carousel <= 4.0.8 - Unauthenticated Password-Protected Post Content and Non-Public Post Disclosure via sp_smart_post_block_all_post_query AJAX Action (fixed in 4.0.9; Medium 5.3)
- [WPSEC-2026-1454](https://wpsec.com/vuln/WPSEC-2026-1454/) 2026-10-22: Post Carousel <= 4.0.8 - Unauthenticated Non-Public Post Type Information Exposure via Smart Search REST Endpoint (fixed in 4.0.9; Medium 5.3)
- [WPSEC-2026-1453](https://wpsec.com/vuln/WPSEC-2026-1453/) 2026-10-22: myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Trashing via 'buycred-cancel' Parameter (fixed in 4.0.0; Medium 5.4)
- [WPSEC-2026-1452](https://wpsec.com/vuln/WPSEC-2026-1452/) 2026-10-22: Fattura24 <= 8.2.0 - Missing Authorization to Unauthenticated Support Ticket Submission (fixed in 8.2.1; Medium 5.3)
- [WPSEC-2026-1451](https://wpsec.com/vuln/WPSEC-2026-1451/) 2026-10-22: Fattura24 <= 8.2.0 - Unauthenticated Sensitive Information Exposure via Temporary Support Ticket Attachment File (fixed in 8.2.1; Medium 5.9)
- [WPSEC-2026-1450](https://wpsec.com/vuln/WPSEC-2026-1450/) 2026-10-22: Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.8.1 - Cross-Site Request Forgery to Repeated Partial Payment Wallet Refund (fixed in 2.8.2; Medium 4.3)
- [WPSEC-2026-1449](https://wpsec.com/vuln/WPSEC-2026-1449/) 2026-10-22: Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.8.1 - Authenticated (Subscriber+) Comment Reward Limit Bypass (fixed in 2.8.2; Medium 4.3)
- [WPSEC-2026-1448](https://wpsec.com/vuln/WPSEC-2026-1448/) 2026-10-22: Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.3 - Authenticated (Custom-Access+) Missing Authorization to Integration Settings Modification and Provider Migration (fixed in 7.8.14.4; Low 3.8)
- [WPSEC-2026-1447](https://wpsec.com/vuln/WPSEC-2026-1447/) 2026-10-22: Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.3 - Authenticated (Custom-Access+) Stored Cross-Site Scripting via CTA Button Label and Module Title (fixed in 7.8.14.4; Medium 5.5)
- [WPSEC-2026-1446](https://wpsec.com/vuln/WPSEC-2026-1446/) 2026-10-22: ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.4 - Authenticated (Subscriber+) PHP Object Injection via Profile Field Values (fixed in 6.0.0.5; High 7.5)
- [WPSEC-2026-1445](https://wpsec.com/vuln/WPSEC-2026-1445/) 2026-10-22: Zoho CRM Lead Magnet <= 1.8.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Contact Form 7 Form Title (fixed in 1.8.2.5; Medium 4.0)
- [WPSEC-2026-1444](https://wpsec.com/vuln/WPSEC-2026-1444/) 2026-10-22: Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_rsvp_date' Parameter (fixed in 7.4.9; Medium 6.4)
- [WPSEC-2026-1443](https://wpsec.com/vuln/WPSEC-2026-1443/) 2026-10-22: Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_search_form Shortcode Label Attributes (fixed in 7.4.9; Medium 6.4)
- [WPSEC-2026-1442](https://wpsec.com/vuln/WPSEC-2026-1442/) 2026-10-22: Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Unauthenticated Booking Approval Bypass and Authenticated (Subscriber+) Arbitrary Booking Cancellation via 'booking_id' Parameter Mass Assignment (fixed in 7.4.9; Medium 5.3)
- [WPSEC-2026-1441](https://wpsec.com/vuln/WPSEC-2026-1441/) 2026-10-22: MONEI Payments for WooCommerce <= 7.3.5 - Unauthenticated Insecure Direct Object Reference to Order Payment Completion via Payment Reuse (fixed in 7.3.6; Medium 5.3)
- [WPSEC-2026-1440](https://wpsec.com/vuln/WPSEC-2026-1440/) 2026-10-22: MONEI Payments for WooCommerce <= 7.3.5 - Authenticated (Subscriber+) Missing Authorization to Payment Token Attachment via Payment Method Redirect (fixed in 7.3.6; Medium 4.2)
- [WPSEC-2026-1439](https://wpsec.com/vuln/WPSEC-2026-1439/) 2026-10-22: MONEI Payments for WooCommerce <= 7.3.5 - Unauthenticated Insecure Direct Object Reference to Subscription Payment Data Update (fixed in 7.3.6; Medium 5.3)
- [WPSEC-2026-1438](https://wpsec.com/vuln/WPSEC-2026-1438/) 2026-10-22: JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Preset Field Values (fixed in 3.6.7.1; High 7.2)
- [WPSEC-2026-1437](https://wpsec.com/vuln/WPSEC-2026-1437/) 2026-10-22: Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ocs_trigger Shortcode (fixed in 0.5.9.1; Medium 6.4)
- [WPSEC-2026-1436](https://wpsec.com/vuln/WPSEC-2026-1436/) 2026-10-22: Responsive Plus <= 3.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor HTML Widget Import (fixed in 3.5.5; Medium 6.4)
- [WPSEC-2026-1435](https://wpsec.com/vuln/WPSEC-2026-1435/) 2026-10-22: Responsive Plus <= 3.5.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Elementor Page Content Overwrite via Template Import (fixed in 3.5.5; Medium 4.3)
- [WPSEC-2026-1434](https://wpsec.com/vuln/WPSEC-2026-1434/) 2026-10-22: VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Cross-Site Request Forgery to Booking Modification and Custom Message Sending (fixed in 1.8.18; Medium 4.3)
- [WPSEC-2026-1433](https://wpsec.com/vuln/WPSEC-2026-1433/) 2026-10-22: VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Sensitive Information Exposure via U-tec Webhook Debug Log (fixed in 1.8.18; Low 3.7)
- [WPSEC-2026-1432](https://wpsec.com/vuln/WPSEC-2026-1432/) 2026-10-22: Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Email Verification Bypass via OTP Brute Force (fixed in 2.8.3; Medium 5.3)
- [WPSEC-2026-1431](https://wpsec.com/vuln/WPSEC-2026-1431/) 2026-10-22: Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Email Verification Bypass via Predictable Verification Link (fixed in 2.8.3; Medium 5.3)
- [WPSEC-2026-1430](https://wpsec.com/vuln/WPSEC-2026-1430/) 2026-10-22: SureDash <= 1.12.2 - Unauthenticated Sensitive Information Exposure via Quick View 'post_id' Parameter (fixed in 1.12.3; Medium 5.3)
- [WPSEC-2026-1429](https://wpsec.com/vuln/WPSEC-2026-1429/) 2026-10-22: SureDash <= 1.12.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Unapproved Comments in Comment Lists (fixed in 1.12.3; Medium 4.3)
- [WPSEC-2026-1428](https://wpsec.com/vuln/WPSEC-2026-1428/) 2026-10-22: SureDash <= 1.12.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Community Posts, Comments, and Profile Bio (fixed in 1.12.3; Medium 5.4)
- [WPSEC-2026-1427](https://wpsec.com/vuln/WPSEC-2026-1427/) 2026-10-22: SureDash <= 1.12.2 - Unauthenticated Sensitive Information Exposure via REST API Community Posts and Comments (fixed in 1.12.3; Medium 5.3)
- [WPSEC-2026-1426](https://wpsec.com/vuln/WPSEC-2026-1426/) 2026-10-22: SureDash <= 1.12.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via Image Source in Community Posts (fixed in 1.12.3; Medium 6.4)
- [WPSEC-2026-1425](https://wpsec.com/vuln/WPSEC-2026-1425/) 2026-10-22: Advanced Block Animation <= 4.4.2 - Unauthenticated DOM-Based Cross-Site Scripting via Inline HTML Preview Script (fixed in 4.5.0; Medium 6.1)
- [WPSEC-2026-1424](https://wpsec.com/vuln/WPSEC-2026-1424/) 2026-10-22: GDPR Compliance & Cookie Consent <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Data Access Form Class Settings (fixed in 1.6.3; Medium 4.4)
- [WPSEC-2026-1423](https://wpsec.com/vuln/WPSEC-2026-1423/) 2026-10-22: Mortgage Calculator <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mortgage_calculator' Shortcode 'title' Attribute (fixed in 1.3.1; Medium 6.4)
- [WPSEC-2026-1422](https://wpsec.com/vuln/WPSEC-2026-1422/) 2026-10-22: Rio EMI Calculator <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Currency Display Setting (fixed in 1.4.2; Medium 4.4)
- [WPSEC-2026-1421](https://wpsec.com/vuln/WPSEC-2026-1421/) 2026-10-22: BMI Adult & Kid Calculator <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id_calc' Shortcode Attribute (fixed in 1.2.4; Medium 6.4)
- [WPSEC-2026-1420](https://wpsec.com/vuln/WPSEC-2026-1420/) 2026-10-22: 3D viewer – Embed 3D Models <= 1.9.4 - Authenticated (Contributor+) Sensitive Information Exposure via [3d_viewer] Shortcode (fixed in 2.0.0; Medium 4.3)
- [WPSEC-2026-1419](https://wpsec.com/vuln/WPSEC-2026-1419/) 2026-10-21: Jock On Air Now (JOAN) <= 6.1.3 - Unauthenticated Limited Path Traversal via 'joan_visitor_locale' Cookie (fixed in 6.1.4; Medium 5.3)
- [WPSEC-2026-1418](https://wpsec.com/vuln/WPSEC-2026-1418/) 2026-10-21: Related Posts for WordPress <= 3.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via Related Posts Link Screen and Meta Box (fixed in 3.0.1; Medium 4.3)
- [WPSEC-2026-1417](https://wpsec.com/vuln/WPSEC-2026-1417/) 2026-10-21: eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Zoom API Credential Modification via Migration Action (fixed in 1.7.2; Medium 5.3)
- [WPSEC-2026-1416](https://wpsec.com/vuln/WPSEC-2026-1416/) 2026-10-21: eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Zoom Meeting Deletion (fixed in 1.7.2; Medium 5.4)
- [WPSEC-2026-1415](https://wpsec.com/vuln/WPSEC-2026-1415/) 2026-10-21: eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Zoom Meeting Synchronization (fixed in 1.7.2; Medium 4.3)
- [WPSEC-2026-1414](https://wpsec.com/vuln/WPSEC-2026-1414/) 2026-10-21: eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Settings Map AJAX Action (fixed in 1.7.2; Medium 6.5)
- [WPSEC-2026-1413](https://wpsec.com/vuln/WPSEC-2026-1413/) 2026-10-21: eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Plugin Settings Overwrite via Font Regeneration (fixed in 1.7.2; Medium 5.4)
- [WPSEC-2026-1412](https://wpsec.com/vuln/WPSEC-2026-1412/) 2026-10-21: eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Unauthenticated Zoom Meeting Host Role Escalation via Signature Generation (fixed in 1.7.2; Medium 6.5)
- [WPSEC-2026-1411](https://wpsec.com/vuln/WPSEC-2026-1411/) 2026-10-21: W3 Total Cache <= 2.10.7 - Unauthenticated Minify Cache Poisoning via 'b' Parameter and Query String (fixed in 2.11.0; Medium 5.3)
- [WPSEC-2026-1410](https://wpsec.com/vuln/WPSEC-2026-1410/) 2026-10-21: W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Cached REST API Responses (fixed in 2.11.0; Medium 4.7)
- [WPSEC-2026-1409](https://wpsec.com/vuln/WPSEC-2026-1409/) 2026-10-21: W3 Total Cache <= 2.10.7 - Unauthenticated Content Injection via Predictable HTML Minify Placeholders (fixed in 2.11.0; Low 3.7)
- [WPSEC-2026-1408](https://wpsec.com/vuln/WPSEC-2026-1408/) 2026-10-21: VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Cross-Site Request Forgery to Booking Modification, Deletion and Data Export (fixed in 1.8.17; Medium 5.4)
- [WPSEC-2026-1407](https://wpsec.com/vuln/WPSEC-2026-1407/) 2026-10-21: VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Reflected Cross-Site Scripting via 'vbo_active_tab', 'vbo_lang', 'goto' and 'status' Parameters (fixed in 1.8.17; Medium 6.1)
- [WPSEC-2026-1406](https://wpsec.com/vuln/WPSEC-2026-1406/) 2026-10-21: VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Unauthenticated Stored Cross-Site Scripting via Pre-Check-in Guest Fields (fixed in 1.8.17; Medium 5.4)
- [WPSEC-2026-1405](https://wpsec.com/vuln/WPSEC-2026-1405/) 2026-10-21: VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Unauthenticated Stored Cross-Site Scripting via Customer Email (fixed in 1.8.17; Medium 6.1)
- [WPSEC-2026-1404](https://wpsec.com/vuln/WPSEC-2026-1404/) 2026-10-21: Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (fixed in 1.7.21; Medium 6.4)
- [WPSEC-2026-1403](https://wpsec.com/vuln/WPSEC-2026-1403/) 2026-10-21: Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.2 - Authenticated (Contributor+) Path Traversal to Arbitrary File Read via 'importFiles' Parameter (fixed in 1.7.21; Medium 6.5)
- [WPSEC-2026-1402](https://wpsec.com/vuln/WPSEC-2026-1402/) 2026-10-21: WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Authenticated (Subscriber+) Paid Access Bypass via Stripe Customer Portal Plan Change (fixed in 2.10.0; Medium 4.2)
- [WPSEC-2026-1401](https://wpsec.com/vuln/WPSEC-2026-1401/) 2026-10-21: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.7 - Authenticated (Contributor+) Missing Authorization to Unauthorized Future Action Scheduling (fixed in 4.11.0; Medium 4.3)
- [WPSEC-2026-1400](https://wpsec.com/vuln/WPSEC-2026-1400/) 2026-10-21: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Term Creation (fixed in 4.11.0; Medium 4.3)
- [WPSEC-2026-1399](https://wpsec.com/vuln/WPSEC-2026-1399/) 2026-10-21: SureCart <= 4.9.6 - Unauthenticated Authentication Bypass via Passwordless Login Verification Code (fixed in 4.10.0; Critical 9.8)
- [WPSEC-2026-1398](https://wpsec.com/vuln/WPSEC-2026-1398/) 2026-10-21: SureCart <= 4.9.6 - Authenticated (Author+) Stored Cross-Site Scripting via Block Icon Name (fixed in 4.10.0; Medium 6.4)
- [WPSEC-2026-1397](https://wpsec.com/vuln/WPSEC-2026-1397/) 2026-10-21: SureCart <= 4.9.6 - Unauthenticated Path Traversal via REST API 'id' Parameter (fixed in 4.10.0; Medium 6.5)
- [WPSEC-2026-1396](https://wpsec.com/vuln/WPSEC-2026-1396/) 2026-10-21: SureCart <= 4.9.6 - Unauthenticated Open Redirect via Checkout 'page_url' Metadata (fixed in 4.10.0; Medium 6.1)
- [WPSEC-2026-1395](https://wpsec.com/vuln/WPSEC-2026-1395/) 2026-10-21: Pixel Manager for WooCommerce <= 2.2.2 - Authenticated (Subscriber+) Missing Authorization to Plugin Settings Update via AJAX Actions (fixed in 2.2.3; Medium 4.3)
- [WPSEC-2026-1394](https://wpsec.com/vuln/WPSEC-2026-1394/) 2026-10-21: LiteSpeed Cache <= 7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Attributes (fixed in 7.9.2; Medium 4.9)
- [WPSEC-2026-1393](https://wpsec.com/vuln/WPSEC-2026-1393/) 2026-10-21: LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Exposure via Preset Backup Files (fixed in 7.9.2; Medium 5.9)
- [WPSEC-2026-1392](https://wpsec.com/vuln/WPSEC-2026-1392/) 2026-10-21: WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.1.3 - Cross-Site Request Forgery to Port Setting Update (fixed in 4.1.4; Medium 4.3)
- [WPSEC-2026-1391](https://wpsec.com/vuln/WPSEC-2026-1391/) 2026-10-21: GeoDirectory <= 2.8.193 - Unauthenticated Authorization Bypass to Guest Listing Ownership (fixed in 2.8.194; Medium 5.6)
- [WPSEC-2026-1390](https://wpsec.com/vuln/WPSEC-2026-1390/) 2026-10-21: GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Path Traversal in Listing Media (fixed in 2.8.194; High 7.6)
- [WPSEC-2026-1389](https://wpsec.com/vuln/WPSEC-2026-1389/) 2026-10-21: GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Insecure Direct Object Reference to Listing Attachment Modification (fixed in 2.8.194; Medium 4.3)
- [WPSEC-2026-1388](https://wpsec.com/vuln/WPSEC-2026-1388/) 2026-10-21: GeoDirectory <= 2.8.193 - Unauthenticated Sensitive Information Exposure via REST Marker Popup and Recently Viewed Listings (fixed in 2.8.194; Medium 5.3)
- [WPSEC-2026-1387](https://wpsec.com/vuln/WPSEC-2026-1387/) 2026-10-21: GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map and Post Badge Shortcode Attributes (fixed in 2.8.194; Medium 6.4)
- [WPSEC-2026-1386](https://wpsec.com/vuln/WPSEC-2026-1386/) 2026-10-21: Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Unauthenticated Missing Authorization to archive.org Credential Validation (fixed in 1.5.0; Medium 5.3)
- [WPSEC-2026-1385](https://wpsec.com/vuln/WPSEC-2026-1385/) 2026-10-21: Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Improper Certificate Validation Leading to archive.org Credential Exposure (fixed in 1.5.0; Low 3.7)
- [WPSEC-2026-1384](https://wpsec.com/vuln/WPSEC-2026-1384/) 2026-10-21: Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Form Field Type (fixed in 3.1.9; Medium 4.4)
- [WPSEC-2026-1383](https://wpsec.com/vuln/WPSEC-2026-1383/) 2026-10-21: Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 - Unauthenticated Insecure Direct Object Reference to Customer Information Exposure via 'customer_id' Parameter (fixed in 1.0.31; Medium 6.5)
- [WPSEC-2026-1382](https://wpsec.com/vuln/WPSEC-2026-1382/) 2026-10-21: Booking Package <= 1.7.32 - Unauthenticated User Registration Bypass via 'createUser' Action (fixed in 1.7.33; Medium 5.3)
- [WPSEC-2026-1381](https://wpsec.com/vuln/WPSEC-2026-1381/) 2026-10-21: Booking Package <= 1.7.32 - Unauthenticated Verification Code Bypass (fixed in 1.7.33; Medium 5.3)
- [WPSEC-2026-1380](https://wpsec.com/vuln/WPSEC-2026-1380/) 2026-10-21: Booking Package <= 1.7.32 - Unauthenticated Price Manipulation via Hotel Room Amounts and Cross-Calendar Services (fixed in 1.7.33; Medium 5.3)
- [WPSEC-2026-1379](https://wpsec.com/vuln/WPSEC-2026-1379/) 2026-10-21: Booking Package <= 1.7.32 - Unauthenticated Payment Bypass via Stripe Payment Amount Mismatch and Payment Reuse (fixed in 1.7.33; Medium 5.3)
- [WPSEC-2026-1378](https://wpsec.com/vuln/WPSEC-2026-1378/) 2026-10-21: WP Booking System <= 2.1.0.4 - Authenticated (Subscriber+) Missing Authorization to Booking Modification via AJAX Actions (fixed in 2.1.0.5; Medium 5.4)
- [WPSEC-2026-1377](https://wpsec.com/vuln/WPSEC-2026-1377/) 2026-10-21: Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via podcast_playlist Shortcode 'type' Attribute (fixed in 3.17.1; Medium 6.4)
- [WPSEC-2026-1376](https://wpsec.com/vuln/WPSEC-2026-1376/) 2026-10-21: Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Sensitive Information Exposure of Private and Draft Posts via podcast_episode Shortcode (fixed in 3.17.1; Medium 4.3)
- [WPSEC-2026-1375](https://wpsec.com/vuln/WPSEC-2026-1375/) 2026-10-21: Seriously Simple Podcasting <= 3.17.0 - Unauthenticated Missing Authorization to Edit-Context Episode Data via REST API (fixed in 3.17.1; Medium 5.3)
- [WPSEC-2026-1374](https://wpsec.com/vuln/WPSEC-2026-1374/) 2026-10-21: Seriously Simple Podcasting <= 3.17.0 - Unauthenticated Sensitive Information Exposure of Password-Protected Episode Media via REST API and Playlist AJAX (fixed in 3.17.1; Medium 5.3)
- [WPSEC-2026-1373](https://wpsec.com/vuln/WPSEC-2026-1373/) 2026-10-21: Speed Optimizer <= 7.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via DNS Prefetch and Font Preload URLs (fixed in 7.8.5; Medium 4.4)
- [WPSEC-2026-1372](https://wpsec.com/vuln/WPSEC-2026-1372/) 2026-10-21: Speed Optimizer <= 7.8.4 - Authenticated (Administrator+) Missing Authorization to Network Option Update via Enable/Disable Option REST Routes (fixed in 7.8.5; Low 2.2)
- [WPSEC-2026-1371](https://wpsec.com/vuln/WPSEC-2026-1371/) 2026-10-21: Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Typed Text (fixed in 3.8.0.1; Medium 6.4)
- [WPSEC-2026-1370](https://wpsec.com/vuln/WPSEC-2026-1370/) 2026-10-21: Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up Block Prefix, Suffix and Separator (fixed in 3.8.0.1; Medium 6.4)
- [WPSEC-2026-1369](https://wpsec.com/vuln/WPSEC-2026-1369/) 2026-10-21: Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar Block Number Prefix and Suffix (fixed in 3.8.0.1; Medium 6.4)
- [WPSEC-2026-1368](https://wpsec.com/vuln/WPSEC-2026-1368/) 2026-10-21: Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing <= 1.70.0 - Unauthenticated Full Path Disclosure via Google Tag Gateway Proxy Configuration File (fixed in 1.71.0; Low 3.7)
- [WPSEC-2026-1367](https://wpsec.com/vuln/WPSEC-2026-1367/) 2026-10-21: We’re Open! <= 2.6 - Unauthenticated Reflected Cross-Site Scripting via 'content' Parameter (fixed in 2.7; Medium 6.1)
- [WPSEC-2026-1366](https://wpsec.com/vuln/WPSEC-2026-1366/) 2026-10-21: Logo and Address Widget with Schema <= 2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget Title and Address Fields (fixed in 3.0; Medium 4.4)
- [WPSEC-2026-1365](https://wpsec.com/vuln/WPSEC-2026-1365/) 2026-10-21: Team Manager <= 2.6.8 - Unauthenticated Sensitive Information Exposure via Debug Log File (fixed in 2.6.9; Low 3.7)
- [WPSEC-2026-1364](https://wpsec.com/vuln/WPSEC-2026-1364/) 2026-10-21: Team Manager <= 2.6.8 - Authenticated (Contributor+) CSS Injection via 'bg_color' and 'social_color' Shortcode Attributes (fixed in 2.6.9; Medium 5.0)
- [WPSEC-2026-1363](https://wpsec.com/vuln/WPSEC-2026-1363/) 2026-10-21: Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.28 - Authenticated (Administrator+) Arbitrary File Upload via Directory Theme Upload (fixed in 6.4.29; Medium 6.6)
- [WPSEC-2026-1362](https://wpsec.com/vuln/WPSEC-2026-1362/) 2026-10-21: Internal Links Manager <= 3.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Link URL and Keywords (fixed in 3.2.0; Medium 4.4)
- [WPSEC-2026-1361](https://wpsec.com/vuln/WPSEC-2026-1361/) 2026-10-21: Super Progressive Web Apps <= 2.2.48.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Pre-Caching URLs Setting (fixed in 2.2.49; Medium 4.4)
- [WPSEC-2026-1360](https://wpsec.com/vuln/WPSEC-2026-1360/) 2026-10-21: Otter Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content Magic Tags (fixed in 3.2.8; Medium 6.4)
- [WPSEC-2026-1359](https://wpsec.com/vuln/WPSEC-2026-1359/) 2026-10-21: Otter Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Atomic Wind CSS (fixed in 3.2.8; Medium 6.4)
- [WPSEC-2026-1358](https://wpsec.com/vuln/WPSEC-2026-1358/) 2026-10-21: Otter Blocks <= 3.2.7 - Unauthenticated Sensitive Information Exposure via otter/v1/dynamic REST Endpoint (fixed in 3.2.8; Medium 5.3)
- [WPSEC-2026-1357](https://wpsec.com/vuln/WPSEC-2026-1357/) 2026-10-21: Otter Blocks <= 3.2.7 - Unauthenticated Block Visibility Conditions Bypass via REST API (fixed in 3.2.8; Medium 5.3)
- [WPSEC-2026-1356](https://wpsec.com/vuln/WPSEC-2026-1356/) 2026-10-21: User Profile Builder <= 4.0.4 - Authenticated (Administrator+) Privilege Escalation via Front-End Edit Profile Form on Multisite (fixed in 4.0.5; High 8.0)
- [WPSEC-2026-1355](https://wpsec.com/vuln/WPSEC-2026-1355/) 2026-10-21: User Profile Builder <= 4.0.4 - Authenticated (Editor+) Privilege Escalation via Registration Form 'role' Attribute (fixed in 4.0.5; Medium 5.9)
- [WPSEC-2026-1354](https://wpsec.com/vuln/WPSEC-2026-1354/) 2026-10-21: User Profile Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute (fixed in 4.0.5; Medium 5.4)
- [WPSEC-2026-1353](https://wpsec.com/vuln/WPSEC-2026-1353/) 2026-10-21: User Profile Builder <= 4.0.4 - Authenticated (Subscriber+) CAPTCHA Bypass via REST API and XML-RPC Comments (fixed in 4.0.5; Medium 4.3)
- [WPSEC-2026-1352](https://wpsec.com/vuln/WPSEC-2026-1352/) 2026-10-21: Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Popup Trashing (fixed in 4.4.6; Medium 5.3)
- [WPSEC-2026-1351](https://wpsec.com/vuln/WPSEC-2026-1351/) 2026-10-21: Popup Builder <= 4.4.5 - Unauthenticated Stored Cross-Site Scripting via Subscription Form Name Fields (fixed in 4.4.6; High 7.2)
- [WPSEC-2026-1350](https://wpsec.com/vuln/WPSEC-2026-1350/) 2026-10-21: Ajax Search Lite <= 4.14.6 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Images (fixed in 4.14.7; Medium 5.3)
- [WPSEC-2026-1349](https://wpsec.com/vuln/WPSEC-2026-1349/) 2026-10-21: Ajax Search Lite <= 4.14.6 - Unauthenticated SQL Injection via Search Phrase (fixed in 4.14.7; High 7.5)
- [WPSEC-2026-1348](https://wpsec.com/vuln/WPSEC-2026-1348/) 2026-10-21: Download Monitor <= 5.3.4 - Authenticated (Administrator+) Incorrect Authorization to Approved Download Paths Modification via REST API (fixed in 5.3.5; Medium 5.8)
- [WPSEC-2026-1347](https://wpsec.com/vuln/WPSEC-2026-1347/) 2026-10-21: Burst Statistics <= 3.7.2 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via REST Data Type Override (fixed in 3.7.3; Medium 4.3)
- [WPSEC-2026-1346](https://wpsec.com/vuln/WPSEC-2026-1346/) 2026-10-21: Burst Statistics <= 3.7.2 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via Report Share Links (fixed in 3.7.3; Medium 4.3)
- [WPSEC-2026-1345](https://wpsec.com/vuln/WPSEC-2026-1345/) 2026-10-21: Page Builder by SiteOrigin <= 2.37.0 - Authenticated (Contributor+) Sensitive Information Exposure via Post Loop Widget (fixed in 2.38.0; Medium 4.3)
- [WPSEC-2026-1344](https://wpsec.com/vuln/WPSEC-2026-1344/) 2026-10-21: Page Builder by SiteOrigin <= 2.37.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Class Name (fixed in 2.38.0; Medium 6.4)
- [WPSEC-2026-1343](https://wpsec.com/vuln/WPSEC-2026-1343/) 2026-10-21: Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.6 - Unauthenticated Administrator Approval Bypass via Email OTP Registration (fixed in 6.8.7; Medium 5.3)
- [WPSEC-2026-1342](https://wpsec.com/vuln/WPSEC-2026-1342/) 2026-10-21: Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.6 - Unauthenticated Sensitive Information Exposure via load_more AJAX Action (fixed in 6.8.7; Medium 5.3)
- [WPSEC-2026-1341](https://wpsec.com/vuln/WPSEC-2026-1341/) 2026-10-21: PayPlug for WooCommerce (Official) <= 3.1.0 - Cross-Site Request Forgery to Payment Settings Change and PayPlug Account Connection via payplug_api REST Routes (fixed in 3.1.1; Medium 6.5)
- [WPSEC-2026-1340](https://wpsec.com/vuln/WPSEC-2026-1340/) 2026-10-21: PayPlug for WooCommerce (Official) <= 3.1.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Deletion and Modification via Apple Pay AJAX Actions (fixed in 3.1.1; High 7.5)
- [WPSEC-2026-1339](https://wpsec.com/vuln/WPSEC-2026-1339/) 2026-10-21: PayPlug for WooCommerce (Official) <= 3.1.0 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via check_payment and create_payment_intent (fixed in 3.1.1; Medium 6.5)
- [WPSEC-2026-1338](https://wpsec.com/vuln/WPSEC-2026-1338/) 2026-10-21: Newsletters <= 4.18.1 - Unauthenticated PHP Object Injection via Database Update Notice Dismissal (fixed in 4.18.2; High 8.1)
- [WPSEC-2026-1337](https://wpsec.com/vuln/WPSEC-2026-1337/) 2026-10-21: Newsletters <= 4.18.1 - Unauthenticated SQL Injection via Subscriber Management 'id' Parameter (fixed in 4.18.2; High 7.5)
- [WPSEC-2026-1336](https://wpsec.com/vuln/WPSEC-2026-1336/) 2026-10-21: MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.72 - Authenticated (Vendor+) Stored Cross-Site Scripting via Excessive Vendor Capabilities (fixed in 2.1.80; Medium 6.4)
- [WPSEC-2026-1335](https://wpsec.com/vuln/WPSEC-2026-1335/) 2026-10-21: Surfer <= 1.8.0.744 - Authenticated (Contributor+) Sensitive Information Exposure of Surfer API Key via Post Editor Script Data (fixed in 1.8.1.759; High 7.1)
- [WPSEC-2026-1334](https://wpsec.com/vuln/WPSEC-2026-1334/) 2026-10-21: WordLift <= 3.54.17 - Unauthenticated Sensitive Information Exposure via Geomap AJAX Action (fixed in 3.54.18; Medium 5.3)
- [WPSEC-2026-1333](https://wpsec.com/vuln/WPSEC-2026-1333/) 2026-10-21: WordLift <= 3.54.17 - Authenticated (Contributor+) Missing Authorization to Recipe Main Ingredient Update (fixed in 3.54.18; Medium 4.3)
- [WPSEC-2026-1332](https://wpsec.com/vuln/WPSEC-2026-1332/) 2026-10-21: WordLift <= 3.54.17 - Authenticated (Contributor+) Sensitive Information Exposure via Related Posts AJAX Action (fixed in 3.54.18; Medium 4.3)
- [WPSEC-2026-1331](https://wpsec.com/vuln/WPSEC-2026-1331/) 2026-10-21: WordLift <= 3.54.17 - Unauthenticated Sensitive Information Exposure via Chord AJAX Action (fixed in 3.54.18; Medium 5.3)
- [WPSEC-2026-1330](https://wpsec.com/vuln/WPSEC-2026-1330/) 2026-10-21: Optimole <= 4.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes (fixed in 4.2.17; Medium 6.4)
- [WPSEC-2026-1329](https://wpsec.com/vuln/WPSEC-2026-1329/) 2026-10-21: CoDesigner WooCommerce Builder for Elementor <= 4.41 - Unauthenticated Order Currency Manipulation via Currency Switcher (fixed in 4.42; Low 3.7)
- [WPSEC-2026-1328](https://wpsec.com/vuln/WPSEC-2026-1328/) 2026-10-21: CoDesigner WooCommerce Builder for Elementor <= 4.41 - Missing Authorization to Unauthenticated Limited Plugin Installation via Setup Wizard (fixed in 4.42; Medium 5.3)
- [WPSEC-2026-1327](https://wpsec.com/vuln/WPSEC-2026-1327/) 2026-10-21: Interactive Content – H5P <= 1.17.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Tags (fixed in 1.17.10; Medium 6.4)
- [WPSEC-2026-1326](https://wpsec.com/vuln/WPSEC-2026-1326/) 2026-10-21: ThumbPress <= 6.9.1 - Authenticated (Contributor+) PHP Object Injection via Post Content and Post Meta (fixed in 6.10.0; High 7.1)
- [WPSEC-2026-1325](https://wpsec.com/vuln/WPSEC-2026-1325/) 2026-10-21: Better Messages <= 3.1.3 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'bmErrors' Parameter (fixed in 3.1.4; Medium 6.1)
- [WPSEC-2026-1324](https://wpsec.com/vuln/WPSEC-2026-1324/) 2026-10-21: 2Way VideoCalls and Random Chat – HTML5 Webcam Videochat <= 5.2.8 - Cross-Site Request Forgery to Call Room Deletion and Creation (fixed in 6.1.8; Medium 4.3)
- [WPSEC-2026-1323](https://wpsec.com/vuln/WPSEC-2026-1323/) 2026-10-21: On Page SEO + Whatsapp Chat Button <= 2.0.3 - Cross-Site Request Forgery to robots.txt Modification (fixed in 2.0.4; Medium 4.3)
- [WPSEC-2026-1322](https://wpsec.com/vuln/WPSEC-2026-1322/) 2026-10-21: Easy Testimonial Slider and Form <= 1.0.31 - Unauthenticated Path Traversal to Arbitrary File Deletion via 'oldcaptcha' Parameter (fixed in 1.0.32; High 8.2)
- [WPSEC-2026-1321](https://wpsec.com/vuln/WPSEC-2026-1321/) 2026-10-21: YITH WooCommerce Product Bundles <= 2.30.0 - Unauthenticated Price Manipulation via Bundled Item Cart Quantity Update (fixed in 2.30.1; Medium 5.3)
- [WPSEC-2026-1320](https://wpsec.com/vuln/WPSEC-2026-1320/) 2026-10-21: UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Composer Widget Slot Link Settings (fixed in 5.4.0; Medium 6.4)
- [WPSEC-2026-1319](https://wpsec.com/vuln/WPSEC-2026-1319/) 2026-10-21: Analytics Insights for Google Analytics 4 <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via Google Analytics Real-Time Report Data (fixed in 6.4; High 7.2)
- [WPSEC-2026-1318](https://wpsec.com/vuln/WPSEC-2026-1318/) 2026-10-21: Shipping for Nova Poshta <= 1.19.8 - Reflected Cross-Site Scripting via 'invoice' Parameter (fixed in 1.19.9; Medium 6.1)
- [WPSEC-2026-1317](https://wpsec.com/vuln/WPSEC-2026-1317/) 2026-10-21: Mintpay <= 2.2.3 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation and Order Data Exposure (fixed in 3.0.0; Medium 6.5)
- [WPSEC-2026-1316](https://wpsec.com/vuln/WPSEC-2026-1316/) 2026-10-21: Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Missing Authorization to Pending Booking Deletion and Modification via 'wbtm_prev_outbound_group_id' and 'wbtm_return_group_id' Parameters (fixed in 5.9.9; Medium 6.5)
- [WPSEC-2026-1315](https://wpsec.com/vuln/WPSEC-2026-1315/) 2026-10-21: Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Insecure Direct Object Reference to Booking Details Disclosure via 'booking_id' Parameter (fixed in 5.9.9; Medium 5.3)
- [WPSEC-2026-1314](https://wpsec.com/vuln/WPSEC-2026-1314/) 2026-10-21: YITH PayPal Express Checkout for WooCommerce <= 1.62.0 - Unauthenticated Insecure Direct Object Reference via PayPal Express Checkout Return 'order_id' and 'order_key' Parameters (fixed in 1.62.1; Medium 5.3)
- [WPSEC-2026-1313](https://wpsec.com/vuln/WPSEC-2026-1313/) 2026-10-21: WPCafe <= 3.0.22 - Unauthenticated Sensitive Information Exposure via Localized Plugin Settings (fixed in 3.0.23; Medium 5.3)
- [WPSEC-2026-1312](https://wpsec.com/vuln/WPSEC-2026-1312/) 2026-10-21: Open Graphite <= 1.7.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Image Field (fixed in 2.0.0; Medium 6.4)
- [WPSEC-2026-1311](https://wpsec.com/vuln/WPSEC-2026-1311/) 2026-10-21: Knit Pay <= 9.6.3.0 - Unauthenticated Insecure Direct Object Reference via PayPal Order Creation and Capture (fixed in 9.6.3.1; Medium 5.3)
- [WPSEC-2026-1310](https://wpsec.com/vuln/WPSEC-2026-1310/) 2026-10-21: VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Email (fixed in 1.4.9; High 7.2)
- [WPSEC-2026-1309](https://wpsec.com/vuln/WPSEC-2026-1309/) 2026-10-21: VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Path Traversal via Customer Details (fixed in 1.4.9; Low 3.7)
- [WPSEC-2026-1308](https://wpsec.com/vuln/WPSEC-2026-1308/) 2026-10-21: VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Arbitrary File Deletion via Customer Document Deletion (fixed in 1.4.9; Medium 6.8)
- [WPSEC-2026-1307](https://wpsec.com/vuln/WPSEC-2026-1307/) 2026-10-21: VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Multiple Administrative Actions (fixed in 1.4.9; Medium 4.3)
- [WPSEC-2026-1306](https://wpsec.com/vuln/WPSEC-2026-1306/) 2026-10-21: NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data (fixed in 9.3.3; High 7.2)
- [WPSEC-2026-1305](https://wpsec.com/vuln/WPSEC-2026-1305/) 2026-10-21: Prime Mover – Backup and Migration <= 2.2.1 - Unauthenticated PHP Object Injection via Stored Content Processed During Migration Search-Replace (fixed in 2.2.2; High 7.5)
- [WPSEC-2026-1304](https://wpsec.com/vuln/WPSEC-2026-1304/) 2026-10-21: Advanced Order Export For WooCommerce <= 4.1.3 - Authenticated (Shop Manager+) SQL Injection via 'limit' Parameter (fixed in 4.1.4; Medium 4.9)
- [WPSEC-2026-1303](https://wpsec.com/vuln/WPSEC-2026-1303/) 2026-10-21: PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Insecure Direct Object Reference to Order Document Disclosure via Document Shortcode (fixed in 5.16.5; Medium 5.9)
- [WPSEC-2026-1302](https://wpsec.com/vuln/WPSEC-2026-1302/) 2026-10-21: PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Order Address, Custom Field, and Note Values (fixed in 5.16.5; Medium 5.4)
- [WPSEC-2026-1301](https://wpsec.com/vuln/WPSEC-2026-1301/) 2026-10-21: Meta Box - WordPress Custom Fields Framework <= 5.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Editor Field (fixed in 5.15.3; Medium 6.4)
- [WPSEC-2026-1300](https://wpsec.com/vuln/WPSEC-2026-1300/) 2026-10-21: Meta Box - WordPress Custom Fields Framework <= 5.15.2 - Authenticated (Contributor+) Sensitive Information Exposure via Block Bindings (fixed in 5.15.3; Medium 6.5)
- [WPSEC-2026-1299](https://wpsec.com/vuln/WPSEC-2026-1299/) 2026-10-21: Meta Box - WordPress Custom Fields Framework <= 5.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Background Field (fixed in 5.15.3; Medium 6.4)
- [WPSEC-2026-1298](https://wpsec.com/vuln/WPSEC-2026-1298/) 2026-10-21: Leaky Paywall <= 5.2.1 - Unauthenticated Sensitive Information Exposure via RSS Feeds (fixed in 5.3.0; Medium 5.3)
- [WPSEC-2026-1297](https://wpsec.com/vuln/WPSEC-2026-1297/) 2026-10-21: SureCookie <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-surecookie-restore' Attribute (fixed in 1.7.0; Medium 6.4)
- [WPSEC-2026-1296](https://wpsec.com/vuln/WPSEC-2026-1296/) 2026-10-21: Advanced Flat rate shipping Woocommerce <= 1.6.6.17 - Cross-Site Request Forgery to Shipping Package Status Update (fixed in 1.6.6.19; Medium 4.3)
- [WPSEC-2026-1295](https://wpsec.com/vuln/WPSEC-2026-1295/) 2026-10-21: Gantry 5 Framework <= 5.6.4 - Unauthenticated Sensitive Information Exposure via Detailed Debug Error Page (fixed in 5.6.5; Medium 5.3)
- [WPSEC-2026-1294](https://wpsec.com/vuln/WPSEC-2026-1294/) 2026-10-21: Link Library <= 7.9.7 - Unauthenticated SQL Injection via Category Name (fixed in 7.10.0; Medium 5.9)
- [WPSEC-2026-1293](https://wpsec.com/vuln/WPSEC-2026-1293/) 2026-10-21: Link Library <= 7.9.7 - Missing Authorization to Unauthenticated Link Submission Login Requirement Bypass (fixed in 7.10.0; Low 3.7)
- [WPSEC-2026-1292](https://wpsec.com/vuln/WPSEC-2026-1292/) 2026-10-21: WP Photo Album Plus <= 9.3.04.002 - Cross-Site Request Forgery to Comment Management Actions (fixed in 9.3.04.003; Medium 4.3)
- [WPSEC-2026-1291](https://wpsec.com/vuln/WPSEC-2026-1291/) 2026-10-21: Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via JavaScript Error Log Details (fixed in 2.5.3; High 7.2)
- [WPSEC-2026-1290](https://wpsec.com/vuln/WPSEC-2026-1290/) 2026-10-21: Disable payment method / COD fees for Order for WooCommerce <= 1.1.10.9 - Authenticated (Subscriber+) Missing Authorization to Usage Tracking Opt-In (fixed in 1.1.10.10; Medium 4.3)
- [WPSEC-2026-1289](https://wpsec.com/vuln/WPSEC-2026-1289/) 2026-10-21: SecuPress Free <= 2.7.1 - Unauthenticated Login Attempt Limit Bypass via Email Address Login (fixed in 2.7.2; Medium 5.3)
- [WPSEC-2026-1288](https://wpsec.com/vuln/WPSEC-2026-1288/) 2026-10-21: Event Manager and Tickets Selling Plugin for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation via Shop Manager Capability Elevation (fixed in 5.7.9; High 7.2)
- [WPSEC-2026-1287](https://wpsec.com/vuln/WPSEC-2026-1287/) 2026-10-21: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.54 - Authenticated (Instructor+) Insecure Direct Object Reference to User Profile Name Modification via Manage Students (fixed in 3.7.55; Medium 4.3)
- [WPSEC-2026-1286](https://wpsec.com/vuln/WPSEC-2026-1286/) 2026-10-21: Brizy – Page Builder <= 2.8.23 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (fixed in 2.8.24; Medium 6.4)
- [WPSEC-2026-1285](https://wpsec.com/vuln/WPSEC-2026-1285/) 2026-10-21: GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.7 - Authenticated (Subscriber+) Missing Authorization to Private Post Title Disclosure via Rank and Achievement Options AJAX Actions (fixed in 8.0.8; Medium 4.3)
- [WPSEC-2026-1284](https://wpsec.com/vuln/WPSEC-2026-1284/) 2026-10-21: Greenshift <= 13.2.1 - Unauthenticated Stored Cross-Site Scripting via Split Text Animations (fixed in 13.2.2; Medium 5.4)
- [WPSEC-2026-1283](https://wpsec.com/vuln/WPSEC-2026-1283/) 2026-10-21: Greenshift <= 13.2.1 - Unauthenticated Stored Cross-Site Scripting via Text Animated Element (fixed in 13.2.2; Medium 5.4)
- [WPSEC-2026-1282](https://wpsec.com/vuln/WPSEC-2026-1282/) 2026-10-21: Modula Image Gallery <= 3.0.13 - Authenticated (Contributor+) Missing Authorization to Gallery Duplication (fixed in 3.0.14; Medium 4.3)
- [WPSEC-2026-1281](https://wpsec.com/vuln/WPSEC-2026-1281/) 2026-10-21: Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Account Takeover via Update User Form Action (fixed in 0.9.2.8; High 8.1)
- [WPSEC-2026-1280](https://wpsec.com/vuln/WPSEC-2026-1280/) 2026-10-21: Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary Attachment Deletion via Form Email Action (fixed in 0.9.2.8; Medium 4.8)
- [WPSEC-2026-1279](https://wpsec.com/vuln/WPSEC-2026-1279/) 2026-10-21: Advanced Custom Fields: Extended <= 0.9.2.7 - Authenticated (Contributor+) Sensitive Information Exposure via acfe_form Shortcode Template Tags (fixed in 0.9.2.8; Medium 6.5)
- [WPSEC-2026-1278](https://wpsec.com/vuln/WPSEC-2026-1278/) 2026-10-21: Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Template Tag Injection via Form Post and Term Actions (fixed in 0.9.2.8; Medium 5.9)
- [WPSEC-2026-1277](https://wpsec.com/vuln/WPSEC-2026-1277/) 2026-10-21: Strong Testimonials <= 3.3.14 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Meta Modification (fixed in 3.3.15; Medium 4.3)
- [WPSEC-2026-1276](https://wpsec.com/vuln/WPSEC-2026-1276/) 2026-10-21: WooCommerce Menu Cart <= 3.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Product Variation Attribute Values (fixed in 3.2.1; Medium 5.5)
- [WPSEC-2026-1275](https://wpsec.com/vuln/WPSEC-2026-1275/) 2026-10-21: RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Item Excerpt (fixed in 5.2.13; Medium 5.4)
- [WPSEC-2026-1274](https://wpsec.com/vuln/WPSEC-2026-1274/) 2026-10-21: Dynamic Visibility for Elementor <= 6.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Query Control (fixed in 6.0.7; Medium 6.4)
- [WPSEC-2026-1273](https://wpsec.com/vuln/WPSEC-2026-1273/) 2026-10-21: UpdraftPlus <= 1.26.12 - Unauthenticated Continued Access via Unrevoked Compromised UpdraftCentral Keys (fixed in 1.26.13; High 8.1)
- [WPSEC-2026-1272](https://wpsec.com/vuln/WPSEC-2026-1272/) 2026-10-20: WP Mailster <= 1.9.1.0 - Unauthenticated Stored Cross-Site Scripting via Email Subject and Body (fixed in 1.9.2.0; High 7.2)
- [WPSEC-2026-1271](https://wpsec.com/vuln/WPSEC-2026-1271/) 2026-10-20: WP Mailster <= 1.9.1.0 - Unauthenticated Arbitrary File Upload via Email Attachment Filename (fixed in 1.9.2.0; Critical 9.8)
- [WPSEC-2026-1270](https://wpsec.com/vuln/WPSEC-2026-1270/) 2026-10-20: WP Mailster <= 1.9.1.0 - Authenticated (Contributor+) Arbitrary File Read via CSV Import (fixed in 1.9.2.0; Medium 6.5)
- [WPSEC-2026-1269](https://wpsec.com/vuln/WPSEC-2026-1269/) 2026-10-20: Contest Gallery <= 34.0.1 - Unauthenticated Stored Cross-Site Scripting via Gallery Entry Attachment Title and Caption (fixed in 34.0.2; High 7.2)
- [WPSEC-2026-1268](https://wpsec.com/vuln/WPSEC-2026-1268/) 2026-10-20: WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.2 - Missing Authorization to Unauthenticated Database Update Trigger (fixed in 2.7.3; Medium 5.3)
- [WPSEC-2026-1267](https://wpsec.com/vuln/WPSEC-2026-1267/) 2026-10-20: Better Messages <= 3.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery via Link Preview (fixed in 3.1.3; Medium 6.4)
- [WPSEC-2026-1266](https://wpsec.com/vuln/WPSEC-2026-1266/) 2026-10-20: Woo Swish e-commerce <= 3.7.8 - Unauthenticated Authentication Bypass to Payment Service Credential Injection via Legacy OAuth Callback (fixed in 3.7.9; Medium 6.5)
- [WPSEC-2026-1265](https://wpsec.com/vuln/WPSEC-2026-1265/) 2026-10-20: Woo Swish e-commerce <= 3.7.8 - Missing Authorization to Authenticated (Contributor+) Swish Service Connect and Disconnect (fixed in 3.7.9; Medium 5.4)
- [WPSEC-2026-1264](https://wpsec.com/vuln/WPSEC-2026-1264/) 2026-10-20: Mapster WP Maps <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Loader Color (fixed in 2.0.6; Medium 6.4)
- [WPSEC-2026-1263](https://wpsec.com/vuln/WPSEC-2026-1263/) 2026-10-20: Mapster WP Maps <= 2.0.5 - Missing Authorization to Unauthenticated Map Modification and Stored Cross-Site Scripting via save-mapmaker REST Endpoint (fixed in 2.0.6; High 7.2)
- [WPSEC-2026-1262](https://wpsec.com/vuln/WPSEC-2026-1262/) 2026-10-20: Bootstrap Shortcodes <= 3.4.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Bundled Bootstrap Library Data Attributes (fixed in 3.4.6; Medium 6.4)
- [WPSEC-2026-1261](https://wpsec.com/vuln/WPSEC-2026-1261/) 2026-10-20: Bootstrap Shortcodes <= 3.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bs_tcontent' Shortcode 'id' Attribute (fixed in 3.4.6; Medium 6.4)
- [WPSEC-2026-1260](https://wpsec.com/vuln/WPSEC-2026-1260/) 2026-10-20: YMC Filter <= 3.12.20 - Unauthenticated Sensitive Information Exposure via Posts Filter Search (fixed in 3.12.21; Medium 5.3)
- [WPSEC-2026-1259](https://wpsec.com/vuln/WPSEC-2026-1259/) 2026-10-20: WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.17.0 - Unauthenticated Staging Site Login Protection Bypass via 'rest_route' Parameter (fixed in 4.18.0; Medium 6.5)
- [WPSEC-2026-1258](https://wpsec.com/vuln/WPSEC-2026-1258/) 2026-10-20: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 45.0 - Unauthenticated Missing Authorization to Graph Mailer Authorization Reset (fixed in 45.1; Medium 5.3)
- [WPSEC-2026-1257](https://wpsec.com/vuln/WPSEC-2026-1257/) 2026-10-20: Hyyan WooCommerce Polylang Integration <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Translated Variation Deletion (fixed in 1.6.0; Medium 5.4)
- [WPSEC-2026-1256](https://wpsec.com/vuln/WPSEC-2026-1256/) 2026-10-20: Hyyan WooCommerce Polylang Integration <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Translated Product Featured Status Modification (fixed in 1.6.0; Medium 4.3)
- [WPSEC-2026-1255](https://wpsec.com/vuln/WPSEC-2026-1255/) 2026-10-20: My Calendar <= 3.8.8 - Unauthenticated Sensitive Information Exposure via iCal Export (fixed in 3.8.9; Medium 5.3)
- [WPSEC-2026-1254](https://wpsec.com/vuln/WPSEC-2026-1254/) 2026-10-20: WebP Express <= 0.25.15 - Unauthenticated Stored Cross-Site Scripting via Alter HTML (fixed in 0.25.16; Medium 5.4)
- [WPSEC-2026-1253](https://wpsec.com/vuln/WPSEC-2026-1253/) 2026-10-20: WebP Express <= 0.25.15 - Unauthenticated Authentication Bypass in Web Service (fixed in 0.25.16; Medium 4.8)
- [WPSEC-2026-1252](https://wpsec.com/vuln/WPSEC-2026-1252/) 2026-10-20: Advanced Access Manager – Access Governance for WordPress <= 8.0.1 - Authenticated (Administrator+) Authorization Bypass to Privilege Escalation via JWT REST Endpoints (fixed in 8.0.2; High 7.2)
- [WPSEC-2026-1251](https://wpsec.com/vuln/WPSEC-2026-1251/) 2026-10-20: WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Missing Authorization to Membership Self-Assignment and Restricted Profile Field Update (fixed in 3.5.8; Medium 5.4)
- [WPSEC-2026-1250](https://wpsec.com/vuln/WPSEC-2026-1250/) 2026-10-20: WP Accessibility <= 2.4.3 - Unauthenticated Sensitive Information Exposure via 'longdesc' Parameter (fixed in 2.4.4; Medium 5.3)
- [WPSEC-2026-1249](https://wpsec.com/vuln/WPSEC-2026-1249/) 2026-10-19: SchedulePress <= 5.3.4 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Publishing and Status Change via Elementor Schedule Modal (fixed in 5.3.5; Medium 5.4)
- [WPSEC-2026-1248](https://wpsec.com/vuln/WPSEC-2026-1248/) 2026-10-19: SchedulePress <= 5.3.4 - Authenticated (Contributor+) Missing Authorization to Post Publishing and Scheduling via Post Panel and Calendar REST Endpoints (fixed in 5.3.5; Medium 4.3)
- [WPSEC-2026-1247](https://wpsec.com/vuln/WPSEC-2026-1247/) 2026-10-19: Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Missing Authorization to Unauthenticated Casso Account Disconnection (fixed in 4.2.0; Medium 6.5)
- [WPSEC-2026-1246](https://wpsec.com/vuln/WPSEC-2026-1246/) 2026-10-19: Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Missing Authorization to Casso Account Relinking via OAuth2 Callback (fixed in 4.2.0; High 8.2)
- [WPSEC-2026-1245](https://wpsec.com/vuln/WPSEC-2026-1245/) 2026-10-19: Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Unauthenticated Insecure Direct Object Reference to Order Status Disclosure (fixed in 4.2.0; Medium 5.3)
- [WPSEC-2026-1244](https://wpsec.com/vuln/WPSEC-2026-1244/) 2026-10-19: Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Unauthenticated Authentication Bypass to Order Payment Confirmation via Webhook (fixed in 4.2.0; Medium 5.9)
- [WPSEC-2026-1243](https://wpsec.com/vuln/WPSEC-2026-1243/) 2026-10-19: Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description (fixed in 6.2.0; Medium 6.3)
- [WPSEC-2026-1242](https://wpsec.com/vuln/WPSEC-2026-1242/) 2026-10-19: Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Imported Post Content (fixed in 2.2.5; Medium 5.4)
- [WPSEC-2026-1241](https://wpsec.com/vuln/WPSEC-2026-1241/) 2026-10-19: Content Pilot <= 2.2.4 - Authenticated (Contributor+) Missing Authorization to Campaign Configuration and Campaign Data Deletion (fixed in 2.2.5; Medium 6.4)
- [WPSEC-2026-1240](https://wpsec.com/vuln/WPSEC-2026-1240/) 2026-10-19: Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content (fixed in 4.7.3; High 7.2)
- [WPSEC-2026-1239](https://wpsec.com/vuln/WPSEC-2026-1239/) 2026-10-19: WP Ultimate Review <= 2.4.4 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email Field (fixed in 2.4.5; Medium 5.6)
- [WPSEC-2026-1238](https://wpsec.com/vuln/WPSEC-2026-1238/) 2026-10-19: Magical Addons For Elementor < 1.5.3 - Unauthenticated Sensitive Information Exposure via Mailchimp API Key (fixed in 1.5.3; Medium 5.3)
- [WPSEC-2026-1237](https://wpsec.com/vuln/WPSEC-2026-1237/) 2026-10-19: Display Post Types <= 3.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Non-Public Post Types (fixed in 3.4.5; Medium 4.3)
- [WPSEC-2026-1236](https://wpsec.com/vuln/WPSEC-2026-1236/) 2026-10-18: WP AutoTerms <= 3.0.7 - Unauthenticated DOM-Based Cross-Site Scripting via Cookie Consent Preview postMessage Handler (fixed in 3.0.8; Medium 6.1)
- [WPSEC-2026-1235](https://wpsec.com/vuln/WPSEC-2026-1235/) 2026-10-18: Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.311.0 - Unauthenticated Missing Authorization to AI Chat and AI Search REST Endpoints and Restricted Collections (fixed in 17.311.1; Medium 4.8)
- [WPSEC-2026-1234](https://wpsec.com/vuln/WPSEC-2026-1234/) 2026-10-18: Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.311.0 - Authenticated (Subscriber+) Sensitive Information Exposure via KB Search (fixed in 17.311.1; Medium 4.3)
- [WPSEC-2026-1233](https://wpsec.com/vuln/WPSEC-2026-1233/) 2026-10-18: Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.311.0 - Authenticated (Subscriber+) Missing Authorization to Arbitrary User Meta Update (fixed in 17.311.1; Medium 4.3)
- [WPSEC-2026-1232](https://wpsec.com/vuln/WPSEC-2026-1232/) 2026-10-18: VietQR <= 3.6.0 - Unauthenticated Sensitive Information Exposure via vietqr/developer API Endpoint (fixed in 3.7.0; Medium 5.3)
- [WPSEC-2026-1231](https://wpsec.com/vuln/WPSEC-2026-1231/) 2026-10-18: Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Product Tabs Block Icon Attributes (fixed in 2.2.28; Medium 6.4)
- [WPSEC-2026-1230](https://wpsec.com/vuln/WPSEC-2026-1230/) 2026-10-18: Printus <= 2.0.6 - Authenticated (Shop Manager+) Path Traversal to Local File Inclusion via Template Name (fixed in 2.1.0; Medium 6.6)
- [WPSEC-2026-1229](https://wpsec.com/vuln/WPSEC-2026-1229/) 2026-10-18: GSheetConnector For Ninja Forms <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Google Sheets Access Code Update (fixed in 3.0.0; Medium 5.4)
- [WPSEC-2026-1228](https://wpsec.com/vuln/WPSEC-2026-1228/) 2026-10-18: MxChat <= 3.2.25 - Cross-Site Request Forgery to Transcript Translation (fixed in 3.2.26; Medium 4.3)
- [WPSEC-2026-1227](https://wpsec.com/vuln/WPSEC-2026-1227/) 2026-10-18: MxChat <= 3.2.25 - Unauthenticated Stored Cross-Site Scripting via Chat Messages (fixed in 3.2.26; High 7.2)
- [WPSEC-2026-1226](https://wpsec.com/vuln/WPSEC-2026-1226/) 2026-10-18: MxChat <= 3.2.25 - Unauthenticated Stored Cross-Site Scripting via Rating Feedback (fixed in 3.2.26; High 7.2)
- [WPSEC-2026-1225](https://wpsec.com/vuln/WPSEC-2026-1225/) 2026-10-18: Events Made Easy <= 3.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event HTML Headers and Schema.org JSON-LD (fixed in 3.2.25; Medium 6.4)
- [WPSEC-2026-1224](https://wpsec.com/vuln/WPSEC-2026-1224/) 2026-10-18: Events Made Easy <= 3.2.24 - Authenticated (Editor+) Stored Cross-Site Scripting via Location Name and Address in Location Edit Map (fixed in 3.2.25; Medium 4.8)
- [WPSEC-2026-1223](https://wpsec.com/vuln/WPSEC-2026-1223/) 2026-10-18: Extensions for Leaflet Map <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'choropleth' Shortcode (fixed in 6.0; Medium 6.4)
- [WPSEC-2026-1222](https://wpsec.com/vuln/WPSEC-2026-1222/) 2026-10-18: Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Missing Authorization to Restricted Event Disclosure via 'occasionsID' Parameter (fixed in 5.36.0; Low 2.7)
- [WPSEC-2026-1221](https://wpsec.com/vuln/WPSEC-2026-1221/) 2026-10-18: Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Sensitive Information Exposure via REST API Stealth Mode Bypass (fixed in 5.36.0; Low 2.2)
- [WPSEC-2026-1220](https://wpsec.com/vuln/WPSEC-2026-1220/) 2026-10-18: Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Unauthenticated Log Injection via Log Forwarding Local Files (fixed in 5.36.0; Low 3.7)
- [WPSEC-2026-1219](https://wpsec.com/vuln/WPSEC-2026-1219/) 2026-10-18: Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attempt Details via 'attempt_id' Parameter (fixed in 4.0.7; Medium 4.3)
- [WPSEC-2026-1218](https://wpsec.com/vuln/WPSEC-2026-1218/) 2026-10-18: Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Privilege Escalation via Student Role 'edit_posts' Capability (fixed in 4.0.7; Medium 4.3)
- [WPSEC-2026-1217](https://wpsec.com/vuln/WPSEC-2026-1217/) 2026-10-18: Academy LMS <= 4.0.5 - Authenticated (Academy Instructor+) Missing Authorization to Course Publication via change_post_status (fixed in 4.0.7; Medium 4.3)
- [WPSEC-2026-1216](https://wpsec.com/vuln/WPSEC-2026-1216/) 2026-10-18: Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Episode and Shownotes Modification (fixed in 4.5.4; Medium 5.4)
- [WPSEC-2026-1215](https://wpsec.com/vuln/WPSEC-2026-1215/) 2026-10-18: Podlove Podcast Publisher <= 4.5.3 - Unauthenticated Sensitive Information Exposure of Unpublished Episodes (fixed in 4.5.4; Medium 5.3)
- [WPSEC-2026-1214](https://wpsec.com/vuln/WPSEC-2026-1214/) 2026-10-18: Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contributor Name (fixed in 4.5.4; Medium 6.4)
- [WPSEC-2026-1213](https://wpsec.com/vuln/WPSEC-2026-1213/) 2026-10-18: Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) Missing Authorization to Podcast Settings Modification (fixed in 4.5.4; Medium 4.3)
- [WPSEC-2026-1212](https://wpsec.com/vuln/WPSEC-2026-1212/) 2026-10-18: Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Authenticated (Contributor+) Sensitive Information Exposure via 'baicb' Shortcode (fixed in 1.1.22; Medium 4.3)
- [WPSEC-2026-1211](https://wpsec.com/vuln/WPSEC-2026-1211/) 2026-10-18: Document Embedder – let visitors read files without downloading <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Document Library File URLs (fixed in 2.4.1; Medium 6.4)
- [WPSEC-2026-1210](https://wpsec.com/vuln/WPSEC-2026-1210/) 2026-10-18: Document Embedder – let visitors read files without downloading <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Document Embed Block 'doc' Attribute (fixed in 2.4.1; Medium 6.4)
- [WPSEC-2026-1209](https://wpsec.com/vuln/WPSEC-2026-1209/) 2026-10-18: s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via s2Get Shortcode (fixed in 261017; Medium 6.4)
- [WPSEC-2026-1208](https://wpsec.com/vuln/WPSEC-2026-1208/) 2026-10-18: s2Member <= 261011 - Unauthenticated Denial of Service via REST API Collection Requests (fixed in 261017; Medium 5.3)
- [WPSEC-2026-1207](https://wpsec.com/vuln/WPSEC-2026-1207/) 2026-10-18: AI Engine <= 3.8.5 - Authenticated (Editor+) Insecure Direct Object Reference to Arbitrary Post Title and Excerpt Modification (fixed in 3.8.6; Low 2.7)
- [WPSEC-2026-1206](https://wpsec.com/vuln/WPSEC-2026-1206/) 2026-10-17: Seraphinite Post .DOCX Source <= 2.16.15 - Authenticated (Subscriber+) Missing Authorization to Plugin State Modification (fixed in 2.16.16; Medium 5.4)
- [WPSEC-2026-1205](https://wpsec.com/vuln/WPSEC-2026-1205/) 2026-10-17: UpdraftPlus <= 1.26.10 - Unauthenticated SQL Injection via Database Restore (fixed in 1.26.11; High 7.5)
- [WPSEC-2026-1204](https://wpsec.com/vuln/WPSEC-2026-1204/) 2026-10-17: Rich Showcase for Google Reviews <= 7.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Widget Builder Page (fixed in 7.1.7; Medium 4.3)
- [WPSEC-2026-1203](https://wpsec.com/vuln/WPSEC-2026-1203/) 2026-10-17: WeForms <= 1.6.28 - Unauthenticated Insecure Direct Object Reference to Arbitrary Attachment Deletion via Upload Field Values (fixed in 1.6.29; Medium 5.4)
- [WPSEC-2026-1202](https://wpsec.com/vuln/WPSEC-2026-1202/) 2026-10-17: YMC Filter <= 3.12.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Autocomplete Search Results (fixed in 3.12.20; Medium 6.4)
- [WPSEC-2026-1201](https://wpsec.com/vuln/WPSEC-2026-1201/) 2026-10-17: YMC Filter <= 3.12.19 - Unauthenticated Sensitive Information Exposure via Search Autocomplete REST Endpoint (fixed in 3.12.20; Medium 5.3)
- [WPSEC-2026-1200](https://wpsec.com/vuln/WPSEC-2026-1200/) 2026-10-17: If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (fixed in 1.10.3; Medium 6.4)
- [WPSEC-2026-1199](https://wpsec.com/vuln/WPSEC-2026-1199/) 2026-10-17: Uncanny Toolkit for LearnDash <= 3.8.1 - Authenticated (Administrator+) Missing Authorization to User Verification Status Modification on Multisite (fixed in 3.8.2; Low 3.3)
- [WPSEC-2026-1198](https://wpsec.com/vuln/WPSEC-2026-1198/) 2026-10-17: Uncanny Toolkit for LearnDash <= 3.8.1 - Cross-Site Request Forgery to Password Change via Front End Login Password Reset (fixed in 3.8.2; High 7.5)
- [WPSEC-2026-1197](https://wpsec.com/vuln/WPSEC-2026-1197/) 2026-10-17: WP Photo Album Plus <= 9.3.04.001 - Cross-Site Request Forgery to Photo and Comment Deletion (fixed in 9.3.04.002; Medium 4.3)
- [WPSEC-2026-1196](https://wpsec.com/vuln/WPSEC-2026-1196/) 2026-10-17: FluentCart A New Era of eCommerce <= 2.1.0 - Unauthenticated Sensitive Information Exposure of Draft and Private Products via Product Modal (fixed in 2.2.0; Medium 5.3)
- [WPSEC-2026-1195](https://wpsec.com/vuln/WPSEC-2026-1195/) 2026-10-17: Bulk Page Generator <= 3.1.1 - Authenticated (Contributor+) Missing Authorization to Sensitive Information Exposure via Multiple AJAX Actions (fixed in 3.1.2; Medium 4.3)
- [WPSEC-2026-1194](https://wpsec.com/vuln/WPSEC-2026-1194/) 2026-10-17: FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.11.0 - Unauthenticated Sensitive Information Exposure via Activity Feed (fixed in 2.12.0; Low 3.7)
- [WPSEC-2026-1193](https://wpsec.com/vuln/WPSEC-2026-1193/) 2026-10-17: Fluent Forms <= 6.2.15 - Unauthenticated Payment Bypass via Oversized Payment Amounts, Quantities and Checkbox Values (fixed in 6.2.16; Medium 5.3)
- [WPSEC-2026-1192](https://wpsec.com/vuln/WPSEC-2026-1192/) 2026-10-17: Fluent Forms <= 6.2.15 - Unauthenticated Insecure Direct Object Reference via Guest Order Payer Email (fixed in 6.2.16; Medium 6.5)
- [WPSEC-2026-1191](https://wpsec.com/vuln/WPSEC-2026-1191/) 2026-10-17: Fluent Forms <= 6.2.15 - Authenticated (Contributor+) Sensitive Information Exposure via 'theme' Shortcode Attribute (fixed in 6.2.16; Medium 4.3)
- [WPSEC-2026-1190](https://wpsec.com/vuln/WPSEC-2026-1190/) 2026-10-17: Fluent Forms <= 6.2.15 - Authenticated (Fluent Forms Manager+) Cross-Form Authorization Bypass via Malformed 'form_id' Route Parameter (fixed in 6.2.16; Medium 6.3)
- [WPSEC-2026-1189](https://wpsec.com/vuln/WPSEC-2026-1189/) 2026-10-17: Gravatar Enhanced <= 0.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gravatar Profile Block Attributes (fixed in 0.14.0; Medium 6.4)
- [WPSEC-2026-1188](https://wpsec.com/vuln/WPSEC-2026-1188/) 2026-10-17: Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via Payment Form Custom Field Data (fixed in 2.8.62; High 7.2)
- [WPSEC-2026-1187](https://wpsec.com/vuln/WPSEC-2026-1187/) 2026-10-17: RewardsWP <= 1.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Guest Order Takeover via Order Linking Verification (fixed in 1.6.1; Medium 5.4)
- [WPSEC-2026-1186](https://wpsec.com/vuln/WPSEC-2026-1186/) 2026-10-17: RewardsWP <= 1.6.0 - Missing Authorization to Unauthenticated Settings Overwrite via Setup Completion Handler (fixed in 1.6.1; Medium 5.3)
- [WPSEC-2026-1185](https://wpsec.com/vuln/WPSEC-2026-1185/) 2026-10-17: E2Pdf – Export Pdf Tool for WordPress <= 1.32.57 - Unauthenticated Stored Cross-Site Scripting via Export Dataset Labels (fixed in 1.32.58; Medium 5.4)
- [WPSEC-2026-1184](https://wpsec.com/vuln/WPSEC-2026-1184/) 2026-10-17: Contact Form by Supsystic <= 1.10.5 - Unauthenticated Sensitive Information Exposure via Front-End Form Settings (fixed in 1.10.7; Medium 5.3)
- [WPSEC-2026-1183](https://wpsec.com/vuln/WPSEC-2026-1183/) 2026-10-17: WP Booking System <= 2.1.0.3 - Unauthenticated Missing Authorization to Booking Email Log Disclosure and Resend (fixed in 2.1.0.4; Medium 6.5)
- [WPSEC-2026-1182](https://wpsec.com/vuln/WPSEC-2026-1182/) 2026-10-17: WP Booking System <= 2.1.0.3 - Authenticated (Subscriber+) Missing Authorization to Form Settings Update (fixed in 2.1.0.4; Medium 4.3)
- [WPSEC-2026-1181](https://wpsec.com/vuln/WPSEC-2026-1181/) 2026-10-17: WP Booking System <= 2.1.0.3 - Authenticated (Subscriber+) Missing Authorization to Booking Data Exposure via Admin Calendar Refresh AJAX Action (fixed in 2.1.0.4; Medium 4.3)
- [WPSEC-2026-1180](https://wpsec.com/vuln/WPSEC-2026-1180/) 2026-10-17: Sermon Browser <= 0.45.22 - Unauthenticated Open Redirect via 'url' Parameter (fixed in 0.46.0; Medium 6.1)
- [WPSEC-2026-1179](https://wpsec.com/vuln/WPSEC-2026-1179/) 2026-10-17: Sermon Browser <= 0.45.22 - Unauthenticated Stored Cross-Site Scripting via Preacher, Series and Service Names (fixed in 0.46.0; High 7.2)
- [WPSEC-2026-1178](https://wpsec.com/vuln/WPSEC-2026-1178/) 2026-10-17: Sermon Browser <= 0.45.22 - Missing Authorization to Unauthenticated Preacher, Series, Service and File Modification (fixed in 0.46.0; High 7.3)
- [WPSEC-2026-1177](https://wpsec.com/vuln/WPSEC-2026-1177/) 2026-10-17: Sermon Browser <= 0.45.22 - Authenticated (Author+) Stored Cross-Site Scripting via Embed Code (fixed in 0.46.0; Medium 6.4)
- [WPSEC-2026-1176](https://wpsec.com/vuln/WPSEC-2026-1176/) 2026-10-17: Sermon Browser <= 0.45.22 - Authenticated (Author+) Server-Side Request Forgery via Remote File Import (fixed in 0.46.0; Medium 6.4)
- [WPSEC-2026-1175](https://wpsec.com/vuln/WPSEC-2026-1175/) 2026-10-17: Read More Without Refresh < 4.3.1 - Reflected Cross-Site Scripting via Pricing Page Query Parameters (fixed in 4.3.1; Medium 6.1)
- [WPSEC-2026-1174](https://wpsec.com/vuln/WPSEC-2026-1174/) 2026-10-17: Read More Without Refresh < 4.3.1 - Unauthenticated Content Injection via Freemius SDK 'purchase_completed' Admin Notice (fixed in 4.3.1; Low 3.7)
- [WPSEC-2026-1173](https://wpsec.com/vuln/WPSEC-2026-1173/) 2026-10-17: LearnPress <= 4.4.10 - Authenticated (Subscriber+) Missing Authorization to Restricted Course Enrollment via JWT Checkout REST Endpoint (fixed in 4.4.11; Medium 5.4)
- [WPSEC-2026-1172](https://wpsec.com/vuln/WPSEC-2026-1172/) 2026-10-17: LearnPress <= 4.4.10 - Unauthenticated Password Protection Bypass to Sensitive Information Exposure via REST API (fixed in 4.4.11; Medium 5.3)
- [WPSEC-2026-1171](https://wpsec.com/vuln/WPSEC-2026-1171/) 2026-10-17: LearnPress <= 4.4.10 - Authenticated (LP Instructor+) Missing Authorization to Arbitrary Course Duplication and Permanent Deletion via Course Builder (fixed in 4.4.11; Medium 6.3)
- [WPSEC-2026-1170](https://wpsec.com/vuln/WPSEC-2026-1170/) 2026-10-17: Better Search <= 4.5.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Thumbnails (fixed in 4.5.2; Low 3.7)
- [WPSEC-2026-1169](https://wpsec.com/vuln/WPSEC-2026-1169/) 2026-10-17: Contextual Related Posts <= 4.5.1 - Unauthenticated Sensitive Information Exposure via Related Post Thumbnails of Password-Protected Posts (fixed in 4.5.2; Medium 5.3)
- [WPSEC-2026-1168](https://wpsec.com/vuln/WPSEC-2026-1168/) 2026-10-17: Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mb_image Shortcode (fixed in 2.4.6; Medium 6.4)
- [WPSEC-2026-1167](https://wpsec.com/vuln/WPSEC-2026-1167/) 2026-10-17: ECS <= 4.3.12 - Authenticated (Contributor+) Insecure Direct Object Reference to Dynamic Repeater Binding Modification (fixed in 4.3.13; Medium 4.3)
- [WPSEC-2026-1166](https://wpsec.com/vuln/WPSEC-2026-1166/) 2026-10-17: Appointment Booking Plugin <= 5.7.4 - Unauthenticated OTP Brute Force via Race Condition in OTP Verification (fixed in 5.7.5; Medium 4.8)
- [WPSEC-2026-1165](https://wpsec.com/vuln/WPSEC-2026-1165/) 2026-10-17: Appointment Booking Plugin <= 5.7.4 - Authenticated (LatePoint Agent+) Insecure Direct Object Reference to Customer Information Disclosure (fixed in 5.7.5; Medium 4.3)
- [WPSEC-2026-1164](https://wpsec.com/vuln/WPSEC-2026-1164/) 2026-10-17: Appointment Booking Plugin <= 5.7.4 - Unauthenticated Payment Bypass via 'payment_portion' Parameter (fixed in 5.7.5; Medium 5.3)
- [WPSEC-2026-1163](https://wpsec.com/vuln/WPSEC-2026-1163/) 2026-10-17: MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Deletion via Import Preflight File Path (fixed in 8.16.2; High 8.1)
- [WPSEC-2026-1162](https://wpsec.com/vuln/WPSEC-2026-1162/) 2026-10-17: MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) SQL Injection via Schema Field Definitions (fixed in 8.16.2; High 8.8)
- [WPSEC-2026-1161](https://wpsec.com/vuln/WPSEC-2026-1161/) 2026-10-17: MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Upload via CSV Import Preflight (fixed in 8.16.2; High 8.8)
- [WPSEC-2026-1160](https://wpsec.com/vuln/WPSEC-2026-1160/) 2026-10-17: MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map JavaScript Options (fixed in 8.16.2; Medium 6.4)
- [WPSEC-2026-1159](https://wpsec.com/vuln/WPSEC-2026-1159/) 2026-10-17: MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Unauthenticated Sensitive Information Exposure via Posts REST Route (fixed in 8.16.2; Medium 5.3)
- [WPSEC-2026-1158](https://wpsec.com/vuln/WPSEC-2026-1158/) 2026-10-17: MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Unauthenticated Sensitive Information Exposure via Collection REST Routes (fixed in 8.16.2; High 7.5)
- [WPSEC-2026-1157](https://wpsec.com/vuln/WPSEC-2026-1157/) 2026-10-17: WPGraphQL <= 2.24.1 - Unauthenticated Sensitive Information Exposure via User, Post and Term Mutation Error Messages (fixed in 2.24.2; Medium 5.3)
- [WPSEC-2026-1156](https://wpsec.com/vuln/WPSEC-2026-1156/) 2026-10-17: WPGraphQL <= 2.24.1 - Authenticated (Author+) Server-Side Request Forgery via createMediaItem Remote URL (fixed in 2.24.2; Medium 4.9)
- [WPSEC-2026-1155](https://wpsec.com/vuln/WPSEC-2026-1155/) 2026-10-17: WPGraphQL <= 2.24.1 - Authenticated (Subscriber+) Sensitive Information Exposure via updateComment and deleteComment Error Messages (fixed in 2.24.2; Medium 4.3)
- [WPSEC-2026-1154](https://wpsec.com/vuln/WPSEC-2026-1154/) 2026-10-17: Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Custom+) Missing Authorization to Order Status Manipulation and Attendee Reassignment (fixed in 4.1.27; Low 2.7)
- [WPSEC-2026-1153](https://wpsec.com/vuln/WPSEC-2026-1153/) 2026-10-17: Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Featured Image Modification (fixed in 4.1.27; Medium 4.3)
- [WPSEC-2026-1152](https://wpsec.com/vuln/WPSEC-2026-1152/) 2026-10-17: Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Contributor+) Sensitive Information Exposure via Event Organizer/Speaker Assignment and Speaker/Organizer Events Shortcodes (fixed in 4.1.27; Medium 4.3)
- [WPSEC-2026-1151](https://wpsec.com/vuln/WPSEC-2026-1151/) 2026-10-17: Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via Speaker REST API (fixed in 4.1.27; Medium 4.3)
- [WPSEC-2026-1150](https://wpsec.com/vuln/WPSEC-2026-1150/) 2026-10-17: Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Unauthenticated Payment Bypass via WooCommerce Order Linking (fixed in 4.1.27; Medium 5.3)
- [WPSEC-2026-1149](https://wpsec.com/vuln/WPSEC-2026-1149/) 2026-10-17: Themify Builder <= 7.8.2 - Unauthenticated CSS Injection via tb_generate_on_fly AJAX Action (fixed in 7.8.3; Low 3.7)
- [WPSEC-2026-1148](https://wpsec.com/vuln/WPSEC-2026-1148/) 2026-10-17: Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider 'visible' Attribute (fixed in 7.8.3; Medium 6.4)
- [WPSEC-2026-1147](https://wpsec.com/vuln/WPSEC-2026-1147/) 2026-10-17: Themify Builder <= 7.8.2 - Unauthenticated Arbitrary Mailing List Subscription via Optin Module (fixed in 7.8.3; Medium 5.3)
- [WPSEC-2026-1146](https://wpsec.com/vuln/WPSEC-2026-1146/) 2026-10-17: Themify Builder <= 7.8.2 - Unauthenticated Sensitive Information Exposure via Search & Filter Meta Parameters (fixed in 7.8.3; Medium 5.3)
- [WPSEC-2026-1145](https://wpsec.com/vuln/WPSEC-2026-1145/) 2026-10-17: Themify Popup <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Popup Style Settings (fixed in 1.4.8; Medium 6.4)
- [WPSEC-2026-1144](https://wpsec.com/vuln/WPSEC-2026-1144/) 2026-10-17: Disabled Source, Disabled Right Click and Content Protection <= 1.8.2 - Unauthenticated PHP Object Injection via IP Geolocation Lookup (fixed in 1.8.3; High 8.1)
- [WPSEC-2026-1143](https://wpsec.com/vuln/WPSEC-2026-1143/) 2026-10-17: Awesome Support <= 6.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Ticket Attachment MIME Type Confusion (fixed in 6.4.2; Medium 4.9)
- [WPSEC-2026-1142](https://wpsec.com/vuln/WPSEC-2026-1142/) 2026-10-16: Bookit — Booking & Appointment Calendar <= 2.6.0.5 - Unauthenticated Payment Bypass via 'payment_status' Parameter (fixed in 2.6.0.6; Medium 5.3)
- [WPSEC-2026-1141](https://wpsec.com/vuln/WPSEC-2026-1141/) 2026-10-16: Event Tickets and Registration <= 5.30.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Ticket and Attendee Deletion (fixed in 5.30.2; Medium 4.3)
- [WPSEC-2026-1140](https://wpsec.com/vuln/WPSEC-2026-1140/) 2026-10-16: The Events Calendar <= 6.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Widget HTML Tag Settings (fixed in 6.18.2; Medium 6.4)
- [WPSEC-2026-1139](https://wpsec.com/vuln/WPSEC-2026-1139/) 2026-10-16: SureCart <= 4.9.5 - Unauthenticated Open Redirect via Checkout 'success_url' Metadata (fixed in 4.9.6; Medium 6.1)
- [WPSEC-2026-1138](https://wpsec.com/vuln/WPSEC-2026-1138/) 2026-10-16: SureCart <= 4.9.5 - Unauthenticated Sensitive Information Exposure via Product REST API List Endpoints (fixed in 4.9.6; Medium 5.3)
- [WPSEC-2026-1137](https://wpsec.com/vuln/WPSEC-2026-1137/) 2026-10-16: SureCart <= 4.9.5 - Unauthenticated Authentication Bypass via Passwordless Login Code Brute Force (fixed in 4.9.6; High 8.1)
- [WPSEC-2026-1136](https://wpsec.com/vuln/WPSEC-2026-1136/) 2026-10-16: CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.20 - Unauthenticated Coming Soon/Maintenance Mode Bypass via Custom Whitelist URL Patterns (fixed in 4.1.21; Low 3.7)
- [WPSEC-2026-1135](https://wpsec.com/vuln/WPSEC-2026-1135/) 2026-10-16: Happierleads <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Client ID Setting (fixed in 3.1.0; Medium 6.4)
- [WPSEC-2026-1134](https://wpsec.com/vuln/WPSEC-2026-1134/) 2026-10-16: Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via Merge Tags (fixed in 3.15.6; High 7.3)
- [WPSEC-2026-1133](https://wpsec.com/vuln/WPSEC-2026-1133/) 2026-10-16: Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via Submission 'calculations' Extra Data (fixed in 3.15.6; High 7.2)
- [WPSEC-2026-1132](https://wpsec.com/vuln/WPSEC-2026-1132/) 2026-10-16: Ninja Forms <= 3.15.5 - Reflected Cross-Site Scripting via Query String Merge Tags in HTML Fields (fixed in 3.15.6; Medium 6.1)
- [WPSEC-2026-1131](https://wpsec.com/vuln/WPSEC-2026-1131/) 2026-10-16: WebberZone Top 10 <= 4.5.3 - Unauthenticated Sensitive Information Exposure via Popular Posts REST Endpoint (fixed in 4.6.0; Medium 5.3)
- [WPSEC-2026-1130](https://wpsec.com/vuln/WPSEC-2026-1130/) 2026-10-16: WebberZone Top 10 <= 4.5.3 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Thumbnails (fixed in 4.6.0; Medium 5.3)
- [WPSEC-2026-1129](https://wpsec.com/vuln/WPSEC-2026-1129/) 2026-10-16: WebberZone Top 10 <= 4.5.3 - Unauthenticated Sensitive Information Exposure via Cached Popular Posts Lists (fixed in 4.6.0; Low 3.7)
- [WPSEC-2026-1128](https://wpsec.com/vuln/WPSEC-2026-1128/) 2026-10-16: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image IPTC Metadata (fixed in 4.5.3; Medium 6.4)
- [WPSEC-2026-1127](https://wpsec.com/vuln/WPSEC-2026-1127/) 2026-10-16: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Contributor+) Local File Inclusion via Shortcode Attributes (fixed in 4.5.3; High 8.8)
- [WPSEC-2026-1126](https://wpsec.com/vuln/WPSEC-2026-1126/) 2026-10-16: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Author+) Insecure Direct Object Reference to Album Modification and Deletion via Lightroom and XML-RPC (fixed in 4.5.3; Medium 5.4)
- [WPSEC-2026-1125](https://wpsec.com/vuln/WPSEC-2026-1125/) 2026-10-16: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Contributor+) PHP Object Injection via Shortcode Template Attribute (fixed in 4.5.3; High 7.5)
- [WPSEC-2026-1124](https://wpsec.com/vuln/WPSEC-2026-1124/) 2026-10-16: Iptanus File Upload <= 5.2.0 - Unauthenticated Information Exposure via 'params_index' Parameter (fixed in 5.2.1; Medium 5.3)
- [WPSEC-2026-1123](https://wpsec.com/vuln/WPSEC-2026-1123/) 2026-10-16: Fast Index <= 2.2 - Unauthenticated Sensitive Information Exposure via Publicly Stored Service Account Key Files (fixed in 3.0.0; Medium 5.9)
- [WPSEC-2026-1122](https://wpsec.com/vuln/WPSEC-2026-1122/) 2026-10-16: Fast Index <= 2.2 - Cross-Site Request Forgery to Arbitrary File Upload, Settings Update and Service Account Key Deletion (fixed in 3.0.0; High 8.8)
- [WPSEC-2026-1121](https://wpsec.com/vuln/WPSEC-2026-1121/) 2026-10-16: Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Webmention Entry Name (fixed in 5.10.2; High 7.2)
- [WPSEC-2026-1120](https://wpsec.com/vuln/WPSEC-2026-1120/) 2026-10-16: bbPress <= 2.6.19 - Unauthenticated Sensitive Information Exposure via Forum Attachments (fixed in 2.6.20; Medium 5.3)
- [WPSEC-2026-1119](https://wpsec.com/vuln/WPSEC-2026-1119/) 2026-10-16: bbPress <= 2.6.19 - Unauthenticated Sensitive Information Exposure via Single Reply Pages (fixed in 2.6.20; Medium 5.3)
- [WPSEC-2026-1118](https://wpsec.com/vuln/WPSEC-2026-1118/) 2026-10-16: bbPress <= 2.6.19 - Authenticated (Subscriber+) Missing Authorization to Topic and Reply Creation in Password-Protected Forums (fixed in 2.6.20; Medium 4.3)
- [WPSEC-2026-1117](https://wpsec.com/vuln/WPSEC-2026-1117/) 2026-10-16: Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro <= 7.4.5 - Authenticated (Author+) Insecure Direct Object Reference to Arbitrary Post Modification via REST API update_subscriber 'ID' Parameter (fixed in 7.5.0; Medium 4.3)
- [WPSEC-2026-1116](https://wpsec.com/vuln/WPSEC-2026-1116/) 2026-10-16: Better Messages <= 3.0.14 - Authenticated (Subscriber+) Sensitive Information Exposure via 'reply_to' Message Meta in AI Chat Bot Conversations (fixed in 3.1.0; Low 3.1)
- [WPSEC-2026-1115](https://wpsec.com/vuln/WPSEC-2026-1115/) 2026-10-16: Better Messages <= 3.0.14 - Authenticated (Subscriber+) Sensitive Information Exposure of Pending Moderation Messages via 'lazyPool' REST Endpoint (fixed in 3.1.0; Medium 4.3)
- [WPSEC-2026-1114](https://wpsec.com/vuln/WPSEC-2026-1114/) 2026-10-16: Blocksy Companion <= 2.1.59 - Cross-Site Request Forgery to Extension Deactivation via Incorrect License Handler (fixed in 2.1.60; Medium 4.3)
- [WPSEC-2026-1113](https://wpsec.com/vuln/WPSEC-2026-1113/) 2026-10-16: Events Made Easy <= 3.2.22 - Unauthenticated Missing Authorization to Invite-Only Event Booking (fixed in 3.2.23; Medium 5.3)
- [WPSEC-2026-1112](https://wpsec.com/vuln/WPSEC-2026-1112/) 2026-10-16: Events Made Easy <= 3.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Location Map Balloons (fixed in 3.2.23; Medium 6.4)
- [WPSEC-2026-1111](https://wpsec.com/vuln/WPSEC-2026-1111/) 2026-10-16: Events Made Easy <= 3.2.22 - Authenticated (Subscriber+) Missing Authorization via Spoofed Referer Header (fixed in 3.2.23; Medium 4.3)
- [WPSEC-2026-1110](https://wpsec.com/vuln/WPSEC-2026-1110/) 2026-10-16: Events Made Easy <= 3.2.22 - Unauthenticated Insecure Direct Object Reference to Person Record Modification via Booking, Membership and Task Signup Forms (fixed in 3.2.23; Medium 5.3)
- [WPSEC-2026-1109](https://wpsec.com/vuln/WPSEC-2026-1109/) 2026-10-16: UpdraftPlus <= 1.26.9 - Unauthenticated SQL Injection via Database Restore (fixed in 1.26.10; High 7.5)
- [WPSEC-2026-1108](https://wpsec.com/vuln/WPSEC-2026-1108/) 2026-10-16: Simple Banner <= 3.3.2 - Authenticated (Subscriber+) Privilege Escalation via User Permissions Setting (fixed in 3.3.3; High 7.5)
- [WPSEC-2026-1107](https://wpsec.com/vuln/WPSEC-2026-1107/) 2026-10-16: GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via X/Twitter Username Custom Field (fixed in 2.8.193; Medium 6.4)
- [WPSEC-2026-1106](https://wpsec.com/vuln/WPSEC-2026-1106/) 2026-10-16: CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via Event Title (fixed in 1.4.43; Medium 5.4)
- [WPSEC-2026-1105](https://wpsec.com/vuln/WPSEC-2026-1105/) 2026-10-16: Passster – Password Protect Pages and Content <= 4.3.18 - Unauthenticated Category-Locked Content Disclosure via Taxonomy Feeds, Archives and REST API (fixed in 4.3.19; Medium 5.3)
- [WPSEC-2026-1104](https://wpsec.com/vuln/WPSEC-2026-1104/) 2026-10-16: WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce <= 4.20.01 - Unauthenticated Sensitive Information Exposure via 'cookie' Parameter in Lead Lookup AJAX Handler (fixed in 4.24.0; Medium 5.3)
- [WPSEC-2026-1103](https://wpsec.com/vuln/WPSEC-2026-1103/) 2026-10-16: Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Unauthenticated Reflected Cross-Site Scripting via 'form' Parameter (fixed in 6.0.5; Medium 6.1)
- [WPSEC-2026-1102](https://wpsec.com/vuln/WPSEC-2026-1102/) 2026-10-16: Backup and Staging by WP Time Capsule <= 1.22.27 - Missing Authorization to Authenticated (Subscriber+) Staging-to-Live Push (fixed in 1.22.28; High 8.1)
- [WPSEC-2026-1101](https://wpsec.com/vuln/WPSEC-2026-1101/) 2026-10-16: CM HIPAA Forms <= 3.3.1 - Authenticated (HIPAA Forms Role+) Privilege Escalation via HIPAA Role Capability Update (fixed in 3.3.2; High 8.8)
- [WPSEC-2026-1100](https://wpsec.com/vuln/WPSEC-2026-1100/) 2026-10-16: CM HIPAA Forms <= 3.3.1 - Unauthenticated Email Content Injection via Form Submission Notification Parameters (fixed in 3.3.2; Medium 5.3)
- [WPSEC-2026-1099](https://wpsec.com/vuln/WPSEC-2026-1099/) 2026-10-16: CM HIPAA Forms <= 3.3.1 - Authenticated (HIPAA Forms Role+) Insecure Direct Object Reference to Unassigned Form Submissions (fixed in 3.3.2; High 7.1)
- [WPSEC-2026-1098](https://wpsec.com/vuln/WPSEC-2026-1098/) 2026-10-16: Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Server-Side Request Forgery via 'image_url' Parameter (fixed in 10.31.11; Medium 5.5)
- [WPSEC-2026-1097](https://wpsec.com/vuln/WPSEC-2026-1097/) 2026-10-16: Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Stored Cross-Site Scripting via SVG Image Upload (fixed in 10.31.11; Medium 5.5)
- [WPSEC-2026-1096](https://wpsec.com/vuln/WPSEC-2026-1096/) 2026-10-16: Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Missing Authorization to Administrator Demotion and Arbitrary User Deletion (fixed in 10.31.11; Medium 6.7)
- [WPSEC-2026-1095](https://wpsec.com/vuln/WPSEC-2026-1095/) 2026-10-16: Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Subscriber+) Missing Authorization to Salon Data Read via REST API (fixed in 10.31.11; Medium 4.3)
- [WPSEC-2026-1094](https://wpsec.com/vuln/WPSEC-2026-1094/) 2026-10-16: Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Privilege Escalation via Customer User Meta (fixed in 10.31.11; High 7.2)
- [WPSEC-2026-1093](https://wpsec.com/vuln/WPSEC-2026-1093/) 2026-10-16: Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Cross-Site Request Forgery to Arbitrary User Deletion (fixed in 10.31.11; High 8.1)
- [WPSEC-2026-1092](https://wpsec.com/vuln/WPSEC-2026-1092/) 2026-10-16: FAZ Cookie Manager <= 1.34.0 - Unauthenticated Web Cache Poisoning via Crawler User-Agent (fixed in 1.34.1; Low 3.7)
- [WPSEC-2026-1091](https://wpsec.com/vuln/WPSEC-2026-1091/) 2026-10-16: Form Maker by 10Web <= 1.15.49 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (fixed in 1.15.50; High 7.2)
- [WPSEC-2026-1090](https://wpsec.com/vuln/WPSEC-2026-1090/) 2026-10-16: Photo Gallery by 10Web <= 1.8.47 - Cross-Site Request Forgery to Gallery Bulk Actions (fixed in 1.8.48; Medium 5.4)
- [WPSEC-2026-1089](https://wpsec.com/vuln/WPSEC-2026-1089/) 2026-10-16: Photo Gallery by 10Web <= 1.8.47 - Reflected Cross-Site Scripting via 'page' Parameter (fixed in 1.8.48; Medium 6.1)
- [WPSEC-2026-1088](https://wpsec.com/vuln/WPSEC-2026-1088/) 2026-10-16: Conversational Forms for ChatBot <= 1.5.1 - Unauthenticated PHP Object Injection via Form Entry Answer (fixed in 1.5.2; High 8.1)
- [WPSEC-2026-1087](https://wpsec.com/vuln/WPSEC-2026-1087/) 2026-10-16: Docket Cache <= 26.04.09 - Unauthenticated PHP Object Injection via Object Cache Values (fixed in 26.04.10; High 8.1)
- [WPSEC-2026-1086](https://wpsec.com/vuln/WPSEC-2026-1086/) 2026-10-16: Docket Cache <= 26.04.09 - Unauthenticated Sensitive Information Exposure of WP-CLI OPcache Shared Secret (fixed in 26.04.10; Medium 6.5)
- [WPSEC-2026-1085](https://wpsec.com/vuln/WPSEC-2026-1085/) 2026-10-16: Docket Cache <= 26.04.09 - Reflected Cross-Site Scripting via 'nx' and 'nv' Parameters (fixed in 26.04.10; Medium 6.1)
- [WPSEC-2026-1084](https://wpsec.com/vuln/WPSEC-2026-1084/) 2026-10-16: Booking Package <= 1.7.31 - Unauthenticated Payment Bypass via Booking Submission (fixed in 1.7.32; Medium 5.3)
- [WPSEC-2026-1083](https://wpsec.com/vuln/WPSEC-2026-1083/) 2026-10-16: Nexter Extension <= 4.7.12 - Authenticated (Contributor+) Sensitive Information Exposure via Display Conditions Pickers (fixed in 4.7.13; Medium 4.3)
- [WPSEC-2026-1082](https://wpsec.com/vuln/WPSEC-2026-1082/) 2026-10-16: Nexter Extension <= 4.7.12 - Unauthenticated CAPTCHA Bypass via Missing Cloudflare Turnstile Token (fixed in 4.7.13; Medium 5.3)
- [WPSEC-2026-1081](https://wpsec.com/vuln/WPSEC-2026-1081/) 2026-10-16: Nexter Extension <= 4.7.12 - Authenticated (Author+) Missing Authorization to Image Conversion and Overwrite via Image Optimisation (fixed in 4.7.13; Medium 4.3)
- [WPSEC-2026-1080](https://wpsec.com/vuln/WPSEC-2026-1080/) 2026-10-16: Nexter Extension <= 4.7.12 - Authenticated (Contributor+) Missing Authorization to Post Publication via Post Duplicator (fixed in 4.7.13; Low 3.1)
- [WPSEC-2026-1079](https://wpsec.com/vuln/WPSEC-2026-1079/) 2026-10-16: WPGraphQL <= 2.24.0 - Authenticated (Contributor+) Sensitive Information Exposure via Trashed Posts (fixed in 2.24.1; Medium 4.3)
- [WPSEC-2026-1078](https://wpsec.com/vuln/WPSEC-2026-1078/) 2026-10-16: WPGraphQL <= 2.24.0 - Authenticated (Author+) Server-Side Request Forgery via 'filePath' Parameter (fixed in 2.24.1; Medium 4.9)
- [WPSEC-2026-1077](https://wpsec.com/vuln/WPSEC-2026-1077/) 2026-10-16: WPGraphQL <= 2.24.0 - Unauthenticated Missing Authorization to Comment Creation on Restricted Posts (fixed in 2.24.1; Medium 5.3)
- [WPSEC-2026-1076](https://wpsec.com/vuln/WPSEC-2026-1076/) 2026-10-16: WPGraphQL <= 2.24.0 - Authenticated (Subscriber+) Missing Authorization to Comment Metadata Modification and Moderation Bypass via updateComment (fixed in 2.24.1; Medium 4.3)
- [WPSEC-2026-1075](https://wpsec.com/vuln/WPSEC-2026-1075/) 2026-10-16: PowerPack Lite for Beaver Builder <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Facebook App ID Setting (fixed in 1.3.2; Medium 4.4)
- [WPSEC-2026-1074](https://wpsec.com/vuln/WPSEC-2026-1074/) 2026-10-16: PowerPack Lite for Beaver Builder <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Facebook App ID Integration Setting (fixed in 1.3.2; Medium 6.1)
- [WPSEC-2026-1073](https://wpsec.com/vuln/WPSEC-2026-1073/) 2026-10-16: Simple 301 Redirects by BetterLinks <= 2.1.0 - Unauthenticated PHP Object Injection via Insecure Plugin Information Request (fixed in 2.1.1; High 7.5)
- [WPSEC-2026-1072](https://wpsec.com/vuln/WPSEC-2026-1072/) 2026-10-16: Simple 301 Redirects by BetterLinks <= 2.1.0 - Authenticated (Administrator+) Incorrect Authorization to Arbitrary Plugin Installation and Activation (fixed in 2.1.1; Medium 6.6)
- [WPSEC-2026-1071](https://wpsec.com/vuln/WPSEC-2026-1071/) 2026-10-16: Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.6 - Unauthenticated Authorization Bypass via 'ck_subscriber_id' Parameter and Cookie (fixed in 3.4.7; Medium 5.3)
- [WPSEC-2026-1070](https://wpsec.com/vuln/WPSEC-2026-1070/) 2026-10-16: Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Discount Validation Bypass via PayPal Fastlane and Card Checkout (fixed in 3.7.2; Medium 5.3)
- [WPSEC-2026-1069](https://wpsec.com/vuln/WPSEC-2026-1069/) 2026-10-16: Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Race Condition to Discount Usage Limit Bypass via Checkout (fixed in 3.7.2; Low 3.7)
- [WPSEC-2026-1068](https://wpsec.com/vuln/WPSEC-2026-1068/) 2026-10-16: Easy Digital Downloads <= 3.7.1.1 - Authenticated (Subscriber+) Missing Authorization to Test Email Summary Sending (fixed in 3.7.2; Medium 4.3)
- [WPSEC-2026-1067](https://wpsec.com/vuln/WPSEC-2026-1067/) 2026-10-16: Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via 'payment-id' Parameter (fixed in 3.7.2; Medium 5.3)
- [WPSEC-2026-1066](https://wpsec.com/vuln/WPSEC-2026-1066/) 2026-10-16: Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via User Email (fixed in 6.90; Medium 6.1)
- [WPSEC-2026-1065](https://wpsec.com/vuln/WPSEC-2026-1065/) 2026-10-16: Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Reflected Cross-Site Scripting via 'item_meta' Parameter (fixed in 6.90; Medium 6.1)
- [WPSEC-2026-1064](https://wpsec.com/vuln/WPSEC-2026-1064/) 2026-10-16: Download Manager <= 3.3.72 - Unauthenticated Missing Authorization to Restricted Package Download via Password Lock (fixed in 3.3.73; Low 3.7)
- [WPSEC-2026-1063](https://wpsec.com/vuln/WPSEC-2026-1063/) 2026-10-16: Download Manager <= 3.3.72 - Unauthenticated Missing Authorization to Protected File Download via Audio, Video and PDF Preview Links (fixed in 3.3.73; Medium 5.3)
- [WPSEC-2026-1062](https://wpsec.com/vuln/WPSEC-2026-1062/) 2026-10-16: Formidable Forms <= 6.35 - Authenticated (Custom-Access+) Missing Authorization to Arbitrary Plugin Installation via Account Connection Token (fixed in 7.0; High 7.5)
- [WPSEC-2026-1061](https://wpsec.com/vuln/WPSEC-2026-1061/) 2026-10-16: Tutor LMS <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name in Consent Logs (fixed in 4.1.3; Medium 6.4)
- [WPSEC-2026-1060](https://wpsec.com/vuln/WPSEC-2026-1060/) 2026-10-16: Joli FAQ SEO – WordPress FAQ Plugin <= 1.3.10 - Reflected Cross-Site Scripting via Pricing Page Query Parameters (fixed in 1.3.11; Medium 6.1)
- [WPSEC-2026-1059](https://wpsec.com/vuln/WPSEC-2026-1059/) 2026-10-16: Blockons <= 1.2.19 - Unauthenticated Limited File Upload via Contact Form Submission REST Endpoint (fixed in 1.2.20; Medium 5.3)
- [WPSEC-2026-1058](https://wpsec.com/vuln/WPSEC-2026-1058/) 2026-10-16: Blockons <= 1.2.19 - Unauthenticated Arbitrary Email Sending via Contact Form Submission REST Endpoint (fixed in 1.2.20; Medium 5.3)
- [WPSEC-2026-1057](https://wpsec.com/vuln/WPSEC-2026-1057/) 2026-10-16: Job Postings <= 2.8.2 - Authenticated (Contributor+) Missing Authorization to Arbitrary Job Post Duplication (fixed in 2.8.3; Medium 5.4)
- [WPSEC-2026-1056](https://wpsec.com/vuln/WPSEC-2026-1056/) 2026-10-16: WordLift <= 3.54.15 - Authenticated (Subscriber+) Missing Authorization to Schema.org Taxonomy Sync (fixed in 3.54.17; Medium 4.3)
- [WPSEC-2026-1055](https://wpsec.com/vuln/WPSEC-2026-1055/) 2026-10-16: Animation Addons for Elementor <= 4.2.6 - Authenticated (Author+) Stored Cross-Site Scripting via Posts and Video Posts Tab Widgets Post Title (fixed in 4.2.7; Medium 6.4)
- [WPSEC-2026-1054](https://wpsec.com/vuln/WPSEC-2026-1054/) 2026-10-16: Animation Addons for Elementor <= 4.2.6 - Authenticated (Contributor+) Sensitive Information Exposure via Toggle Switcher Widget (fixed in 4.2.7; Medium 4.3)
- [WPSEC-2026-1053](https://wpsec.com/vuln/WPSEC-2026-1053/) 2026-10-16: OttoKit: All-in-One Automation Platform <= 1.1.41 - Unauthenticated Authentication Bypass via Denied Connection Token (fixed in 1.1.42; High 8.1)
- [WPSEC-2026-1052](https://wpsec.com/vuln/WPSEC-2026-1052/) 2026-10-16: Quiz Maker by AYS <= 6.7.1.91 - Unauthenticated Reflected Cross-Site Scripting via Request URI in Social Share Buttons (fixed in 6.7.1.92; Medium 6.1)
- [WPSEC-2026-1051](https://wpsec.com/vuln/WPSEC-2026-1051/) 2026-10-16: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart Tag Injection in Form Field Values (fixed in 3.6.3; Medium 5.3)
- [WPSEC-2026-1050](https://wpsec.com/vuln/WPSEC-2026-1050/) 2026-10-16: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting via Form Entry Values (fixed in 3.6.3; High 7.2)
- [WPSEC-2026-1049](https://wpsec.com/vuln/WPSEC-2026-1049/) 2026-10-16: Translate WordPress and go Multilingual – Weglot <= 6.4.2 - Unauthenticated Stored Cross-Site Scripting via Translated Link URLs (fixed in 6.4.3; High 7.2)
- [WPSEC-2026-1048](https://wpsec.com/vuln/WPSEC-2026-1048/) 2026-10-16: SAML Single Sign On <= 6.0.0 - Unauthenticated Authentication Bypass via SAML Assertion Replay (fixed in 6.1.0; High 8.1)
- [WPSEC-2026-1047](https://wpsec.com/vuln/WPSEC-2026-1047/) 2026-10-16: Pay For Post with WooCommerce <= 3.2.34 - Unauthenticated Reflected Cross-Site Scripting via Pricing Page URL Parameters (fixed in 3.2.35; Medium 6.1)
- [WPSEC-2026-1046](https://wpsec.com/vuln/WPSEC-2026-1046/) 2026-10-16: Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes (fixed in 7.3.0; Medium 6.4)
- [WPSEC-2026-1045](https://wpsec.com/vuln/WPSEC-2026-1045/) 2026-10-16: WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via Campaign Log (fixed in 2.9.1; Medium 5.4)
- [WPSEC-2026-1044](https://wpsec.com/vuln/WPSEC-2026-1044/) 2026-10-16: WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Content (fixed in 2.9.1; Medium 5.4)
- [WPSEC-2026-1043](https://wpsec.com/vuln/WPSEC-2026-1043/) 2026-10-15: AI Engine <= 3.8.4 - Unauthenticated Insecure Direct Object Reference to File Deletion via File Upload Metadata (fixed in 3.8.5; Medium 4.8)
- [WPSEC-2026-1042](https://wpsec.com/vuln/WPSEC-2026-1042/) 2026-10-15: Gmedia Photo Gallery <= 1.25.1 - Cross-Site Request Forgery to Arbitrary Gmedia Term Deletion via Module Preset Restore (fixed in 1.25.2; Medium 5.4)
- [WPSEC-2026-1041](https://wpsec.com/vuln/WPSEC-2026-1041/) 2026-10-15: Telegram Bot & Channel <= 4.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'telegram_m_send_content' Parameter (fixed in 4.2.1; Medium 6.4)
- [WPSEC-2026-1040](https://wpsec.com/vuln/WPSEC-2026-1040/) 2026-10-15: Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Popular Posts Block 'instance_id' Attribute (fixed in 4.5.3; Medium 6.4)
- [WPSEC-2026-1039](https://wpsec.com/vuln/WPSEC-2026-1039/) 2026-10-15: Product Layouts for WooCommerce <= 1.4.5 - Unauthenticated Sensitive Information Exposure via Quick View (fixed in 1.4.6; Medium 5.3)
- [WPSEC-2026-1038](https://wpsec.com/vuln/WPSEC-2026-1038/) 2026-10-15: ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Unauthenticated Information Exposure of Unpublished Affiliate Links via 'ta_click_data_redirect' and 'ta_link_fixer' AJAX Actions (fixed in 3.12.1; Medium 6.5)
- [WPSEC-2026-1037](https://wpsec.com/vuln/WPSEC-2026-1037/) 2026-10-15: ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Missing Authorization to Authenticated (Contributor+) Stripe API Key Exposure via Payments Settings Tab (fixed in 3.12.1; Medium 6.5)
- [WPSEC-2026-1036](https://wpsec.com/vuln/WPSEC-2026-1036/) 2026-10-15: GetPaid Stripe Payments <= 2.3.28 - Unauthenticated Payment Bypass via Insufficient Payment Amount Verification (fixed in 2.3.29; Medium 5.3)
- [WPSEC-2026-1035](https://wpsec.com/vuln/WPSEC-2026-1035/) 2026-10-15: UpdraftPlus <= 1.26.8 - Unauthenticated SQL Injection via Database Restore (fixed in 1.26.9; High 7.5)
- [WPSEC-2026-1034](https://wpsec.com/vuln/WPSEC-2026-1034/) 2026-10-15: Restricted Site Access <= 7.6.3 - Unauthenticated Authentication Bypass via 'page_id' and 'pagename' Query Parameters (fixed in 7.6.4; Low 3.7)
- [WPSEC-2026-1033](https://wpsec.com/vuln/WPSEC-2026-1033/) 2026-10-15: Product Attachment for WooCommerce <= 2.3.4 - Unauthenticated Insecure Direct Object Reference to Order Attachment Download (fixed in 2.3.5; Medium 5.3)
- [WPSEC-2026-1032](https://wpsec.com/vuln/WPSEC-2026-1032/) 2026-10-15: Advanced Ads – Ad Manager & AdSense <= 2.0.26 - Authenticated (Editor+) Sensitive Information Exposure via Author Search (fixed in 2.0.27; Medium 4.9)
- [WPSEC-2026-1031](https://wpsec.com/vuln/WPSEC-2026-1031/) 2026-10-15: Depicter — Popup & Slider Builder <= 4.8.1 - Authenticated (Editor+) Arbitrary File Upload (fixed in 4.8.2; High 7.2)
- [WPSEC-2026-1030](https://wpsec.com/vuln/WPSEC-2026-1030/) 2026-10-15: Invoicing with InvoiceXpress for WooCommerce <= 9.1 - Unauthenticated Sensitive Information Exposure via Predictable Document PDF File Names (fixed in 10.0; Medium 5.9)
- [WPSEC-2026-1029](https://wpsec.com/vuln/WPSEC-2026-1029/) 2026-10-15: Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget and UIkit Component HTML (fixed in 10.0.0; Medium 6.4)
- [WPSEC-2026-1028](https://wpsec.com/vuln/WPSEC-2026-1028/) 2026-10-15: Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via UIkit Component Attributes (Content Guard Bypass) (fixed in 10.0.0; Medium 6.4)
- [WPSEC-2026-1027](https://wpsec.com/vuln/WPSEC-2026-1027/) 2026-10-15: Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated SQL Injection via 'customer_id' Parameter (fixed in 1.0.30; High 7.5)
- [WPSEC-2026-1026](https://wpsec.com/vuln/WPSEC-2026-1026/) 2026-10-15: Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated Missing Authorization via Notification Flow REST Routes (fixed in 1.0.30; High 7.3)
- [WPSEC-2026-1025](https://wpsec.com/vuln/WPSEC-2026-1025/) 2026-10-15: My Calendar <= 3.8.7 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes (fixed in 3.8.8; Critical 9.8)
- [WPSEC-2026-1024](https://wpsec.com/vuln/WPSEC-2026-1024/) 2026-10-15: My Calendar <= 3.8.7 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' and Query String Parameters (fixed in 3.8.8; High 7.3)
- [WPSEC-2026-1023](https://wpsec.com/vuln/WPSEC-2026-1023/) 2026-10-15: My Calendar <= 3.7.17 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' and Query String Parameters (fixed in 3.7.18; High 7.3)
- [WPSEC-2026-1022](https://wpsec.com/vuln/WPSEC-2026-1022/) 2026-10-15: My Calendar <= 3.7.17 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes (fixed in 3.7.18; Critical 9.8)
- [WPSEC-2026-1021](https://wpsec.com/vuln/WPSEC-2026-1021/) 2026-10-15: My Calendar <= 3.6.17 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes (fixed in 3.6.18; Critical 9.8)
- [WPSEC-2026-1020](https://wpsec.com/vuln/WPSEC-2026-1020/) 2026-10-15: LWS Optimize – All-in-One Speed Booster & Cache Tools <= 4.1.6.5 - Unauthenticated Server-Side Request Forgery via Host Header (fixed in 4.1.7; Medium 5.4)
- [WPSEC-2026-1019](https://wpsec.com/vuln/WPSEC-2026-1019/) 2026-10-15: My Calendar <= 3.5.21 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes (fixed in 3.5.22; Critical 9.8)
- [WPSEC-2026-1018](https://wpsec.com/vuln/WPSEC-2026-1018/) 2026-10-15: My Calendar <= 3.4.24 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' and Query String Parameters (fixed in 3.4.25; High 7.3)
- [WPSEC-2026-1017](https://wpsec.com/vuln/WPSEC-2026-1017/) 2026-10-15: My Calendar <= 3.4.24 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes (fixed in 3.4.25; Critical 9.8)
- [WPSEC-2026-1016](https://wpsec.com/vuln/WPSEC-2026-1016/) 2026-10-15: Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Incorrect Authorization to Group Appointment Cancellation and Deletion (fixed in 1.6.12.37; Medium 6.5)
- [WPSEC-2026-1015](https://wpsec.com/vuln/WPSEC-2026-1015/) 2026-10-15: Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Sensitive Information Exposure via Appointment Types REST Endpoint (fixed in 1.6.12.37; Medium 5.3)
- [WPSEC-2026-1014](https://wpsec.com/vuln/WPSEC-2026-1014/) 2026-10-15: Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via Debug Log (fixed in 1.6.12.37; High 7.2)
- [WPSEC-2026-1013](https://wpsec.com/vuln/WPSEC-2026-1013/) 2026-10-15: Simply Schedule Appointments <= 1.6.12.35 - Authenticated (Contributor+) Insecure Direct Object Reference via 'edit' Shortcode Attribute (fixed in 1.6.12.37; Medium 6.3)
- [WPSEC-2026-1012](https://wpsec.com/vuln/WPSEC-2026-1012/) 2026-10-15: WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.33 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Modification via Re-order AJAX Actions (fixed in 1.4.34; Medium 4.3)
- [WPSEC-2026-1011](https://wpsec.com/vuln/WPSEC-2026-1011/) 2026-10-15: SmartCrawl SEO checker, analyzer & optimizer <= 3.16.4 - Authenticated (Contributor+) Missing Authorization to Post SEO Analysis Modification and Disclosure (fixed in 3.17.1; Medium 5.4)
- [WPSEC-2026-1010](https://wpsec.com/vuln/WPSEC-2026-1010/) 2026-10-15: NotificationX <= 3.3.3 - Unauthenticated Missing Authorization to Notification Entry Injection via popup-submit REST Endpoint (fixed in 3.3.4; Medium 5.3)
- [WPSEC-2026-1009](https://wpsec.com/vuln/WPSEC-2026-1009/) 2026-10-15: Better Payment <= 2.4.1 - Unauthenticated Open Redirect via PayPal 'return' and 'cancel_return' Parameters (fixed in 2.4.2; Medium 4.7)
- [WPSEC-2026-1008](https://wpsec.com/vuln/WPSEC-2026-1008/) 2026-10-15: Security & Malware scan by CleanTalk <= 2.189 - Unauthenticated Rate Limit Bypass via User-Agent Header (fixed in 2.190; Medium 5.3)
- [WPSEC-2026-1007](https://wpsec.com/vuln/WPSEC-2026-1007/) 2026-10-15: EasyJobs <= 2.8.2 - Missing Authorization to Unauthenticated Usage-Tracking Opt-In Change (fixed in 2.8.3; Medium 5.3)
- [WPSEC-2026-1006](https://wpsec.com/vuln/WPSEC-2026-1006/) 2026-10-15: WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.24 - Unauthenticated Site Access Restriction Bypass via Password Reset Page URL Prefix (fixed in 2.9.25; Low 3.7)
- [WPSEC-2026-1005](https://wpsec.com/vuln/WPSEC-2026-1005/) 2026-10-15: WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.24 - Unauthenticated Site Access Restriction Bypass via REST API Prefix in Request URI (fixed in 2.9.25; Medium 5.3)
- [WPSEC-2026-1004](https://wpsec.com/vuln/WPSEC-2026-1004/) 2026-10-15: Download Monitor <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via XHR Download Link Handling (fixed in 5.3.4; Medium 6.1)
- [WPSEC-2026-1003](https://wpsec.com/vuln/WPSEC-2026-1003/) 2026-10-15: Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Unauthenticated Sensitive Information Exposure via Search Form 'post_type' Parameter (fixed in 4.11.112; Medium 5.3)
- [WPSEC-2026-1002](https://wpsec.com/vuln/WPSEC-2026-1002/) 2026-10-15: Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Authenticated (Subscriber+) Missing Authorization to Post Title Disclosure via 'premium_update_filter' AJAX Action (fixed in 4.11.112; Medium 4.3)
- [WPSEC-2026-1001](https://wpsec.com/vuln/WPSEC-2026-1001/) 2026-10-15: Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Wheel and Media Grid Lightbox URLs (fixed in 4.11.112; Medium 6.4)
- [WPSEC-2026-1000](https://wpsec.com/vuln/WPSEC-2026-1000/) 2026-10-15: Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Authenticated (Contributor+) Missing Authorization to Post Publishing via Change Post Status Ability (fixed in 4.11.112; Low 3.1)
- [WPSEC-2026-0999](https://wpsec.com/vuln/WPSEC-2026-0999/) 2026-10-15: Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Unauthenticated Sensitive Information Exposure of Password-Protected Products via Woo Products Quick View (fixed in 4.11.112; Medium 5.3)
- [WPSEC-2026-0998](https://wpsec.com/vuln/WPSEC-2026-0998/) 2026-10-15: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via Rendered Block Content (fixed in 1.58.2; Medium 6.5)
- [WPSEC-2026-0997](https://wpsec.com/vuln/WPSEC-2026-0997/) 2026-10-15: Gwolle Guestbook <= 5.1.1 - Unauthenticated Reflected Cross-Site Scripting via 'permalink' Parameter (fixed in 5.1.2; Medium 6.1)
- [WPSEC-2026-0996](https://wpsec.com/vuln/WPSEC-2026-0996/) 2026-10-15: Ajax Search Lite <= 4.14.5 - Unauthenticated CSV Injection via Search Statistics Export (fixed in 4.14.6; Medium 4.2)
- [WPSEC-2026-0995](https://wpsec.com/vuln/WPSEC-2026-0995/) 2026-10-15: Ajax Search Lite <= 4.14.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Forged Search Instance Settings (fixed in 4.14.6; Medium 5.4)
- [WPSEC-2026-0994](https://wpsec.com/vuln/WPSEC-2026-0994/) 2026-10-15: Ajax Search Lite <= 4.14.5 - Unauthenticated Sensitive Information Exposure via 'customset' Post Type Selection (fixed in 4.14.6; Medium 5.3)
- [WPSEC-2026-0993](https://wpsec.com/vuln/WPSEC-2026-0993/) 2026-10-15: Ajax Search Lite <= 4.14.5 - Unauthenticated Sensitive Information Exposure of Password Protected Post Content via Search Results (fixed in 4.14.6; Low 3.7)
- [WPSEC-2026-0992](https://wpsec.com/vuln/WPSEC-2026-0992/) 2026-10-15: Categories Images <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode (fixed in 3.3.4; Medium 6.4)
- [WPSEC-2026-0991](https://wpsec.com/vuln/WPSEC-2026-0991/) 2026-10-15: Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Valid Pre-2FA Session (fixed in 1.6.9; High 8.1)
- [WPSEC-2026-0990](https://wpsec.com/vuln/WPSEC-2026-0990/) 2026-10-15: Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass for Multisite Super Administrators (fixed in 1.6.9; High 8.1)
- [WPSEC-2026-0989](https://wpsec.com/vuln/WPSEC-2026-0989/) 2026-10-15: Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Brute Force (fixed in 1.6.9; High 8.1)
- [WPSEC-2026-0988](https://wpsec.com/vuln/WPSEC-2026-0988/) 2026-10-15: OTP Login With Phone Number, OTP Verification <= 1.8.77 - Unauthenticated Authentication Bypass via Firebase Phone Number Verification (fixed in 1.8.78; High 8.1)
- [WPSEC-2026-0987](https://wpsec.com/vuln/WPSEC-2026-0987/) 2026-10-15: OTP Login With Phone Number, OTP Verification <= 1.8.77 - Authenticated (Subscriber+) Insecure Direct Object Reference to Email Address Takeover via Email Change (fixed in 1.8.78; Medium 6.5)
- [WPSEC-2026-0986](https://wpsec.com/vuln/WPSEC-2026-0986/) 2026-10-15: Bulk Page Generator <= 3.1.0 - Authenticated (Subscriber+) Missing Authorization to App Connection Token Generation (fixed in 3.1.1; Medium 5.4)
- [WPSEC-2026-0985](https://wpsec.com/vuln/WPSEC-2026-0985/) 2026-10-15: Restrict Usernames Emails Characters Plugin <= 5.0.3 - Unauthenticated Missing Authorization to Site-Wide Maintenance Mode (DoS) and Nicename Data Deletion via Bulk Nicename Update Actions (fixed in 5.1; High 8.2)
- [WPSEC-2026-0984](https://wpsec.com/vuln/WPSEC-2026-0984/) 2026-10-15: Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Authenticated (Subscriber+) Missing Authorization to Post and Term Enumeration via Builder Condition AJAX Actions (fixed in 4.7.7; Medium 4.3)
- [WPSEC-2026-0983](https://wpsec.com/vuln/WPSEC-2026-0983/) 2026-10-15: Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Missing Authorization to Unauthenticated User Role Modification via View Admin Role (fixed in 4.7.7; Medium 5.3)
- [WPSEC-2026-0982](https://wpsec.com/vuln/WPSEC-2026-0982/) 2026-10-15: Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Unauthenticated Login Attempt Limit Bypass via IP Spoofing (fixed in 4.7.7; Medium 6.5)
- [WPSEC-2026-0981](https://wpsec.com/vuln/WPSEC-2026-0981/) 2026-10-15: Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Authenticated (Author+) Arbitrary File Upload via Custom Font Upload (fixed in 4.7.7; High 7.5)
- [WPSEC-2026-0980](https://wpsec.com/vuln/WPSEC-2026-0980/) 2026-10-15: Insights from Google PageSpeed <= 4.0.8 - Missing Authorization to Unauthenticated Full Report Recheck Trigger (fixed in 5.0.0; Medium 5.3)
- [WPSEC-2026-0979](https://wpsec.com/vuln/WPSEC-2026-0979/) 2026-10-15: RegistrationMagic <= 6.1.0.1 - Unauthenticated Payment Bypass via PayPal IPN Sandbox Verification (fixed in 6.1.0.2; Medium 5.3)
- [WPSEC-2026-0978](https://wpsec.com/vuln/WPSEC-2026-0978/) 2026-10-15: SureForms <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embedded Post Title Smart Tag (fixed in 2.12.9; Medium 6.4)
- [WPSEC-2026-0977](https://wpsec.com/vuln/WPSEC-2026-0977/) 2026-10-15: SureForms <= 2.12.8 - Authenticated (Contributor+) Sensitive Information Exposure via Smart Tags in Post Content (fixed in 2.12.9; High 7.7)
- [WPSEC-2026-0976](https://wpsec.com/vuln/WPSEC-2026-0976/) 2026-10-15: SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.1 - Unauthenticated Denial of Service via 'max_page' Parameter (fixed in 3.1.2; Medium 5.3)
- [WPSEC-2026-0975](https://wpsec.com/vuln/WPSEC-2026-0975/) 2026-10-15: Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.0 - Unauthenticated Price Manipulation via Booking Form Quantity Parameters (fixed in 2.8.1; Medium 5.3)
- [WPSEC-2026-0974](https://wpsec.com/vuln/WPSEC-2026-0974/) 2026-10-14: Site Reviews <= 8.3.4 - Unauthenticated IP Address Spoofing via Proxy HTTP Header (fixed in 8.3.5; Low 3.7)
- [WPSEC-2026-0973](https://wpsec.com/vuln/WPSEC-2026-0973/) 2026-10-14: FileBird – WordPress Media Library Folders & File Manager <= 6.5.8 - Authenticated (Author+) CSV Injection via Folder Name (fixed in 6.5.9; Medium 4.4)
- [WPSEC-2026-0972](https://wpsec.com/vuln/WPSEC-2026-0972/) 2026-10-14: FileBird – WordPress Media Library Folders & File Manager <= 6.5.8 - Authenticated (Contributor+) Missing Authorization to Other Users' Folder Move, Duplication and Color Change (fixed in 6.5.9; Medium 4.3)
- [WPSEC-2026-0971](https://wpsec.com/vuln/WPSEC-2026-0971/) 2026-10-14: FileBird – WordPress Media Library Folders & File Manager <= 6.5.8 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Folder Assignment (fixed in 6.5.9; Medium 4.3)
- [WPSEC-2026-0970](https://wpsec.com/vuln/WPSEC-2026-0970/) 2026-10-14: The Events Calendar <= 6.18.0 - Unauthenticated Denial of Service via 'posts_per_page' Parameter (fixed in 6.18.1; Medium 5.3)
- [WPSEC-2026-0969](https://wpsec.com/vuln/WPSEC-2026-0969/) 2026-10-14: MDTF – Meta Data and Taxonomies Filter <= 1.3.9 - Authenticated (Contributor+) Arbitrary Post Meta Update via Filter Data on Post Save (fixed in 1.4.0; Medium 4.3)
- [WPSEC-2026-0968](https://wpsec.com/vuln/WPSEC-2026-0968/) 2026-10-14: MDTF – Meta Data and Taxonomies Filter <= 1.3.9 - Authenticated (Contributor+) Missing Authorization to Filter Meta Key Rename (fixed in 1.4.0; Medium 4.3)
- [WPSEC-2026-0967](https://wpsec.com/vuln/WPSEC-2026-0967/) 2026-10-14: MDTF – Meta Data and Taxonomies Filter <= 1.3.9 - Authenticated (Contributor+) Sensitive Information Exposure via mdf_value Shortcode (fixed in 1.4.0; Medium 4.3)
- [WPSEC-2026-0966](https://wpsec.com/vuln/WPSEC-2026-0966/) 2026-10-14: MDTF – Meta Data and Taxonomies Filter <= 1.3.9 - Authenticated (Subscriber+) Server-Side Request Forgery via Statistics Connection Check (fixed in 1.4.0; Medium 5.0)
- [WPSEC-2026-0965](https://wpsec.com/vuln/WPSEC-2026-0965/) 2026-10-14: TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via #TRPLINKPROCESSED Marker in URLs (fixed in 3.3.8; High 7.2)
- [WPSEC-2026-0964](https://wpsec.com/vuln/WPSEC-2026-0964/) 2026-10-14: EWWW Image Optimizer <= 8.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load 'data-script' and 'data-link' Attributes (fixed in 8.9.0; Medium 4.9)
- [WPSEC-2026-0963](https://wpsec.com/vuln/WPSEC-2026-0963/) 2026-10-14: Geo Controller <= 9.0.2 - Authenticated (Subscriber+) Missing Authorization to Plugin Integration Support Actions (fixed in 9.0.3; Medium 4.3)
- [WPSEC-2026-0962](https://wpsec.com/vuln/WPSEC-2026-0962/) 2026-10-14: Geo Controller <= 9.0.2 - Unauthenticated IP Address Spoofing via Forwarding Headers (fixed in 9.0.3; Medium 5.3)
- [WPSEC-2026-0961](https://wpsec.com/vuln/WPSEC-2026-0961/) 2026-10-14: CP Multi View Event Calendar <= 1.4.41 - Missing Authorization to Authenticated (Contributor+) Calendar View Modification and Event Deletion (fixed in 1.4.42; Medium 5.4)
- [WPSEC-2026-0960](https://wpsec.com/vuln/WPSEC-2026-0960/) 2026-10-14: CP Multi View Event Calendar <= 1.4.41 - Authenticated (Contributor+) SQL Injection via 'params' Parameter (fixed in 1.4.42; Medium 6.5)
- [WPSEC-2026-0959](https://wpsec.com/vuln/WPSEC-2026-0959/) 2026-10-14: Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.4 - Unauthenticated Insecure Direct Object Reference to Restricted Gallery Image Exposure via Share, Add to Cart, and Product Options AJAX Actions (fixed in 3.7.5; Medium 5.3)
- [WPSEC-2026-0958](https://wpsec.com/vuln/WPSEC-2026-0958/) 2026-10-14: Ultimate Product Catalog <= 5.4.0 - Cross-Site Request Forgery to Custom Field Definitions Update (fixed in 5.5.0; Medium 4.3)
- [WPSEC-2026-0957](https://wpsec.com/vuln/WPSEC-2026-0957/) 2026-10-14: MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.6 - Unauthenticated Privilege Escalation via Account Takeover through Optin Form Field Mapping Parameter (fixed in 1.2.78.7; High 8.1)
- [WPSEC-2026-0956](https://wpsec.com/vuln/WPSEC-2026-0956/) 2026-10-14: WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.87 - Missing Authorization to Authenticated (Subscriber+) Remote Database Connection Test (fixed in 5.5.88; Medium 4.3)
- [WPSEC-2026-0955](https://wpsec.com/vuln/WPSEC-2026-0955/) 2026-10-14: Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via Contact File Copying (fixed in 4.9.4; High 8.1)
- [WPSEC-2026-0954](https://wpsec.com/vuln/WPSEC-2026-0954/) 2026-10-14: YITH WooCommerce Compare <= 3.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute (fixed in 3.15.1; Medium 6.4)
- [WPSEC-2026-0953](https://wpsec.com/vuln/WPSEC-2026-0953/) 2026-10-14: VikRentCar Car Rental Management System <= 1.4.7 - Unauthenticated Reflected Cross-Site Scripting via 'cid', 'vrc_active_tab', 'goto', 'vrc_lang' and 'status' Parameters (fixed in 1.4.8; Medium 6.1)
- [WPSEC-2026-0952](https://wpsec.com/vuln/WPSEC-2026-0952/) 2026-10-14: VikRentCar Car Rental Management System <= 1.4.7 - Unauthenticated Reflected Cross-Site Scripting via Booking Parameters (fixed in 1.4.8; Medium 6.1)
- [WPSEC-2026-0951](https://wpsec.com/vuln/WPSEC-2026-0951/) 2026-10-14: MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated Open Redirect via Tracked Link Shortcodes and Personalization Tags (fixed in 5.42.0; Medium 4.7)
- [WPSEC-2026-0950](https://wpsec.com/vuln/WPSEC-2026-0950/) 2026-10-14: MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated CAPTCHA Bypass via Answer Replay on Registration Forms (fixed in 5.42.0; Medium 5.3)
- [WPSEC-2026-0949](https://wpsec.com/vuln/WPSEC-2026-0949/) 2026-10-14: MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated Open Redirect via 'referrer_form_url' Parameter (fixed in 5.42.0; Medium 6.1)
- [WPSEC-2026-0948](https://wpsec.com/vuln/WPSEC-2026-0948/) 2026-10-14: RSS Aggregator by Feedzy <= 5.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Import Error Messages (fixed in 5.2.12; Medium 6.4)
- [WPSEC-2026-0947](https://wpsec.com/vuln/WPSEC-2026-0947/) 2026-10-14: Cardinity Payment Gateway for WooCommerce <= 3.4.1 - Missing Authorization to Unauthenticated Transaction Log Download (fixed in 3.4.2; Medium 5.3)
- [WPSEC-2026-0946](https://wpsec.com/vuln/WPSEC-2026-0946/) 2026-10-14: Cardinity Payment Gateway for WooCommerce <= 3.4.1 - Unauthenticated Order Status Manipulation via Hosted Checkout Callbacks (fixed in 3.4.2; High 7.5)
- [WPSEC-2026-0945](https://wpsec.com/vuln/WPSEC-2026-0945/) 2026-10-14: Security Ninja – WordPress Security & Firewall <= 5.303 - Unauthenticated Firewall Bypass via Empty Secret Access URL Token (fixed in 5.305; Medium 5.3)
- [WPSEC-2026-0944](https://wpsec.com/vuln/WPSEC-2026-0944/) 2026-10-14: Nexter Extension – Site Enhancements Toolkit <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation via View Admin As Role Switcher (fixed in 4.7.12; High 7.5)
- [WPSEC-2026-0943](https://wpsec.com/vuln/WPSEC-2026-0943/) 2026-10-14: Quick PayPal Payments <= 6.0.3 - Unauthenticated Payment Amount Manipulation via Payment Form Parameters (fixed in 6.0.4; Medium 5.3)
- [WPSEC-2026-0942](https://wpsec.com/vuln/WPSEC-2026-0942/) 2026-10-14: Booking Package <= 1.7.30 - Authenticated (Booking Package Editor+) Stored Cross-Site Scripting via Front-End JavaScript Setting (fixed in 1.7.31; Medium 4.9)
- [WPSEC-2026-0941](https://wpsec.com/vuln/WPSEC-2026-0941/) 2026-10-14: Booking Package <= 1.7.30 - Unauthenticated Sensitive Information Exposure via 'createCustomer' Action (fixed in 1.7.31; Medium 5.3)
- [WPSEC-2026-0940](https://wpsec.com/vuln/WPSEC-2026-0940/) 2026-10-14: Booking Package <= 1.7.30 - Missing Authorization to Unauthenticated Paid Subscription Deactivation (fixed in 1.7.31; Medium 5.3)
- [WPSEC-2026-0939](https://wpsec.com/vuln/WPSEC-2026-0939/) 2026-10-14: InstaWP Connect – 1-click WP Staging & Migration <= 0.1.4.1 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Plugin/Theme Zip Copies (fixed in 0.1.4.2; Medium 5.3)
- [WPSEC-2026-0938](https://wpsec.com/vuln/WPSEC-2026-0938/) 2026-10-14: Sticky Ads Lightweight <= 3.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Ad Code Setting (fixed in 3.4.0; Medium 4.4)
- [WPSEC-2026-0937](https://wpsec.com/vuln/WPSEC-2026-0937/) 2026-10-14: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page (fixed in 1.15.0.0.1; Medium 5.3)
- [WPSEC-2026-0936](https://wpsec.com/vuln/WPSEC-2026-0936/) 2026-10-14: MainWP Dashboard <= 6.2.2 - Authenticated (REST API Key Holder) Authentication Scope Bypass via Crafted Request URI (fixed in 6.2.3; High 7.2)
- [WPSEC-2026-0935](https://wpsec.com/vuln/WPSEC-2026-0935/) 2026-10-14: MainWP Dashboard <= 6.2.2 - Insufficient Session Expiration via REST API Keys of Deleted or Removed Users (fixed in 6.2.3; Medium 5.9)
- [WPSEC-2026-0934](https://wpsec.com/vuln/WPSEC-2026-0934/) 2026-10-14: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page (fixed in 1.15.0.1.1; Medium 5.3)
- [WPSEC-2026-0933](https://wpsec.com/vuln/WPSEC-2026-0933/) 2026-10-14: Welcart e-Commerce <= 2.12.4 - Cross-Site Request Forgery to Member Account Update and Login (fixed in 2.12.5; High 8.1)
- [WPSEC-2026-0932](https://wpsec.com/vuln/WPSEC-2026-0932/) 2026-10-14: Welcart e-Commerce <= 2.12.4 - Unauthenticated Payment Bypass via Forged Digitalcheck Card Payment Notification (fixed in 2.12.5; Medium 5.3)
- [WPSEC-2026-0931](https://wpsec.com/vuln/WPSEC-2026-0931/) 2026-10-14: Welcart e-Commerce <= 2.12.4 - Unauthenticated Payment Amount Manipulation via 'money' Parameter (fixed in 2.12.5; Medium 5.3)
- [WPSEC-2026-0930](https://wpsec.com/vuln/WPSEC-2026-0930/) 2026-10-14: Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via Order List Search Condition Cookie (fixed in 2.12.5; Medium 4.9)
- [WPSEC-2026-0929](https://wpsec.com/vuln/WPSEC-2026-0929/) 2026-10-14: SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Unauthenticated Sensitive Information Exposure via Line Items and Checkouts REST Endpoints (fixed in 4.9.5; Medium 5.3)
- [WPSEC-2026-0928](https://wpsec.com/vuln/WPSEC-2026-0928/) 2026-10-14: SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-icon Web Component (fixed in 4.9.5; Medium 5.4)
- [WPSEC-2026-0927](https://wpsec.com/vuln/WPSEC-2026-0927/) 2026-10-14: WP VR <= 9.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via Scene Image URL (fixed in 9.3.0; Medium 5.4)
- [WPSEC-2026-0926](https://wpsec.com/vuln/WPSEC-2026-0926/) 2026-10-14: rtMedia for WordPress, BuddyPress and bbPress <= 4.7.14 - Unauthenticated Insecure Direct Object Reference to Activity Overwrite via 'activity_id' Parameter (fixed in 4.7.15; Medium 5.3)
- [WPSEC-2026-0925](https://wpsec.com/vuln/WPSEC-2026-0925/) 2026-10-14: rtMedia for WordPress, BuddyPress and bbPress <= 4.7.14 - Unauthenticated Insecure Direct Object Reference via 'rtMedia_attached_files' Parameter (fixed in 4.7.15; Medium 5.3)
- [WPSEC-2026-0924](https://wpsec.com/vuln/WPSEC-2026-0924/) 2026-10-14: s2Member <= 261001 - Unauthenticated Missing Authorization to Protected Content via REST API (fixed in 261011; Medium 5.3)
- [WPSEC-2026-0923](https://wpsec.com/vuln/WPSEC-2026-0923/) 2026-10-14: Broken Link Checker <= 2.4.14.1 - Unauthenticated Authentication Bypass to Scan Report Recipient Removal (fixed in 2.4.15; Medium 5.3)
- [WPSEC-2026-0922](https://wpsec.com/vuln/WPSEC-2026-0922/) 2026-10-14: Broken Link Checker <= 2.4.14.1 - Unauthenticated Sensitive Information Exposure via REST API User Roles Field (fixed in 2.4.15; Medium 5.3)
- [WPSEC-2026-0921](https://wpsec.com/vuln/WPSEC-2026-0921/) 2026-10-14: Broken Link Checker <= 2.4.14.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Truncation and .htaccess Overwrite via Custom Log File Path (fixed in 2.4.15; Medium 5.9)
- [WPSEC-2026-0920](https://wpsec.com/vuln/WPSEC-2026-0920/) 2026-10-14: Broken Link Checker <= 2.4.14.1 - Authenticated (Editor+) Missing Authorization to Broken Link Edit, Unlink and Deredirect (fixed in 2.4.15; Low 2.7)
- [WPSEC-2026-0919](https://wpsec.com/vuln/WPSEC-2026-0919/) 2026-10-14: Broken Link Checker <= 2.4.14.1 - Cross-Site Request Forgery to Scan Data Deletion via Recheck (fixed in 2.4.15; Medium 4.3)
- [WPSEC-2026-0918](https://wpsec.com/vuln/WPSEC-2026-0918/) 2026-10-14: Broken Link Checker <= 2.4.14.1 - Authenticated (Contributor+) PHP Object Injection via SiteOrigin panels_data Post Meta (fixed in 2.4.15; High 7.1)
- [WPSEC-2026-0917](https://wpsec.com/vuln/WPSEC-2026-0917/) 2026-10-14: GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Rank Modification via gamipress_profile_update_user_rank AJAX Action (fixed in 8.0.6; Medium 4.3)
- [WPSEC-2026-0916](https://wpsec.com/vuln/WPSEC-2026-0916/) 2026-10-14: GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Sensitive Information Exposure via Log Extra Data AJAX Action (fixed in 8.0.6; Medium 4.3)
- [WPSEC-2026-0915](https://wpsec.com/vuln/WPSEC-2026-0915/) 2026-10-14: GamiPress <= 8.0.5 - Unauthenticated Sensitive Information Exposure via 'user_id' Parameter of gamipress_get_logs AJAX Action (fixed in 8.0.6; Medium 5.3)
- [WPSEC-2026-0914](https://wpsec.com/vuln/WPSEC-2026-0914/) 2026-10-14: GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Points and Rank Modification via REST API User Meta (fixed in 8.0.6; Medium 4.3)
- [WPSEC-2026-0913](https://wpsec.com/vuln/WPSEC-2026-0913/) 2026-10-14: Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Authenticated (Author+) Arbitrary File Deletion via 'lightboxThumbnailUrl' (fixed in 5.7; High 8.1)
- [WPSEC-2026-0912](https://wpsec.com/vuln/WPSEC-2026-0912/) 2026-10-14: Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Unauthenticated DOM-Based Cross-Site Scripting via 'r3d-' URL Parameters (fixed in 5.7; Medium 6.1)
- [WPSEC-2026-0911](https://wpsec.com/vuln/WPSEC-2026-0911/) 2026-10-14: Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Profile Page Localized Options (fixed in 4.5.16; Medium 4.3)
- [WPSEC-2026-0910](https://wpsec.com/vuln/WPSEC-2026-0910/) 2026-10-14: Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field File URL (fixed in 4.5.16; Medium 6.4)
- [WPSEC-2026-0909](https://wpsec.com/vuln/WPSEC-2026-0909/) 2026-10-14: Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Missing Authorization to Restricted Profile Field Update via 'checkuser_id' Parameter (fixed in 4.5.16; Medium 4.3)
- [WPSEC-2026-0908](https://wpsec.com/vuln/WPSEC-2026-0908/) 2026-10-14: Theme My Login <= 7.3.0 - Cross-Site Request Forgery to Multisite Site Creation via Signup Form (fixed in 7.3.1; Medium 4.3)
- [WPSEC-2026-0907](https://wpsec.com/vuln/WPSEC-2026-0907/) 2026-10-14: Strong Testimonials <= 3.3.12 - Unauthenticated HTML Injection via Comments (fixed in 3.3.13; Medium 4.3)
- [WPSEC-2026-0906](https://wpsec.com/vuln/WPSEC-2026-0906/) 2026-10-14: Strong Testimonials <= 3.3.12 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Form Preview (fixed in 3.3.13; Medium 6.3)
- [WPSEC-2026-0905](https://wpsec.com/vuln/WPSEC-2026-0905/) 2026-10-14: PWA for WP & AMP <= 1.7.88.1 - Unauthenticated Sensitive Information Exposure via Publicly Accessible FCM Service-Account JSON File (fixed in 1.7.88.2; Medium 5.9)
- [WPSEC-2026-0904](https://wpsec.com/vuln/WPSEC-2026-0904/) 2026-10-14: Recipe Maker <= 10.8.5 - Unauthenticated Sensitive Information Exposure via Private and Trashed Recipes (fixed in 10.9.0; Medium 5.3)
- [WPSEC-2026-0903](https://wpsec.com/vuln/WPSEC-2026-0903/) 2026-10-14: Elementor Website Builder <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CDATA Sections (fixed in 4.3.5; Medium 4.9)
- [WPSEC-2026-0902](https://wpsec.com/vuln/WPSEC-2026-0902/) 2026-10-14: Elementor Website Builder <= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline Post CSS (fixed in 4.3.5; Medium 4.9)
- [WPSEC-2026-0901](https://wpsec.com/vuln/WPSEC-2026-0901/) 2026-10-14: Elementor Website Builder <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload Validation Bypass (fixed in 4.3.5; Medium 4.9)
- [WPSEC-2026-0900](https://wpsec.com/vuln/WPSEC-2026-0900/) 2026-10-14: Personio Integration Light <= 5.7.1 - Authenticated (Position Manager+) SQL Injection via Backend Position Search (fixed in 6.0.0; Medium 4.9)
- [WPSEC-2026-0899](https://wpsec.com/vuln/WPSEC-2026-0899/) 2026-10-14: Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.2 - Authenticated (Editor+) PHP Object Injection via Template Import (fixed in 6.4.0; Medium 6.6)
- [WPSEC-2026-0898](https://wpsec.com/vuln/WPSEC-2026-0898/) 2026-10-14: Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.2 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Collection Rendering 'context' Parameter (fixed in 6.4.0; Medium 5.3)
- [WPSEC-2026-0897](https://wpsec.com/vuln/WPSEC-2026-0897/) 2026-10-14: affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Sensitive Information Exposure via AJAX Render Endpoint (fixed in 3.9.2; Low 3.7)
- [WPSEC-2026-0896](https://wpsec.com/vuln/WPSEC-2026-0896/) 2026-10-14: affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Server-Side Request Forgery via Image Proxy (fixed in 3.9.2; Medium 5.4)
- [WPSEC-2026-0895](https://wpsec.com/vuln/WPSEC-2026-0895/) 2026-10-14: AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info (fixed in 1.1.19; Medium 6.3)
- [WPSEC-2026-0894](https://wpsec.com/vuln/WPSEC-2026-0894/) 2026-10-14: Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via Google Fonts Inline Minify (fixed in 1.4.0; Medium 5.9)
- [WPSEC-2026-0893](https://wpsec.com/vuln/WPSEC-2026-0893/) 2026-10-14: Polylang <= 3.8.10 - Authenticated (Editor+) PHP Object Injection via Term Description (fixed in 3.8.11; Medium 6.6)
- [WPSEC-2026-0892](https://wpsec.com/vuln/WPSEC-2026-0892/) 2026-10-14: User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via Signup Details on Unconfirmed Emails List (fixed in 4.0.4; Medium 4.7)
- [WPSEC-2026-0891](https://wpsec.com/vuln/WPSEC-2026-0891/) 2026-10-14: User Profile Builder <= 4.0.3 - Authenticated (Author+) Privilege Escalation via Register Block and Elementor Widget (fixed in 4.0.4; High 8.8)
- [WPSEC-2026-0890](https://wpsec.com/vuln/WPSEC-2026-0890/) 2026-10-14: User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via 'role' Custom Field on Registration with Email Confirmation (fixed in 4.0.4; High 8.1)
- [WPSEC-2026-0889](https://wpsec.com/vuln/WPSEC-2026-0889/) 2026-10-14: User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name in Avatar Image (fixed in 4.0.4; Medium 6.4)
- [WPSEC-2026-0888](https://wpsec.com/vuln/WPSEC-2026-0888/) 2026-10-14: User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via Select (User Role) Field (fixed in 4.0.4; High 8.1)
- [WPSEC-2026-0887](https://wpsec.com/vuln/WPSEC-2026-0887/) 2026-10-14: Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via Review Form (fixed in 1.68; High 7.2)
- [WPSEC-2026-0886](https://wpsec.com/vuln/WPSEC-2026-0886/) 2026-10-14: Joinchat <= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Joinchat Button Block 'message' Attribute (fixed in 6.4.2; Medium 6.4)
- [WPSEC-2026-0885](https://wpsec.com/vuln/WPSEC-2026-0885/) 2026-10-14: GTM4WP <= 2.0.5 - Unauthenticated Sensitive Information Exposure via Cached Custom Order Received Page (fixed in 2.0.6; Low 3.7)
- [WPSEC-2026-0884](https://wpsec.com/vuln/WPSEC-2026-0884/) 2026-10-14: Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Sensitive Information Exposure via Data Request REST Endpoint (fixed in 7.5.6; Medium 5.3)
- [WPSEC-2026-0883](https://wpsec.com/vuln/WPSEC-2026-0883/) 2026-10-14: Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via YotuWP Cookie Blocker (fixed in 7.5.6; Medium 5.4)
- [WPSEC-2026-0882](https://wpsec.com/vuln/WPSEC-2026-0882/) 2026-10-14: Culture Object <= 4.3 - Unauthenticated Missing Authorization to Imported Object Deletion via Debug Purge (fixed in 4.4; Medium 6.5)
- [WPSEC-2026-0881](https://wpsec.com/vuln/WPSEC-2026-0881/) 2026-10-14: WordPress Pinterest Plugin <= 1.9.2 - Authenticated (Contributor+) PHP Object Injection via Asset Cache Post Meta (fixed in 1.9.3; High 7.5)
- [WPSEC-2026-0880](https://wpsec.com/vuln/WPSEC-2026-0880/) 2026-10-14: GS Team Members <= 2.8.2 - Authenticated (Contributor+) PHP Object Injection via Asset Cache Post Meta (fixed in 2.8.3; High 7.5)
- [WPSEC-2026-0879](https://wpsec.com/vuln/WPSEC-2026-0879/) 2026-10-14: GS Team Members <= 2.8.2 - Authenticated (Subscriber+) Missing Authorization to Freemius Account Connection (fixed in 2.8.3; Medium 4.3)
- [WPSEC-2026-0878](https://wpsec.com/vuln/WPSEC-2026-0878/) 2026-10-14: Easy Property Listings <= 3.5.26 - Authenticated (Subscriber+) Missing Authorization to Username Disclosure via epl_search_user AJAX Action (fixed in 3.5.27; Medium 4.3)
- [WPSEC-2026-0877](https://wpsec.com/vuln/WPSEC-2026-0877/) 2026-10-14: Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter (fixed in 2.4.5; Critical 9.8)
- [WPSEC-2026-0876](https://wpsec.com/vuln/WPSEC-2026-0876/) 2026-10-14: Mang Board <= 2.4.4 - Unauthenticated Stored Cross-Site Scripting via Board Post Content (fixed in 2.4.5; High 7.2)
- [WPSEC-2026-0875](https://wpsec.com/vuln/WPSEC-2026-0875/) 2026-10-14: Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Email Verification Bypass via Activation Token Reuse (fixed in 4.1.5; Medium 5.4)
- [WPSEC-2026-0874](https://wpsec.com/vuln/WPSEC-2026-0874/) 2026-10-14: Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Front-End Component Attributes (fixed in 4.7.2; Medium 6.4)
- [WPSEC-2026-0873](https://wpsec.com/vuln/WPSEC-2026-0873/) 2026-10-14: Login using WordPress Users ( WP as SAML IDP ) <= 2.0.1 - Unauthenticated Denial of Service via SAMLRequest Decompression (fixed in 2.0.2; Medium 5.3)
- [WPSEC-2026-0872](https://wpsec.com/vuln/WPSEC-2026-0872/) 2026-10-14: Login using WordPress Users ( WP as SAML IDP ) <= 2.0.1 - Unauthenticated Denial of Service via SP Tracking Cookie (fixed in 2.0.2; High 7.5)
- [WPSEC-2026-0871](https://wpsec.com/vuln/WPSEC-2026-0871/) 2026-10-14: WP Simple Shopping Cart <= 5.3.2 - Unauthenticated Payment Bypass via PayPal Standard IPN Receiver Email (fixed in 5.3.3; Medium 5.3)
- [WPSEC-2026-0870](https://wpsec.com/vuln/WPSEC-2026-0870/) 2026-10-14: WP Simple Shopping Cart <= 5.3.2 - Authenticated (Contributor+) Product Price Manipulation via Dynamic Product Registration (fixed in 5.3.3; Medium 4.3)
- [WPSEC-2026-0869](https://wpsec.com/vuln/WPSEC-2026-0869/) 2026-10-14: Joli Table Of Contents <= 3.0.3 - Reflected Cross-Site Scripting via Pricing Page Query Parameters (fixed in 3.0.4; Medium 6.1)
- [WPSEC-2026-0868](https://wpsec.com/vuln/WPSEC-2026-0868/) 2026-10-14: YayMail – WooCommerce Email Customizer <= 4.4.6 - Authenticated (Shop Manager+) PHP Object Injection via Backup State Import (fixed in 4.4.7; Medium 6.6)
- [WPSEC-2026-0867](https://wpsec.com/vuln/WPSEC-2026-0867/) 2026-10-14: Link Whisper Free <= 0.9.7 - Authenticated (Contributor+) PHP Object Injection via Link Whisper Post Meta (fixed in 0.9.8; High 7.5)
- [WPSEC-2026-0866](https://wpsec.com/vuln/WPSEC-2026-0866/) 2026-10-14: Link Whisper Free <= 0.9.7 - Unauthenticated CSV Injection via Click Tracking Anchor Text (fixed in 0.9.8; Medium 5.4)
- [WPSEC-2026-0865](https://wpsec.com/vuln/WPSEC-2026-0865/) 2026-10-14: Link Whisper Free <= 0.9.7 - Authenticated (Editor+) SQL Injection via 'orderby' and 'post_id' Parameters (fixed in 0.9.8; Medium 4.9)
- [WPSEC-2026-0864](https://wpsec.com/vuln/WPSEC-2026-0864/) 2026-10-14: Link Whisper Free <= 0.9.7 - Authenticated (Subscriber+) Missing Authorization to Broken Link Scan, Link Ignore List and Plugin Option Updates (fixed in 0.9.8; Medium 4.3)
- [WPSEC-2026-0863](https://wpsec.com/vuln/WPSEC-2026-0863/) 2026-10-14: Link Whisper Free <= 0.9.7 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'wpil_admin_frontend_data' Parameter (fixed in 0.9.8; Medium 6.1)
- [WPSEC-2026-0862](https://wpsec.com/vuln/WPSEC-2026-0862/) 2026-10-14: PowerPack Addons for Elementor <= 3.1.0 - Authenticated (Contributor+) Missing Authorization to Enabled Widgets and Extensions Modification (fixed in 3.1.1; Medium 4.3)
- [WPSEC-2026-0861](https://wpsec.com/vuln/WPSEC-2026-0861/) 2026-10-14: PowerPack Addons for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Gradient Background Colors (fixed in 3.1.1; Medium 6.4)
- [WPSEC-2026-0860](https://wpsec.com/vuln/WPSEC-2026-0860/) 2026-10-14: MPG <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'base-url' Shortcode Attribute (fixed in 4.2.5; Medium 6.4)
- [WPSEC-2026-0859](https://wpsec.com/vuln/WPSEC-2026-0859/) 2026-10-13: Mixed Media Gallery Blocks <= 3.4.4 - Authenticated (Contributor+) Missing Authorization to Shared Media Tag Deletion (fixed in 3.4.5; Medium 4.3)
- [WPSEC-2026-0858](https://wpsec.com/vuln/WPSEC-2026-0858/) 2026-10-13: Mixed Media Gallery Blocks <= 3.4.4 - Authenticated (Author+) Missing Authorization to Media Folder Modification and Deletion (fixed in 3.4.5; Medium 4.3)
- [WPSEC-2026-0857](https://wpsec.com/vuln/WPSEC-2026-0857/) 2026-10-13: Books Gallery – Book Showcase, Library & Affiliate Plugin <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Book Author Meta (fixed in 4.8.5; Medium 6.4)
- [WPSEC-2026-0856](https://wpsec.com/vuln/WPSEC-2026-0856/) 2026-10-13: TI WooCommerce Wishlist <= 2.12.1 - Unauthenticated Authorization Bypass to Guest Wishlist Takeover via 'tinv_wishlistkey' Cookie (fixed in 2.13.0; Medium 6.5)
- [WPSEC-2026-0855](https://wpsec.com/vuln/WPSEC-2026-0855/) 2026-10-13: TI WooCommerce Wishlist <= 2.12.1 - Unauthenticated Sensitive Information Exposure of Private Wishlists via 'tinvwl-sharekey' Parameter (fixed in 2.13.0; Low 3.7)
- [WPSEC-2026-0854](https://wpsec.com/vuln/WPSEC-2026-0854/) 2026-10-13: Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.9 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Booking Calendar Files (fixed in 10.31.10; Medium 5.3)
- [WPSEC-2026-0853](https://wpsec.com/vuln/WPSEC-2026-0853/) 2026-10-13: Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Fields (fixed in 10.31.10; High 7.2)
- [WPSEC-2026-0852](https://wpsec.com/vuln/WPSEC-2026-0852/) 2026-10-13: Sprout Invoices – Client Invoicing & Estimates <= 20.8.18 - Authenticated (Contributor+) Sensitive Information Exposure via Client Associated Users Selector (fixed in 20.8.19; Medium 4.3)
- [WPSEC-2026-0851](https://wpsec.com/vuln/WPSEC-2026-0851/) 2026-10-13: MultiVendorX <= 5.0.19 - Authenticated (Store Owner+) Missing Authorization to Global Settings Update via REST API (fixed in 5.0.20; Medium 4.3)
- [WPSEC-2026-0850](https://wpsec.com/vuln/WPSEC-2026-0850/) 2026-10-13: Appointment Booking Plugin & Scheduling System – Webba Booking Calendar <= 6.5.2 - Unauthenticated Insecure Direct Object Reference to Gift Card Code Disclosure via Gift Card Status REST Endpoint (fixed in 6.5.3; Medium 6.5)
- [WPSEC-2026-0849](https://wpsec.com/vuln/WPSEC-2026-0849/) 2026-10-13: Flutterwave Payments <= 1.0.7 - Unauthenticated Stored Cross-Site Scripting via Transactions List (fixed in 1.1.0; High 7.2)
- [WPSEC-2026-0848](https://wpsec.com/vuln/WPSEC-2026-0848/) 2026-10-13: Flutterwave Payments <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (fixed in 1.1.0; Medium 6.4)
- [WPSEC-2026-0847](https://wpsec.com/vuln/WPSEC-2026-0847/) 2026-10-13: Easy Property Listings <= 3.5.25 - Unauthenticated Reflected Cross-Site Scripting via 'epl_action' Parameter (fixed in 3.5.26; Medium 6.1)
- [WPSEC-2026-0846](https://wpsec.com/vuln/WPSEC-2026-0846/) 2026-10-13: Easy Property Listings <= 3.5.25 - Authenticated (Contributor+) SQL Injection via 'property_status' Shortcode Attribute (fixed in 3.5.26; Medium 6.5)
- [WPSEC-2026-0845](https://wpsec.com/vuln/WPSEC-2026-0845/) 2026-10-13: Sidebar Login <= 3.0.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Display Name (fixed in 3.1.0; Medium 5.4)
- [WPSEC-2026-0844](https://wpsec.com/vuln/WPSEC-2026-0844/) 2026-10-13: FluentCart A New Era of eCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure via Smartcode Injection in Checkout Fields (fixed in 1.8.0; High 7.5)
- [WPSEC-2026-0843](https://wpsec.com/vuln/WPSEC-2026-0843/) 2026-10-13: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.5 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order Pay Page (fixed in 1.14.0.5.1; Medium 5.3)
- [WPSEC-2026-0842](https://wpsec.com/vuln/WPSEC-2026-0842/) 2026-10-13: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.4 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page (fixed in 1.14.0.4.1; Medium 5.3)
- [WPSEC-2026-0841](https://wpsec.com/vuln/WPSEC-2026-0841/) 2026-10-13: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page (fixed in 1.14.0.3.1; Medium 5.3)
- [WPSEC-2026-0840](https://wpsec.com/vuln/WPSEC-2026-0840/) 2026-10-13: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.2 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page (fixed in 1.14.0.2.1; Medium 5.3)
- [WPSEC-2026-0839](https://wpsec.com/vuln/WPSEC-2026-0839/) 2026-10-13: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page (fixed in 1.14.0.1.1; Medium 5.3)
- [WPSEC-2026-0838](https://wpsec.com/vuln/WPSEC-2026-0838/) 2026-10-13: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page (fixed in 1.14.0.0.1; Medium 5.3)
- [WPSEC-2026-0837](https://wpsec.com/vuln/WPSEC-2026-0837/) 2026-10-13: Falang multilanguage for WordPress <= 1.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Term Translation (fixed in 1.4.6; Medium 6.4)
- [WPSEC-2026-0836](https://wpsec.com/vuln/WPSEC-2026-0836/) 2026-10-13: WP Booking System <= 2.1.0.2 - Reflected Cross-Site Scripting via 'booking_id' Parameter (fixed in 2.1.0.3; Medium 6.1)
- [WPSEC-2026-0835](https://wpsec.com/vuln/WPSEC-2026-0835/) 2026-10-13: Blog2Social: Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Private and Draft Post Disclosure via 'postId' Parameter (fixed in 9.1.5; Medium 4.3)
- [WPSEC-2026-0834](https://wpsec.com/vuln/WPSEC-2026-0834/) 2026-10-13: TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Unauthenticated Booking Price Manipulation (fixed in 1.3.0; Medium 5.3)
- [WPSEC-2026-0833](https://wpsec.com/vuln/WPSEC-2026-0833/) 2026-10-13: TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Unauthenticated Insecure Direct Object Reference to Booking Summary Disclosure (fixed in 1.3.0; Medium 5.3)
- [WPSEC-2026-0832](https://wpsec.com/vuln/WPSEC-2026-0832/) 2026-10-13: TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Category, Service, Customer and Appointment Deletion (fixed in 1.3.0; Medium 5.4)
- [WPSEC-2026-0831](https://wpsec.com/vuln/WPSEC-2026-0831/) 2026-10-13: TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Service, Category and Appointment Creation/Modification (fixed in 1.3.0; Medium 5.3)
- [WPSEC-2026-0830](https://wpsec.com/vuln/WPSEC-2026-0830/) 2026-10-13: MailChimp Forms by MailMunch <= 3.2.9 - Cross-Site Request Forgery to MailMunch Account Unlinking (fixed in 3.3.0; Medium 4.3)
- [WPSEC-2026-0829](https://wpsec.com/vuln/WPSEC-2026-0829/) 2026-10-13: Klarna Payments for WooCommerce <= 4.13.3 - Unauthenticated Insecure Direct Object Reference to Order Key and Customer Address Exposure via Order-Pay Page (fixed in 4.13.4; Medium 5.3)
- [WPSEC-2026-0828](https://wpsec.com/vuln/WPSEC-2026-0828/) 2026-10-13: Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Row Injection in Biographical Info (fixed in 2.7.6; High 7.1)
- [WPSEC-2026-0827](https://wpsec.com/vuln/WPSEC-2026-0827/) 2026-10-13: MailMunch – Grow your Email List <= 3.1.2 - Authenticated (Subscriber+) Missing Authorization to Account Linking and Widget/Email Management via AJAX Actions (fixed in 3.2.2; Medium 5.4)
- [WPSEC-2026-0826](https://wpsec.com/vuln/WPSEC-2026-0826/) 2026-10-13: Mollie Payments for WooCommerce <= 8.1.10 - Unauthenticated Insufficient Verification of Data Authenticity to Order Payment Bypass via Webhook (fixed in 8.1.11; Medium 5.3)
- [WPSEC-2026-0825](https://wpsec.com/vuln/WPSEC-2026-0825/) 2026-10-13: Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.13 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Shortcode Execution and Campaign Settings Disclosure via Builder Field Preview (fixed in 1.8.13.1; Medium 5.4)
- [WPSEC-2026-0824](https://wpsec.com/vuln/WPSEC-2026-0824/) 2026-10-13: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Member Name (fixed in 5.3.0; Medium 6.4)
- [WPSEC-2026-0823](https://wpsec.com/vuln/WPSEC-2026-0823/) 2026-10-13: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Checkbox Field Value (fixed in 5.3.0; Medium 6.4)
- [WPSEC-2026-0822](https://wpsec.com/vuln/WPSEC-2026-0822/) 2026-10-13: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Unauthenticated Sensitive Information Exposure via Scheduled Entry Export Files (fixed in 1.58.1; Medium 5.9)
- [WPSEC-2026-0821](https://wpsec.com/vuln/WPSEC-2026-0821/) 2026-10-13: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Unauthenticated Missing Authorization to AWeber Subscriber Modification (fixed in 1.58.1; Low 3.7)
- [WPSEC-2026-0820](https://wpsec.com/vuln/WPSEC-2026-0820/) 2026-10-13: Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.7 - Authenticated (Subscriber+) Sensitive Information Exposure via REST API Tickets Endpoints (fixed in 7.4.8; Medium 4.3)
- [WPSEC-2026-0819](https://wpsec.com/vuln/WPSEC-2026-0819/) 2026-10-13: Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.7 - Unauthenticated Clickjacking to OAuth Application Authorization (fixed in 7.4.8; Medium 6.8)
- [WPSEC-2026-0818](https://wpsec.com/vuln/WPSEC-2026-0818/) 2026-10-13: User Verification <= 2.0.46 - Unauthenticated Insecure Direct Object Reference to Account Lockout via Resend Verification (fixed in 2.0.48; Medium 6.5)
- [WPSEC-2026-0817](https://wpsec.com/vuln/WPSEC-2026-0817/) 2026-10-13: WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 - Unauthenticated Reflected Cross-Site Scripting via Script Blocker Placeholder Tokens (fixed in 4.4.7; Medium 6.1)
- [WPSEC-2026-0816](https://wpsec.com/vuln/WPSEC-2026-0816/) 2026-10-13: Zoho CRM Lead Magnet <= 1.8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site-Wide Post HTML Allowlist Modification (fixed in 1.8.2.4; Medium 6.4)
- [WPSEC-2026-0815](https://wpsec.com/vuln/WPSEC-2026-0815/) 2026-10-13: Zoho CRM Lead Magnet <= 1.8.2.3 - Improper Certificate Validation via Globally Disabled SSL Verification (fixed in 1.8.2.4; Medium 4.8)
- [WPSEC-2026-0814](https://wpsec.com/vuln/WPSEC-2026-0814/) 2026-10-13: Zoho CRM Lead Magnet <= 1.8.2.3 - Unauthenticated Reflected Cross-Site Scripting via Form Field Values (fixed in 1.8.2.4; Medium 6.1)
- [WPSEC-2026-0813](https://wpsec.com/vuln/WPSEC-2026-0813/) 2026-10-13: Zoho CRM Lead Magnet <= 1.8.2.3 - Missing Authorization to Authenticated (Subscriber+) Contact Form Field Mapping and CRM User Disclosure (fixed in 1.8.2.4; Medium 4.3)
- [WPSEC-2026-0812](https://wpsec.com/vuln/WPSEC-2026-0812/) 2026-10-13: Advanced Order Export For WooCommerce <= 4.1.2 - Authenticated (Shop Manager+) SQL Injection via Multiple Export Filter Settings (fixed in 4.1.3; Medium 4.9)
- [WPSEC-2026-0811](https://wpsec.com/vuln/WPSEC-2026-0811/) 2026-10-13: URL Shortify – Simple and Easy URL Shortener <= 2.7.1 - Reflected Cross-Site Scripting via Pricing Page Query Parameters (fixed in 2.7.2; Medium 6.1)
- [WPSEC-2026-0810](https://wpsec.com/vuln/WPSEC-2026-0810/) 2026-10-12: Shopping Cart & eCommerce Store <= 6.0.3 - Unauthenticated Payment Bypass via Stripe Payment Intent Return Handler (fixed in 6.0.4; High 7.5)
- [WPSEC-2026-0809](https://wpsec.com/vuln/WPSEC-2026-0809/) 2026-10-12: Jekyll Exporter <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Exported Markdown Content (fixed in 4.4.0; Medium 4.4)
- [WPSEC-2026-0808](https://wpsec.com/vuln/WPSEC-2026-0808/) 2026-10-12: Related Posts for WordPress <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title (fixed in 3.0.0; Medium 6.4)
- [WPSEC-2026-0807](https://wpsec.com/vuln/WPSEC-2026-0807/) 2026-10-12: Booking Calendar <= 11.9 - Missing Authorization to Unauthenticated Block Times Availability Timeline Disclosure (fixed in 11.9.1; Medium 5.3)
- [WPSEC-2026-0806](https://wpsec.com/vuln/WPSEC-2026-0806/) 2026-10-12: Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wishlist Shortcode 'type' Attribute (fixed in 3.0.2; Medium 6.4)
- [WPSEC-2026-0805](https://wpsec.com/vuln/WPSEC-2026-0805/) 2026-10-12: Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 3.0.1 - Authenticated (Customer+) Stored Cross-Site Scripting via Improper unfiltered_html Capability Assignment (fixed in 3.0.2; Medium 6.4)
- [WPSEC-2026-0804](https://wpsec.com/vuln/WPSEC-2026-0804/) 2026-10-12: Hash Elements <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel and Logo Carousel Widget 'data-params' Attribute (fixed in 1.5.7; Medium 6.4)
- [WPSEC-2026-0803](https://wpsec.com/vuln/WPSEC-2026-0803/) 2026-10-12: Hash Elements <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Total Portfolio Masonry Widget 'active_cat' Setting (fixed in 1.5.7; Medium 6.4)
- [WPSEC-2026-0802](https://wpsec.com/vuln/WPSEC-2026-0802/) 2026-10-12: Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Missing Authorization to ACF Options Update (fixed in 3.30.0; Medium 5.3)
- [WPSEC-2026-0801](https://wpsec.com/vuln/WPSEC-2026-0801/) 2026-10-12: Hippoo Mobile App for WooCommerce <= 1.12.0 - Unauthenticated Reflected Cross-Site Scripting via 'token_id' Parameter (fixed in 1.12.1; Medium 6.1)
- [WPSEC-2026-0800](https://wpsec.com/vuln/WPSEC-2026-0800/) 2026-10-12: Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via UIkit Component Attributes (fixed in 4.7.1; Medium 6.4)
- [WPSEC-2026-0799](https://wpsec.com/vuln/WPSEC-2026-0799/) 2026-10-12: Real Accessibility < 1.1 - Unauthenticated Inclusion of Functionality from Untrusted Control Sphere via Page Reader (fixed in 1.1; Medium 4.7)
- [WPSEC-2026-0798](https://wpsec.com/vuln/WPSEC-2026-0798/) 2026-10-12: Academy LMS <= 4.0.3 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Course Review Submission (fixed in 4.0.4; Medium 4.3)
- [WPSEC-2026-0797](https://wpsec.com/vuln/WPSEC-2026-0797/) 2026-10-12: Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.0 - Authenticated (Support Agent+) Missing Authorization to Ticket Closure via Draft Response (fixed in 2.4.5; Medium 4.3)
- [WPSEC-2026-0796](https://wpsec.com/vuln/WPSEC-2026-0796/) 2026-10-12: Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.0 - Authenticated (Support Agent+) Insecure Direct Object Reference to Restricted Mailbox Tickets via 'on_behalf' Customer Portal Parameter (fixed in 2.4.5; Low 3.8)
- [WPSEC-2026-0795](https://wpsec.com/vuln/WPSEC-2026-0795/) 2026-10-12: Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.0 - Unauthenticated Sensitive Information Exposure of Agent Details via Customer Portal Ticket Responses (fixed in 2.4.5; Medium 5.3)
- [WPSEC-2026-0794](https://wpsec.com/vuln/WPSEC-2026-0794/) 2026-10-12: Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.3 - Unauthenticated Missing Authorization to Image Comment Submission in Restricted Galleries (fixed in 3.7.4; Medium 5.3)
- [WPSEC-2026-0793](https://wpsec.com/vuln/WPSEC-2026-0793/) 2026-10-12: Yotpo: Product & Photo Reviews for WooCommerce < 1.8.3 - Improper Certificate Validation in Yotpo API Requests (fixed in 1.8.3; Medium 6.5)
- [WPSEC-2026-0792](https://wpsec.com/vuln/WPSEC-2026-0792/) 2026-10-12: Yotpo: Product & Photo Reviews for WooCommerce < 1.8.3 - Cross-Site Request Forgery via Sync Widget IDs, Submit Past Orders and Export Reviews Actions (fixed in 1.8.3; Medium 4.3)
- [WPSEC-2026-0791](https://wpsec.com/vuln/WPSEC-2026-0791/) 2026-10-12: Yotpo: Product & Photo Reviews for WooCommerce < 1.8.3 - Unauthenticated Sensitive Information Exposure via Debug Log File (fixed in 1.8.3; Low 3.7)
- [WPSEC-2026-0790](https://wpsec.com/vuln/WPSEC-2026-0790/) 2026-10-12: Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Privilege Escalation via Form Field Keys (fixed in 3.30.0; High 8.1)
- [WPSEC-2026-0789](https://wpsec.com/vuln/WPSEC-2026-0789/) 2026-10-12: Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Arbitrary Post Type Creation and Status Change via Post Type and Post Status Fields (fixed in 3.30.0; Low 3.7)
- [WPSEC-2026-0788](https://wpsec.com/vuln/WPSEC-2026-0788/) 2026-10-12: GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Custom Field Values in Dynamic Content Variables (fixed in 2.8.191; Medium 4.9)
- [WPSEC-2026-0787](https://wpsec.com/vuln/WPSEC-2026-0787/) 2026-10-12: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Authenticated (Vendor+) Customer Account Takeover via Customers REST Endpoint (fixed in 5.3.0; High 8.1)
- [WPSEC-2026-0786](https://wpsec.com/vuln/WPSEC-2026-0786/) 2026-10-12: Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Unauthenticated Missing Authorization to Google Calendar Token Overwrite via OAuth Callback (fixed in 1.0.29; Medium 4.8)
- [WPSEC-2026-0785](https://wpsec.com/vuln/WPSEC-2026-0785/) 2026-10-12: Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Unauthenticated Payment Amount Manipulation via Order Currency (fixed in 1.0.29; Medium 5.3)
- [WPSEC-2026-0784](https://wpsec.com/vuln/WPSEC-2026-0784/) 2026-10-12: Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Image Accordion Widget Settings (fixed in 8.8.8; Medium 6.4)
- [WPSEC-2026-0783](https://wpsec.com/vuln/WPSEC-2026-0783/) 2026-10-12: Contest Gallery <= 34.0.0 - Unauthenticated Voting Restriction Bypass via IP Address Spoofing (fixed in 34.0.1; Medium 5.3)
- [WPSEC-2026-0782](https://wpsec.com/vuln/WPSEC-2026-0782/) 2026-10-12: Persistent Login <= 3.1.4 - Unauthenticated Content Injection via Freemius SDK 'purchase_completed' Admin Notice (fixed in 3.1.5; Low 3.7)
- [WPSEC-2026-0781](https://wpsec.com/vuln/WPSEC-2026-0781/) 2026-10-12: ThinkRank AI SEO <= 2.14.2 - Authenticated (Contributor+) Missing Authorization to Restricted ThinkRank REST Endpoints via Mixed-Case Route (fixed in 2.14.3; Medium 5.4)
- [WPSEC-2026-0780](https://wpsec.com/vuln/WPSEC-2026-0780/) 2026-10-12: ThinkRank AI SEO <= 2.14.2 - Unauthenticated Sensitive Information Exposure of Password-Protected Post Content via SEO Meta Tags (fixed in 2.14.3; Low 3.7)
- [WPSEC-2026-0779](https://wpsec.com/vuln/WPSEC-2026-0779/) 2026-10-12: Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '{mode}_type' Parameter (fixed in 2.4.4; Critical 9.8)
- [WPSEC-2026-0778](https://wpsec.com/vuln/WPSEC-2026-0778/) 2026-10-12: Advanced Form Integration <= 2.10.0 - Unauthenticated PHP Object Injection via Nex-Forms Submission Fields (fixed in 2.10.3; High 8.1)
- [WPSEC-2026-0777](https://wpsec.com/vuln/WPSEC-2026-0777/) 2026-10-11: Indieweb Post Kinds <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Response Properties (fixed in 4.0.0; Medium 6.4)
- [WPSEC-2026-0776](https://wpsec.com/vuln/WPSEC-2026-0776/) 2026-10-11: Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated HTML Injection to Server-Side Request Forgery via PDF Generator Form Field Values (fixed in 3.5.55; Medium 5.4)
- [WPSEC-2026-0775](https://wpsec.com/vuln/WPSEC-2026-0775/) 2026-10-11: Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via Form File Uploads (fixed in 3.5.55; High 7.2)
- [WPSEC-2026-0774](https://wpsec.com/vuln/WPSEC-2026-0774/) 2026-10-11: Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored Cross-Site Scripting via Browser Name, Referrer and Page Title (fixed in 1.10.0; High 7.2)
- [WPSEC-2026-0773](https://wpsec.com/vuln/WPSEC-2026-0773/) 2026-10-11: JCH Optimize <= 6.0.2 - Unauthenticated Stored Cross-Site Scripting via Host Header (fixed in 6.1.0; Medium 5.4)
- [WPSEC-2026-0772](https://wpsec.com/vuln/WPSEC-2026-0772/) 2026-10-11: JCH Optimize <= 6.0.2 - Cross-Site Request Forgery to Cache Clearing, .htaccess Modification and Image Backup Deletion (fixed in 6.1.0; Medium 5.4)
- [WPSEC-2026-0771](https://wpsec.com/vuln/WPSEC-2026-0771/) 2026-10-11: JCH Optimize <= 6.0.2 - Open Redirect via 'return' Parameter (fixed in 6.1.0; Medium 6.1)
- [WPSEC-2026-0770](https://wpsec.com/vuln/WPSEC-2026-0770/) 2026-10-11: Groundhogg <= 4.9.2 - Unauthenticated Insecure Direct Object Reference to Unsent and Private Broadcast Disclosure via Campaign Archive (fixed in 4.9.3; Medium 5.3)
- [WPSEC-2026-0769](https://wpsec.com/vuln/WPSEC-2026-0769/) 2026-10-11: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Author+) Stored Cross-Site Scripting via Question Hint and Explanation (fixed in 4.4.10; Medium 6.4)
- [WPSEC-2026-0768](https://wpsec.com/vuln/WPSEC-2026-0768/) 2026-10-11: Post Views Counter <= 1.7.15 - Authenticated (Contributor+) Missing Authorization to Post View Count Modification via REST API (fixed in 1.8.0; Medium 4.3)
- [WPSEC-2026-0767](https://wpsec.com/vuln/WPSEC-2026-0767/) 2026-10-11: Post Views Counter <= 1.7.15 - Authenticated (Contributor+) Missing Authorization to Sensitive Information Exposure via pvc_column_chart AJAX Action (fixed in 1.8.0; Medium 4.3)
- [WPSEC-2026-0766](https://wpsec.com/vuln/WPSEC-2026-0766/) 2026-10-11: WooCommerce Payments <= 11.1.0 - Unauthenticated Insecure Direct Object Reference to Order Update via 'order_id' Parameter (fixed in 11.2.0; Medium 5.3)
- [WPSEC-2026-0765](https://wpsec.com/vuln/WPSEC-2026-0765/) 2026-10-11: Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget Cluster Icon (fixed in 4.11.111; Medium 6.4)
- [WPSEC-2026-0764](https://wpsec.com/vuln/WPSEC-2026-0764/) 2026-10-11: WPKoi Templates for Elementor <= 3.7.3 - Cross-Site Request Forgery to Customizer Settings Reset (fixed in 3.7.4; Medium 4.3)
- [WPSEC-2026-0763](https://wpsec.com/vuln/WPSEC-2026-0763/) 2026-10-11: WPKoi Templates for Elementor <= 3.7.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via Template Import (fixed in 3.7.4; Medium 4.3)
- [WPSEC-2026-0762](https://wpsec.com/vuln/WPSEC-2026-0762/) 2026-10-11: WPKoi Templates for Elementor <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (fixed in 3.7.4; Medium 6.4)
- [WPSEC-2026-0761](https://wpsec.com/vuln/WPSEC-2026-0761/) 2026-10-11: Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress <= 1.5.2 - Reflected Cross-Site Scripting via Pricing Page Query Parameters (fixed in 1.5.3; Medium 6.1)
- [WPSEC-2026-0760](https://wpsec.com/vuln/WPSEC-2026-0760/) 2026-10-11: All-in-One Video Gallery <= 4.9.5 - Authenticated (Subscriber+) Server-Side Request Forgery via Featured Image Download (fixed in 4.9.7; Medium 6.4)
- [WPSEC-2026-0759](https://wpsec.com/vuln/WPSEC-2026-0759/) 2026-10-11: All-in-One Video Gallery <= 4.9.5 - Unauthenticated Pricing Page Configuration Injection (fixed in 4.9.7; Medium 4.3)
- [WPSEC-2026-0758](https://wpsec.com/vuln/WPSEC-2026-0758/) 2026-10-11: BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion via 'bps_directory' Cookie and 'template' Shortcode Attribute (fixed in 6.0; Critical 9.8)
- [WPSEC-2026-0757](https://wpsec.com/vuln/WPSEC-2026-0757/) 2026-10-11: Meow Lightbox <= 5.6.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content (fixed in 5.6.3; Medium 5.4)
- [WPSEC-2026-0756](https://wpsec.com/vuln/WPSEC-2026-0756/) 2026-10-10: Custom Query Blocks <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Types Block Attributes (fixed in 5.7.0; Medium 6.4)
- [WPSEC-2026-0755](https://wpsec.com/vuln/WPSEC-2026-0755/) 2026-10-10: Video Conferencing with BigBlueButton (BBB) <= 3.2.16 - Unauthenticated Missing Authorization to Recording Exposure via Fluent Community Lesson Recordings Shortcode (fixed in 3.2.17; Low 3.7)
- [WPSEC-2026-0754](https://wpsec.com/vuln/WPSEC-2026-0754/) 2026-10-10: AM LottiePlayer <= 4.2.4 - Authenticated (Author+) Denial of Service via .lottie Archive Decompression Bomb (fixed in 4.2.5; Medium 6.5)
- [WPSEC-2026-0753](https://wpsec.com/vuln/WPSEC-2026-0753/) 2026-10-10: Business Places <= 2.2.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints (fixed in 2.3.0; Medium 5.3)
- [WPSEC-2026-0752](https://wpsec.com/vuln/WPSEC-2026-0752/) 2026-10-10: Push Notification for Post and BuddyPress <= 3.23 - Unauthenticated Insecure Direct Object Reference to Push Subscription Registration for Arbitrary Users via User ID Parameters (fixed in 3.24; Medium 6.5)
- [WPSEC-2026-0751](https://wpsec.com/vuln/WPSEC-2026-0751/) 2026-10-10: BuddyPress Member Reviews <= 3.8.0 - Authenticated (Subscriber+) Missing Authorization to Moderation Bypass via Review Update (fixed in 3.8.1; Medium 4.3)
- [WPSEC-2026-0750](https://wpsec.com/vuln/WPSEC-2026-0750/) 2026-10-10: BuddyPress Member Reviews <= 3.8.0 - Unauthenticated Sensitive Information Exposure via Review Pages, Single Review View and Member Widgets (fixed in 3.8.1; Medium 5.3)
- [WPSEC-2026-0749](https://wpsec.com/vuln/WPSEC-2026-0749/) 2026-10-10: BuddyPress Member Reviews <= 3.8.0 - Authenticated (Subscriber+) Missing Authorization to Review Submission Role Restriction Bypass (fixed in 3.8.1; Medium 4.3)
- [WPSEC-2026-0748](https://wpsec.com/vuln/WPSEC-2026-0748/) 2026-10-10: BuddyPress Member Reviews <= 3.8.0 - Authenticated (Contributor+) Missing Authorization to Review Approval and Report Dismissal (fixed in 3.8.1; Medium 4.3)
- [WPSEC-2026-0747](https://wpsec.com/vuln/WPSEC-2026-0747/) 2026-10-10: Pay With MetaMask For WooCommerce <= 1.7.2 - Unauthenticated Payment Verification Bypass via Forged ERC-20 Token Transfer (fixed in 1.7.3; High 7.5)
- [WPSEC-2026-0746](https://wpsec.com/vuln/WPSEC-2026-0746/) 2026-10-10: Action Network <= 1.8.5 - Unauthenticated Reflected Cross-Site Scripting via Signup Widget Form Fields (fixed in 1.9.0; Medium 6.1)
- [WPSEC-2026-0745](https://wpsec.com/vuln/WPSEC-2026-0745/) 2026-10-10: Action Network <= 1.8.5 - Cross-Site Request Forgery to Bulk Action Deletion and Hiding (fixed in 1.9.0; Medium 4.3)
- [WPSEC-2026-0744](https://wpsec.com/vuln/WPSEC-2026-0744/) 2026-10-10: Action Network <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via actionnetwork_list and actionnetwork_calendar Shortcode Attributes (fixed in 1.9.0; Medium 6.4)
- [WPSEC-2026-0743](https://wpsec.com/vuln/WPSEC-2026-0743/) 2026-10-10: Bus Ticket Booking with Seat Reservation <= 5.9.7 - Unauthenticated Price Manipulation via Ticket Type and Seat Selection (fixed in 5.9.8; Medium 5.3)
- [WPSEC-2026-0742](https://wpsec.com/vuln/WPSEC-2026-0742/) 2026-10-10: annasta Woocommerce Product Filters <= 1.8.4 - Authenticated (Author+) Stored Cross-Site Scripting via Meta Data Filter Values (fixed in 1.8.5; Medium 4.9)
- [WPSEC-2026-0741](https://wpsec.com/vuln/WPSEC-2026-0741/) 2026-10-10: annasta Woocommerce Product Filters <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Caller ID Attribute (fixed in 1.8.5; Medium 6.4)
- [WPSEC-2026-0740](https://wpsec.com/vuln/WPSEC-2026-0740/) 2026-10-10: PDF Invoices & Packing Slips for WooCommerce <= 5.16.3 - Authenticated (Subscriber+) Missing Authorization to Order Information Disclosure via Document Number Preview (fixed in 5.16.4; Medium 4.3)
- [WPSEC-2026-0739](https://wpsec.com/vuln/WPSEC-2026-0739/) 2026-10-10: Testimonial Customer Feedback <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (fixed in 1.2.9; Medium 6.4)
- [WPSEC-2026-0738](https://wpsec.com/vuln/WPSEC-2026-0738/) 2026-10-10: WP OAuth Server ( Login with WordPress ) <= 6.4.0 - Unauthenticated Missing Authorization to OAuth Client Registration via MCP Dynamic Client Registration Endpoint (fixed in 6.5.0; Medium 6.8)
- [WPSEC-2026-0737](https://wpsec.com/vuln/WPSEC-2026-0737/) 2026-10-10: Event Post <= 6.1.1 - Authenticated (Subscriber+) Missing Authorization to Child Event Creation (fixed in 6.1.2; Medium 4.3)
- [WPSEC-2026-0736](https://wpsec.com/vuln/WPSEC-2026-0736/) 2026-10-10: Event Post <= 6.1.1 - Unauthenticated Sensitive Information Exposure via Child Events of Non-Public Posts (fixed in 6.1.2; Low 3.7)
- [WPSEC-2026-0735](https://wpsec.com/vuln/WPSEC-2026-0735/) 2026-10-10: Event Post <= 6.1.1 - Authenticated (Contributor+) Missing Authorization to Event Metadata Update (fixed in 6.1.2; Medium 4.3)
- [WPSEC-2026-0734](https://wpsec.com/vuln/WPSEC-2026-0734/) 2026-10-10: Event Post <= 6.1.1 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Deletion (fixed in 6.1.2; Medium 6.5)
- [WPSEC-2026-0733](https://wpsec.com/vuln/WPSEC-2026-0733/) 2026-10-10: SuperFaktura WooCommerce <= 1.56.1 - Cross-Site Request Forgery to Invoice Creation and Regeneration (fixed in 1.57.0; Medium 4.3)
- [WPSEC-2026-0732](https://wpsec.com/vuln/WPSEC-2026-0732/) 2026-10-10: Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management <= 4.6.27 - Unauthenticated Stored Cross-Site Scripting via Stripe Billing Details (fixed in 4.6.28; High 7.2)
- [WPSEC-2026-0731](https://wpsec.com/vuln/WPSEC-2026-0731/) 2026-10-10: Better Messages <= 3.0.13 - Unauthenticated Missing Authorization to User Listing via getUsers REST API Endpoint (fixed in 3.0.14; Medium 5.3)
- [WPSEC-2026-0730](https://wpsec.com/vuln/WPSEC-2026-0730/) 2026-10-10: Docket Cache <= 26.04.07 - Unauthenticated Sensitive Information Exposure via Predictable Cache Log File (fixed in 26.04.08; Medium 5.9)
- [WPSEC-2026-0729](https://wpsec.com/vuln/WPSEC-2026-0729/) 2026-10-10: CMB2 <= 2.13.3 - Reflected Cross-Site Scripting via Object ID Request Parameters (fixed in 2.13.4; Medium 6.1)
- [WPSEC-2026-0728](https://wpsec.com/vuln/WPSEC-2026-0728/) 2026-10-10: CMB2 <= 2.13.3 - Unauthenticated Sensitive Information Exposure via REST API Field Endpoints (fixed in 2.13.4; Medium 5.3)
- [WPSEC-2026-0727](https://wpsec.com/vuln/WPSEC-2026-0727/) 2026-10-10: Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter (fixed in 2.6; Medium 6.1)
- [WPSEC-2026-0726](https://wpsec.com/vuln/WPSEC-2026-0726/) 2026-10-10: VikRentCar Car Rental Management System <= 1.4.6 - Reflected Cross-Site Scripting via Pagination Links (fixed in 1.4.7; Medium 6.1)
- [WPSEC-2026-0725](https://wpsec.com/vuln/WPSEC-2026-0725/) 2026-10-10: VikRentCar Car Rental Management System <= 1.4.6 - Reflected Cross-Site Scripting via Trackings Active Tab Parameter (fixed in 1.4.7; Medium 6.1)
- [WPSEC-2026-0724](https://wpsec.com/vuln/WPSEC-2026-0724/) 2026-10-10: VikRentCar Car Rental Management System <= 1.4.6 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter (fixed in 1.4.7; Medium 6.1)
- [WPSEC-2026-0723](https://wpsec.com/vuln/WPSEC-2026-0723/) 2026-10-10: OTP Login With Phone Number, OTP Verification <= 1.8.74 - Unauthenticated Authentication Bypass via OTP Brute Force (fixed in 1.8.76; High 8.1)
- [WPSEC-2026-0722](https://wpsec.com/vuln/WPSEC-2026-0722/) 2026-10-10: Ads + Pixel for Meta <= 1.2.2 - Unauthenticated Insecure Direct Object Reference to Order Information Disclosure via 'order-received' Parameter (fixed in 1.2.3; Medium 5.3)
- [WPSEC-2026-0721](https://wpsec.com/vuln/WPSEC-2026-0721/) 2026-10-10: WP Encryption <= 7.8.8.1 - Cross-Site Request Forgery to SSL Validation and HTTPS Enforcement (fixed in 7.8.8.2; Medium 4.3)
- [WPSEC-2026-0720](https://wpsec.com/vuln/WPSEC-2026-0720/) 2026-10-10: WP Encryption <= 7.8.8.1 - Missing Authorization to Unauthenticated SSL Domain Verification Continuation (fixed in 7.8.8.2; Medium 5.3)
- [WPSEC-2026-0719](https://wpsec.com/vuln/WPSEC-2026-0719/) 2026-10-10: miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 - Unauthenticated Authentication Bypass via Login OTP Phone Number (fixed in 5.5.8; Critical 9.8)
- [WPSEC-2026-0718](https://wpsec.com/vuln/WPSEC-2026-0718/) 2026-10-10: miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 - Unauthenticated Two-Factor Authentication Bypass via Delay OTP Verification Setting (fixed in 5.5.8; High 7.4)
- [WPSEC-2026-0717](https://wpsec.com/vuln/WPSEC-2026-0717/) 2026-10-10: FluentCart A New Era of eCommerce <= 1.7.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via 'order_id' Parameter (fixed in 1.7.1; Medium 5.3)
- [WPSEC-2026-0716](https://wpsec.com/vuln/WPSEC-2026-0716/) 2026-10-10: FluentCart A New Era of eCommerce <= 1.7.0 - Unauthenticated Integer Overflow to Order Total Manipulation via Cart Quantity (fixed in 1.7.1; Medium 5.3)
- [WPSEC-2026-0715](https://wpsec.com/vuln/WPSEC-2026-0715/) 2026-10-10: LifterLMS <= 10.3.0 - Unauthenticated Deleted Access Plan Purchase via Checkout (fixed in 10.3.1; Medium 5.3)
- [WPSEC-2026-0714](https://wpsec.com/vuln/WPSEC-2026-0714/) 2026-10-10: LifterLMS <= 10.3.0 - Authenticated (Contributor+) Sensitive Information Exposure via select2_query_posts (fixed in 10.3.1; Medium 4.3)
- [WPSEC-2026-0713](https://wpsec.com/vuln/WPSEC-2026-0713/) 2026-10-10: LifterLMS <= 10.3.0 - Unauthenticated Insecure Direct Object Reference to Pending Order Takeover via Checkout (fixed in 10.3.1; Medium 6.5)
- [WPSEC-2026-0712](https://wpsec.com/vuln/WPSEC-2026-0712/) 2026-10-10: LifterLMS <= 10.3.0 - Authenticated (Subscriber+) CSV Injection via Reporting Exports (fixed in 10.3.1; Medium 4.6)
- [WPSEC-2026-0711](https://wpsec.com/vuln/WPSEC-2026-0711/) 2026-10-10: LifterLMS <= 10.3.0 - Unauthenticated Sensitive Information Exposure via Certificate oEmbed and Canonical Redirects (fixed in 10.3.1; Medium 5.3)
- [WPSEC-2026-0710](https://wpsec.com/vuln/WPSEC-2026-0710/) 2026-10-10: LifterLMS <= 10.3.0 - Authentication Bypass via REST API Key Route Restriction (fixed in 10.3.1; Medium 5.4)
- [WPSEC-2026-0709](https://wpsec.com/vuln/WPSEC-2026-0709/) 2026-10-10: SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Authenticated (Shop Worker+) PHP Object Injection via Integrations REST API (fixed in 4.9.4; Medium 6.6)
- [WPSEC-2026-0708](https://wpsec.com/vuln/WPSEC-2026-0708/) 2026-10-10: SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Reflected Cross-Site Scripting via 'live_mode' Parameter (fixed in 4.9.4; Medium 6.1)
- [WPSEC-2026-0707](https://wpsec.com/vuln/WPSEC-2026-0707/) 2026-10-10: Product Feed Manager for WooCommerce <= 8.0.32 - Unauthenticated Sensitive Information Exposure via Log Files (fixed in 8.0.33; Low 3.7)
- [WPSEC-2026-0706](https://wpsec.com/vuln/WPSEC-2026-0706/) 2026-10-10: LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via lifterlms_checkout Shortcode (fixed in 10.3.2; High 8.8)
- [WPSEC-2026-0705](https://wpsec.com/vuln/WPSEC-2026-0705/) 2026-10-10: Braintree for WooCommerce Payment Gateway <= 3.12.0 - Unauthenticated 3D Secure and Card Security Code Verification Bypass via Client-Controlled Checkout Fields (fixed in 3.12.1; Low 3.7)
- [WPSEC-2026-0704](https://wpsec.com/vuln/WPSEC-2026-0704/) 2026-10-10: Braintree for WooCommerce Payment Gateway <= 3.12.0 - Unauthenticated Payment Verification Bypass via Unvalidated Payment Method Nonce Type (fixed in 3.12.1; Low 3.7)
- [WPSEC-2026-0703](https://wpsec.com/vuln/WPSEC-2026-0703/) 2026-10-10: WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.22 - Authenticated (Subscriber+) Payment Bypass via Stripe Checkout Plan Selection (fixed in 2.9.23; Medium 4.3)
- [WPSEC-2026-0702](https://wpsec.com/vuln/WPSEC-2026-0702/) 2026-10-10: Patreon WordPress <= 1.10.0 - Cross-Site Request Forgery to Image Lock Level Update (fixed in 1.11.0; Medium 4.3)
- [WPSEC-2026-0701](https://wpsec.com/vuln/WPSEC-2026-0701/) 2026-10-10: WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.16.0 - Unauthenticated Sensitive Information Exposure via Corrupted Staging Site Report File (fixed in 4.17.0; Medium 5.9)
- [WPSEC-2026-0700](https://wpsec.com/vuln/WPSEC-2026-0700/) 2026-10-10: AI Powered Marketing <= 1.5.4 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order Received Page (fixed in 1.5.5; Medium 5.3)
- [WPSEC-2026-0699](https://wpsec.com/vuln/WPSEC-2026-0699/) 2026-10-10: AI Engine <= 3.8.3 - Authenticated (Contributor+) Missing Authorization to Chatbot Configuration Override via 'mwai_chatbot' Shortcode (fixed in 3.8.4; Medium 5.4)
- [WPSEC-2026-0698](https://wpsec.com/vuln/WPSEC-2026-0698/) 2026-10-10: AI Engine <= 3.8.3 - Missing Authorization to Unauthenticated AI Search and Limited Information Exposure via 'search' REST Endpoint (fixed in 3.8.4; Medium 6.5)
- [WPSEC-2026-0697](https://wpsec.com/vuln/WPSEC-2026-0697/) 2026-10-10: WP Compress <= 7.25.00 - Authenticated (Subscriber+) Privilege Escalation via Plugin Role Permissions (fixed in 7.26.00; Medium 5.0)
- [WPSEC-2026-0696](https://wpsec.com/vuln/WPSEC-2026-0696/) 2026-10-10: FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Received Page Tracking Data (fixed in 3.16.0.6; Medium 4.7)
- [WPSEC-2026-0695](https://wpsec.com/vuln/WPSEC-2026-0695/) 2026-10-10: WPCode <= 2.3.9 - Unauthenticated Snippet Execution Bypass via 'wpcode-safe-mode' Parameter (fixed in 2.4.0; Medium 5.3)
- [WPSEC-2026-0694](https://wpsec.com/vuln/WPSEC-2026-0694/) 2026-10-10: HUSKY <= 1.4.2 - Unauthenticated Reflected Cross-Site Scripting via 'woof_text' Parameter (fixed in 1.4.5; Medium 6.1)
- [WPSEC-2026-0693](https://wpsec.com/vuln/WPSEC-2026-0693/) 2026-10-10: HUSKY <= 1.4.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'JavaScript code after AJAX is done' Setting (fixed in 1.4.5; Medium 5.5)
- [WPSEC-2026-0692](https://wpsec.com/vuln/WPSEC-2026-0692/) 2026-10-10: Wallet for WooCommerce <= 1.7.2 - Authenticated (Subscriber+) Business Logic Flaw to Unpaid Wallet Credit via Cash on Delivery Top-Up (fixed in 1.7.3; Medium 5.3)
- [WPSEC-2026-0691](https://wpsec.com/vuln/WPSEC-2026-0691/) 2026-10-10: Contact Form 7 Multi-Step Forms <= 4.7 - Unauthenticated Reflected Cross-Site Scripting via 'l10n_print_after' Form Field (fixed in 4.7.1; Medium 6.1)
- [WPSEC-2026-0690](https://wpsec.com/vuln/WPSEC-2026-0690/) 2026-10-10: JetFormBuilder <= 3.6.6 - Unauthenticated Missing Authorization to Media Field Value Modification (fixed in 3.6.6.1; Low 3.7)
- [WPSEC-2026-0689](https://wpsec.com/vuln/WPSEC-2026-0689/) 2026-10-10: JetFormBuilder <= 3.6.6 - Unauthenticated Insecure Direct Object Reference to Anonymous Post Update and Trash (fixed in 3.6.6.1; Medium 5.3)
- [WPSEC-2026-0688](https://wpsec.com/vuln/WPSEC-2026-0688/) 2026-10-10: BetterDocs <= 4.9.3 - Unauthenticated Sensitive Information Exposure via Private and Draft Doc Titles (fixed in 4.9.4; Medium 5.3)
- [WPSEC-2026-0687](https://wpsec.com/vuln/WPSEC-2026-0687/) 2026-10-10: WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comments (fixed in 1.2.0; Medium 5.4)
- [WPSEC-2026-0686](https://wpsec.com/vuln/WPSEC-2026-0686/) 2026-10-10: Blocksy Companion <= 2.1.58 - Authenticated (Contributor+) Sensitive Information Exposure via blocksy_posts Shortcode (fixed in 2.1.59; Medium 4.3)
- [WPSEC-2026-0685](https://wpsec.com/vuln/WPSEC-2026-0685/) 2026-10-10: Jeg Kit for Elementor <= 3.2.20 - Authenticated (Subscriber+) Missing Authorization to User Enumeration via Element Option and Author Search AJAX Actions (fixed in 3.2.21; Medium 4.3)
- [WPSEC-2026-0684](https://wpsec.com/vuln/WPSEC-2026-0684/) 2026-10-09: WP Rollback <= 3.1.2 - Unauthenticated Sensitive Information Exposure via Predictable Backup Archive Paths (fixed in 3.2.0; Low 3.7)
- [WPSEC-2026-0683](https://wpsec.com/vuln/WPSEC-2026-0683/) 2026-10-09: Wallet for WooCommerce <= 1.7.1 - Unauthenticated Business Logic Flaw to Unlimited Wallet Credit via Visit Referral Rewards (fixed in 1.7.2; Medium 5.3)
- [WPSEC-2026-0682](https://wpsec.com/vuln/WPSEC-2026-0682/) 2026-10-08: Envira Gallery <= 1.16.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Private Post Title and Excerpt Disclosure via gallery_data REST Field (fixed in 1.16.2; Medium 4.3)
- [WPSEC-2026-0681](https://wpsec.com/vuln/WPSEC-2026-0681/) 2026-10-08: Envira Gallery <= 1.16.1 - Authenticated (Contributor+) Sensitive Information Exposure of Private Galleries via Gallery Shortcode (fixed in 1.16.2; Medium 4.3)
- [WPSEC-2026-0680](https://wpsec.com/vuln/WPSEC-2026-0680/) 2026-10-08: Patreon WordPress <= 1.9.17 - Cross-Site Request Forgery to Account Takeover via OAuth Callback (fixed in 1.10.0; High 8.1)
- [WPSEC-2026-0679](https://wpsec.com/vuln/WPSEC-2026-0679/) 2026-10-08: Patreon WordPress <= 1.9.17 - Unauthenticated Open Redirect via 'final_redirect_uri' State Parameter (fixed in 1.10.0; Medium 4.7)
- [WPSEC-2026-0678](https://wpsec.com/vuln/WPSEC-2026-0678/) 2026-10-08: PPOM for WooCommerce <= 34.0.10 - Unauthenticated Price Manipulation via 'price_matrix_found' Parameter (fixed in 34.0.11; Medium 5.3)
- [WPSEC-2026-0677](https://wpsec.com/vuln/WPSEC-2026-0677/) 2026-10-08: PPOM for WooCommerce <= 34.0.10 - Unauthenticated Path Traversal to Arbitrary File Move via File Upload Field Names (fixed in 34.0.11; High 8.1)
- [WPSEC-2026-0676](https://wpsec.com/vuln/WPSEC-2026-0676/) 2026-10-08: Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive Information Exposure via Predictable Export File Names (fixed in 2.7.9; Medium 5.9)
- [WPSEC-2026-0675](https://wpsec.com/vuln/WPSEC-2026-0675/) 2026-10-08: Tainacan <= 1.3.0 - Authenticated (Editor+) PHP Object Injection via Metadata Order and Type Options (fixed in 1.4.0; High 7.2)
- [WPSEC-2026-0674](https://wpsec.com/vuln/WPSEC-2026-0674/) 2026-10-08: Tainacan <= 1.3.0 - Authenticated (Editor+) Arbitrary File Read via Importer Source File (fixed in 1.4.0; Medium 4.9)
- [WPSEC-2026-0673](https://wpsec.com/vuln/WPSEC-2026-0673/) 2026-10-08: Tainacan <= 1.3.0 - Authenticated (Subscriber+) Sensitive Information Exposure via Reports REST Endpoints (fixed in 1.4.0; Medium 4.3)
- [WPSEC-2026-0672](https://wpsec.com/vuln/WPSEC-2026-0672/) 2026-10-08: Travelpayouts <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Search Form Modification and Stored Cross-Site Scripting (fixed in 1.2.4; Medium 6.4)
- [WPSEC-2026-0671](https://wpsec.com/vuln/WPSEC-2026-0671/) 2026-10-08: WP Plugin Info Card <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout' and 'expiration' Shortcode Attributes (fixed in 6.4.0; Medium 6.4)
- [WPSEC-2026-0670](https://wpsec.com/vuln/WPSEC-2026-0670/) 2026-10-08: Constant Contact Forms <= 2.22.0 - Improper Authentication to Unauthenticated Mailing List Subscription of Arbitrary Users via Login Opt-in (fixed in 2.22.1; Medium 5.3)
- [WPSEC-2026-0669](https://wpsec.com/vuln/WPSEC-2026-0669/) 2026-10-08: Reviews Feed <= 2.14.0 - Unauthenticated Sensitive Information Exposure via Elementor Integration Feed Data (fixed in 2.15.0; Medium 5.3)
- [WPSEC-2026-0668](https://wpsec.com/vuln/WPSEC-2026-0668/) 2026-10-08: Reviews Feed <= 2.14.0 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Feed Data (fixed in 2.15.0; Medium 4.3)
- [WPSEC-2026-0667](https://wpsec.com/vuln/WPSEC-2026-0667/) 2026-10-08: FoxyShop <= 4.9.7 - Unauthenticated Privilege Escalation via Predictable API Key (fixed in 4.9.8; High 8.1)
- [WPSEC-2026-0666](https://wpsec.com/vuln/WPSEC-2026-0666/) 2026-10-08: FoxyShop <= 4.9.7 - Missing Authorization to Unauthenticated Limited File Upload (fixed in 4.9.8; Low 3.7)
- [WPSEC-2026-0665](https://wpsec.com/vuln/WPSEC-2026-0665/) 2026-10-08: FoxyShop <= 4.9.7 - Unauthenticated Sensitive Information Exposure via Order Export (fixed in 4.9.8; High 7.5)
- [WPSEC-2026-0664](https://wpsec.com/vuln/WPSEC-2026-0664/) 2026-10-08: WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via Social Login 'uuid' Parameter (fixed in 1.8.0.1; High 8.1)
- [WPSEC-2026-0663](https://wpsec.com/vuln/WPSEC-2026-0663/) 2026-10-08: WPCOM Member <= 1.7.27 - Cross-Site Request Forgery to Account Takeover via Social Login Binding (fixed in 1.8.0.1; High 7.5)
- [WPSEC-2026-0662](https://wpsec.com/vuln/WPSEC-2026-0662/) 2026-10-08: Pinterest for WooCommerce <= 1.5.1 - Unauthenticated Information Exposure of Password-Protected Products via Rich Pins Metadata (fixed in 1.5.2; Medium 5.3)
- [WPSEC-2026-0661](https://wpsec.com/vuln/WPSEC-2026-0661/) 2026-10-08: Pinterest for WooCommerce <= 1.5.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Settings REST Endpoint (fixed in 1.5.2; Medium 5.5)
- [WPSEC-2026-0660](https://wpsec.com/vuln/WPSEC-2026-0660/) 2026-10-08: Events Manager <= 7.4.6 - Unauthenticated SQL Injection via 'scope' Parameter (fixed in 7.4.7; High 7.5)
- [WPSEC-2026-0659](https://wpsec.com/vuln/WPSEC-2026-0659/) 2026-10-08: Donation Thermometer <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colorramp' Shortcode Attribute (fixed in 2.3.0; Medium 6.4)
- [WPSEC-2026-0658](https://wpsec.com/vuln/WPSEC-2026-0658/) 2026-10-08: Jetpack VideoPress <= 3.6 - Missing Authorization to Restricted Video Playback via Subscription Plan ID (fixed in 3.7; Medium 4.3)
- [WPSEC-2026-0657](https://wpsec.com/vuln/WPSEC-2026-0657/) 2026-10-08: WooCommerce <= 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation via Editing Users with Multiple Roles (fixed in 11.2.0; Medium 6.6)
- [WPSEC-2026-0656](https://wpsec.com/vuln/WPSEC-2026-0656/) 2026-10-08: WooCommerce <= 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation via Account Takeover through Password Reset Email Cc/Bcc Recipients (fixed in 11.2.0; High 7.2)
- [WPSEC-2026-0655](https://wpsec.com/vuln/WPSEC-2026-0655/) 2026-10-08: All in One SEO <= 5.0.2.1 - Authenticated (Contributor+) Missing Authorization to Image Attachment Creation and Limited Image Disclosure via AI Image Generation (fixed in 5.0.3; Medium 5.4)
- [WPSEC-2026-0654](https://wpsec.com/vuln/WPSEC-2026-0654/) 2026-10-08: Stitch Express <= 1.9.1 - Unauthenticated Order Status Check Bypass via 'override' Parameter (fixed in 1.9.3; Low 3.7)
- [WPSEC-2026-0653](https://wpsec.com/vuln/WPSEC-2026-0653/) 2026-10-08: WP Booking System Free version <= 2.1 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header (fixed in 2.1.0.1; High 7.2)
- [WPSEC-2026-0652](https://wpsec.com/vuln/WPSEC-2026-0652/) 2026-10-08: WPAdverts – Classifieds Plugin <= 2.3.4 - Reflected Cross-Site Scripting via '_adverts_action' Parameter (fixed in 2.3.5; Medium 6.1)
- [WPSEC-2026-0651](https://wpsec.com/vuln/WPSEC-2026-0651/) 2026-10-08: WPAdverts – Classifieds Plugin <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via Advert Location and Contact Fields (fixed in 2.3.5; High 7.2)
- [WPSEC-2026-0650](https://wpsec.com/vuln/WPSEC-2026-0650/) 2026-10-08: YITH WooCommerce Affiliates <= 3.31.0 - Authenticated (Shop Manager+) PHP Object Injection via Referral Cookie Expiration Setting (fixed in 3.31.1; Medium 6.6)
- [WPSEC-2026-0649](https://wpsec.com/vuln/WPSEC-2026-0649/) 2026-10-08: WooCommerce Accommodation Bookings <= 1.3.12 - Unauthenticated Denial of Service via Availability Cache Registry (fixed in 1.3.13; Medium 5.3)
- [WPSEC-2026-0648](https://wpsec.com/vuln/WPSEC-2026-0648/) 2026-10-08: WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 - Authenticated (Shop Manager+) SQL Injection via 'currency' Parameter (fixed in 5.6.3; Medium 4.9)
- [WPSEC-2026-0647](https://wpsec.com/vuln/WPSEC-2026-0647/) 2026-10-08: WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 - Unauthenticated Session Fixation via Cross-Domain Session Handoff (fixed in 5.6.3; Medium 4.2)
- [WPSEC-2026-0646](https://wpsec.com/vuln/WPSEC-2026-0646/) 2026-10-08: Shortcodes and extra features for Phlox theme <= 2.17.22 - Missing Authorization to Authenticated (Subscriber+) Theme License Deactivation (fixed in 2.17.24; Medium 4.3)
- [WPSEC-2026-0645](https://wpsec.com/vuln/WPSEC-2026-0645/) 2026-10-08: Shortcodes and extra features for Phlox theme <= 2.17.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes and Menu Widget Custom Content (fixed in 2.17.24; Medium 6.4)
- [WPSEC-2026-0644](https://wpsec.com/vuln/WPSEC-2026-0644/) 2026-10-08: Customer Email Verification for WooCommerce <= 2.8.1 - Authenticated (Contributor+) Missing Authorization to Arbitrary User Email Verification Status Modification (fixed in 2.8.2; Medium 4.3)
- [WPSEC-2026-0643](https://wpsec.com/vuln/WPSEC-2026-0643/) 2026-10-08: Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Unauthenticated Missing Authorization to Arbitrary PayPal Refund (fixed in 4.0.7; Medium 5.3)
- [WPSEC-2026-0642](https://wpsec.com/vuln/WPSEC-2026-0642/) 2026-10-08: Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Unauthenticated Missing Authorization to Payment Data CSV Export (fixed in 4.0.7; Medium 5.3)
- [WPSEC-2026-0641](https://wpsec.com/vuln/WPSEC-2026-0641/) 2026-10-08: Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.25 - Authenticated (Author+) Stored Cross-Site Scripting via Button 'clickAction' Field Property (fixed in 2.4.26; Medium 5.4)
- [WPSEC-2026-0640](https://wpsec.com/vuln/WPSEC-2026-0640/) 2026-10-08: WP Search with Algolia <= 2.14.1 - Authenticated (Subscriber+) Missing Authorization to Index Re-Indexing and Settings Push (fixed in 3.0.0; Medium 5.4)
- [WPSEC-2026-0639](https://wpsec.com/vuln/WPSEC-2026-0639/) 2026-10-08: DPD Baltic Shipping <= 1.2.93 - Embedded Malicious Code (Password-Protected File Manager in uninstall-boolean.php) (fixed in 1.2.94; Critical 9.8)
- [WPSEC-2026-0638](https://wpsec.com/vuln/WPSEC-2026-0638/) 2026-10-08: ShipAny WooCommerce: Ship, Label, Tracking <= 1.1.112 - Missing Authorization to Authenticated (Subscriber+) Merchant Address Disclosure via 'on_click_update_address' AJAX Action (fixed in 1.1.113; Medium 4.3)
- [WPSEC-2026-0637](https://wpsec.com/vuln/WPSEC-2026-0637/) 2026-10-08: ShipAny WooCommerce: Ship, Label, Tracking <= 1.1.112 - Unauthenticated Sensitive Information Exposure of ShipAny API Token (fixed in 1.1.113; High 7.5)
- [WPSEC-2026-0636](https://wpsec.com/vuln/WPSEC-2026-0636/) 2026-10-08: Table Field Add-on for ACF and SCF <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Field Value (fixed in 1.4.1; Medium 6.4)
- [WPSEC-2026-0635](https://wpsec.com/vuln/WPSEC-2026-0635/) 2026-10-08: Product Feed Manager for WooCommerce <= 8.0.31 - Authenticated (Shop Manager+) Arbitrary Options Deletion (fixed in 8.0.32; Medium 6.5)
- [WPSEC-2026-0634](https://wpsec.com/vuln/WPSEC-2026-0634/) 2026-10-08: Product Feed Manager for WooCommerce <= 8.0.31 - Unauthenticated Sensitive Information Exposure of SFTP Password via Log Files (fixed in 8.0.32; Medium 5.9)
- [WPSEC-2026-0633](https://wpsec.com/vuln/WPSEC-2026-0633/) 2026-10-08: Product Feed Manager for WooCommerce <= 8.0.31 - Authenticated (Shop Manager+) Sensitive Information Exposure via WP Options (fixed in 8.0.32; Medium 4.9)
- [WPSEC-2026-0632](https://wpsec.com/vuln/WPSEC-2026-0632/) 2026-10-08: Visual Composer Website Builder <= 45.16.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via 'vcv-source-id' Parameter (fixed in 45.16.4; Medium 4.3)
- [WPSEC-2026-0631](https://wpsec.com/vuln/WPSEC-2026-0631/) 2026-10-08: Molongui Authorship <= 5.2.12 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Byline Link Processing (fixed in 5.3.0; Medium 5.4)
- [WPSEC-2026-0630](https://wpsec.com/vuln/WPSEC-2026-0630/) 2026-10-08: Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Site-Wide Filter Management (fixed in 2.2.1; Medium 4.3)
- [WPSEC-2026-0629](https://wpsec.com/vuln/WPSEC-2026-0629/) 2026-10-08: Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Media Library Image Upload (fixed in 2.2.1; Medium 4.3)
- [WPSEC-2026-0628](https://wpsec.com/vuln/WPSEC-2026-0628/) 2026-10-08: Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Limited Attachment Deletion (fixed in 2.2.1; Medium 4.3)
- [WPSEC-2026-0627](https://wpsec.com/vuln/WPSEC-2026-0627/) 2026-10-08: Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Title (fixed in 2.2.1; Medium 6.4)
- [WPSEC-2026-0626](https://wpsec.com/vuln/WPSEC-2026-0626/) 2026-10-08: Portfolio Gallery – Image Gallery Plugin <= 2.2.0 - Authenticated (Contributor+) Insecure Direct Object Reference to Gallery Image Modification and Disclosure (fixed in 2.2.1; Medium 5.4)
- [WPSEC-2026-0625](https://wpsec.com/vuln/WPSEC-2026-0625/) 2026-10-08: Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.5 - Authenticated (Contributor+) Missing Authorization to Kit Account Connection via OAuth Callback (fixed in 3.4.6; Medium 4.2)
- [WPSEC-2026-0624](https://wpsec.com/vuln/WPSEC-2026-0624/) 2026-10-08: Forminator Forms <= 1.57.3.1 - Unauthenticated Insecure Direct Object Reference via Stripe PaymentIntent ID (fixed in 1.58.0; Medium 6.5)
- [WPSEC-2026-0623](https://wpsec.com/vuln/WPSEC-2026-0623/) 2026-10-08: Forminator Forms <= 1.57.3.1 - Unauthenticated PayPal Order Request Tampering via Form Submission (fixed in 1.58.0; Medium 5.3)
- [WPSEC-2026-0622](https://wpsec.com/vuln/WPSEC-2026-0622/) 2026-10-08: Forminator Forms <= 1.57.3.1 - Unauthenticated CAPTCHA Bypass on Payment Forms (fixed in 1.58.0; Medium 5.3)
- [WPSEC-2026-0621](https://wpsec.com/vuln/WPSEC-2026-0621/) 2026-10-08: WP Store Locator <= 3.0.3 - Authenticated (Store Locator Manager+) Stored Cross-Site Scripting via Store Marker Meta (fixed in 3.1.0; Medium 5.5)
- [WPSEC-2026-0620](https://wpsec.com/vuln/WPSEC-2026-0620/) 2026-10-08: WP Store Locator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'template' Shortcode Attribute (fixed in 3.1.0; Medium 6.4)
- [WPSEC-2026-0619](https://wpsec.com/vuln/WPSEC-2026-0619/) 2026-10-08: Forminator Forms <= 1.57.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values (fixed in 1.57.3.1; High 7.2)
- [WPSEC-2026-0618](https://wpsec.com/vuln/WPSEC-2026-0618/) 2026-10-08: Forminator Forms <= 1.57.3 - Unauthenticated Arbitrary Shortcode Execution via User-Agent Header and Referer URL (fixed in 1.57.3.1; Medium 5.6)
- [WPSEC-2026-0617](https://wpsec.com/vuln/WPSEC-2026-0617/) 2026-10-08: Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.14 - Unauthenticated HTML Injection in Email Notifications via Referral Link and IP Address (fixed in 1.26.15; Low 3.1)
- [WPSEC-2026-0616](https://wpsec.com/vuln/WPSEC-2026-0616/) 2026-10-08: Official Integration for Billingo <= 4.3.2 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Options Update in Email Settings (fixed in 4.3.3; High 7.2)
- [WPSEC-2026-0615](https://wpsec.com/vuln/WPSEC-2026-0615/) 2026-10-08: Official Integration for Billingo <= 4.3.2 - Unauthenticated Sensitive Information Exposure via Log Files (fixed in 4.3.3; Medium 5.3)
- [WPSEC-2026-0614](https://wpsec.com/vuln/WPSEC-2026-0614/) 2026-10-08: Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Icon Block Attributes (fixed in 3.0.11; Medium 6.4)
- [WPSEC-2026-0613](https://wpsec.com/vuln/WPSEC-2026-0613/) 2026-10-08: WP Job Manager <= 2.4.7 - Unauthenticated Sensitive Information Exposure via Listing Archives, Term Feeds, Sitemaps and REST API (fixed in 2.4.8; Low 3.7)
- [WPSEC-2026-0612](https://wpsec.com/vuln/WPSEC-2026-0612/) 2026-10-08: WP Job Manager <= 2.4.7 - Authenticated (Subscriber+) Sensitive Information Exposure via Edit Job Form Attachment Fields (fixed in 2.4.8; Medium 4.3)
- [WPSEC-2026-0611](https://wpsec.com/vuln/WPSEC-2026-0611/) 2026-10-08: WP Job Manager <= 2.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via [jobs] Shortcode 'post_status' Attribute (fixed in 2.4.8; Medium 4.3)
- [WPSEC-2026-0610](https://wpsec.com/vuln/WPSEC-2026-0610/) 2026-10-08: WPComplete <= 2.9.5.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Completion Data Modification (fixed in 2.9.5.8; Medium 4.3)
- [WPSEC-2026-0609](https://wpsec.com/vuln/WPSEC-2026-0609/) 2026-10-08: WPComplete <= 2.9.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Name (fixed in 2.9.5.8; Medium 6.4)
- [WPSEC-2026-0608](https://wpsec.com/vuln/WPSEC-2026-0608/) 2026-10-08: Tabs Widget for Page Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nested Tab Widgets (fixed in 1.2.3; Medium 6.4)
- [WPSEC-2026-0607](https://wpsec.com/vuln/WPSEC-2026-0607/) 2026-10-07: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (fixed in 4.10.6; Medium 6.4)
- [WPSEC-2026-0606](https://wpsec.com/vuln/WPSEC-2026-0606/) 2026-10-07: Social Rocket – Social Sharing Plugin <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading' Shortcode Attribute (fixed in 1.3.6; Medium 6.4)
- [WPSEC-2026-0605](https://wpsec.com/vuln/WPSEC-2026-0605/) 2026-10-07: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Unauthenticated Order Completion Without Confirmed Payment via Square Checkout (fixed in 3.7.1.1; Low 3.7)
- [WPSEC-2026-0604](https://wpsec.com/vuln/WPSEC-2026-0604/) 2026-10-07: RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Loop Block (fixed in 5.2.11; Medium 6.4)
- [WPSEC-2026-0603](https://wpsec.com/vuln/WPSEC-2026-0603/) 2026-10-07: Subscribe to Comments <= 2.3.2 - Unauthenticated Sensitive Information Exposure via Subscriptions to Non-Public Posts (fixed in 2.3.3; Low 3.7)
- [WPSEC-2026-0602](https://wpsec.com/vuln/WPSEC-2026-0602/) 2026-10-07: Subscribe to Comments <= 2.3.2 - Authenticated (Subscriber+) Incorrect Authorization to Subscription Takeover via Unverified Account Email (fixed in 2.3.3; Medium 5.4)
- [WPSEC-2026-0601](https://wpsec.com/vuln/WPSEC-2026-0601/) 2026-10-07: Subscribe to Comments <= 2.3.2 - Unauthenticated Sensitive Information Exposure via E-mail Change Confirmation (fixed in 2.3.3; Medium 4.8)
- [WPSEC-2026-0600](https://wpsec.com/vuln/WPSEC-2026-0600/) 2026-10-07: Subscribe to Comments <= 2.3.2 - Cross-Site Request Forgery via Subscription Manager (fixed in 2.3.3; Medium 4.3)
- [WPSEC-2026-0599](https://wpsec.com/vuln/WPSEC-2026-0599/) 2026-10-07: Premmerce Product Filter for WooCommerce <= 3.8.2 - Authenticated (Subscriber+) Missing Authorization to Taxonomy Term Disclosure (fixed in 3.8.3; Medium 4.3)
- [WPSEC-2026-0598](https://wpsec.com/vuln/WPSEC-2026-0598/) 2026-10-07: GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Standard IPN Notifications (fixed in 4.18.0.1; Low 3.7)
- [WPSEC-2026-0597](https://wpsec.com/vuln/WPSEC-2026-0597/) 2026-10-07: Kadence Blocks <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Block Title Heading Level (fixed in 3.7.12.1; Medium 6.4)
- [WPSEC-2026-0596](https://wpsec.com/vuln/WPSEC-2026-0596/) 2026-10-07: Robokassa payment gateway for Woocommerce <= 1.8.9 - Unauthenticated Insecure Direct Object Reference to Order Key Exposure via 'InvId' Parameter (fixed in 1.9.0; Low 3.7)
- [WPSEC-2026-0595](https://wpsec.com/vuln/WPSEC-2026-0595/) 2026-10-07: GPTranslate <= 2.34.13 - Unauthenticated Cross-Site Scripting via HTML Attribute Values in Server-Side Translated Pages (fixed in 2.34.14; Medium 6.1)
- [WPSEC-2026-0594](https://wpsec.com/vuln/WPSEC-2026-0594/) 2026-10-07: Document Engine <= 2.1.0 - Authenticated (Author+) Server-Side Request Forgery via Post to PDF (fixed in 2.2.0; Medium 6.4)
- [WPSEC-2026-0593](https://wpsec.com/vuln/WPSEC-2026-0593/) 2026-10-07: All in One Invite Codes <= 1.2.0 - Authenticated (Subscriber+) Missing Authorization to Sending Invites via Other Users' Invite Codes (fixed in 1.3.0; Medium 5.4)
- [WPSEC-2026-0592](https://wpsec.com/vuln/WPSEC-2026-0592/) 2026-10-07: All in One Invite Codes <= 1.2.0 - Cross-Site Request Forgery to Invite Code Creation (fixed in 1.3.0; Medium 4.3)
- [WPSEC-2026-0591](https://wpsec.com/vuln/WPSEC-2026-0591/) 2026-10-07: All in One Invite Codes <= 1.2.0 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Invite Code Disabling (fixed in 1.3.0; Medium 4.3)
- [WPSEC-2026-0590](https://wpsec.com/vuln/WPSEC-2026-0590/) 2026-10-07: Subscribe to Comments <= 2.3.1 - Authenticated (Author+) Missing Authorization to Plugin Settings Update (fixed in 2.3.2; Medium 6.4)
- [WPSEC-2026-0589](https://wpsec.com/vuln/WPSEC-2026-0589/) 2026-10-07: Subscribe to Comments <= 2.3.1 - Unauthenticated Sensitive Information Exposure via Subscription Management Keys (fixed in 2.3.2; Medium 6.5)
- [WPSEC-2026-0588](https://wpsec.com/vuln/WPSEC-2026-0588/) 2026-10-07: Subscribe to Comments <= 2.3.1 - Reflected Cross-Site Scripting via 'ref' Parameter (fixed in 2.3.2; Medium 6.1)
- [WPSEC-2026-0587](https://wpsec.com/vuln/WPSEC-2026-0587/) 2026-10-07: Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 - Authenticated (Subscriber+) Missing Authorization to Appointment Data and Security Token Exposure via Calendar Appointments Route (fixed in 1.0.28; Medium 5.4)
- [WPSEC-2026-0586](https://wpsec.com/vuln/WPSEC-2026-0586/) 2026-10-07: Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.3 - Authenticated (Contributor+) Path Traversal to Local File Inclusion via List Submissions Block (fixed in 2.10.4; High 8.8)
- [WPSEC-2026-0585](https://wpsec.com/vuln/WPSEC-2026-0585/) 2026-10-07: Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.3 - Unauthenticated Missing Authorization to Arbitrary Taxonomy Term Disclosure via bf_load_taxonomy AJAX Action (fixed in 2.10.4; Medium 5.3)
- [WPSEC-2026-0584](https://wpsec.com/vuln/WPSEC-2026-0584/) 2026-10-07: Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.2 - Unauthenticated Missing Authorization to Form Configuration Export (fixed in 2.10.3; Medium 5.3)
- [WPSEC-2026-0583](https://wpsec.com/vuln/WPSEC-2026-0583/) 2026-10-07: Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Unauthenticated Missing Authorization to Arbitrary Post Modification (fixed in 2.10.1; High 7.5)
- [WPSEC-2026-0582](https://wpsec.com/vuln/WPSEC-2026-0582/) 2026-10-07: Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Unauthenticated Missing Authorization to Image Upload via upload_image_from_url AJAX Action (fixed in 2.10.1; Medium 5.3)
- [WPSEC-2026-0581](https://wpsec.com/vuln/WPSEC-2026-0581/) 2026-10-07: Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Unauthenticated Missing Authorization to Limited Attachment Deletion (fixed in 2.10.1; Medium 5.3)
- [WPSEC-2026-0580](https://wpsec.com/vuln/WPSEC-2026-0580/) 2026-10-07: Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Reflected Cross-Site Scripting via 'error_msg_*' Parameters (fixed in 2.10.1; Medium 6.1)
- [WPSEC-2026-0579](https://wpsec.com/vuln/WPSEC-2026-0579/) 2026-10-07: Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Unauthenticated Information Exposure via Failed Form Submissions (fixed in 2.10.1; Low 3.7)
- [WPSEC-2026-0578](https://wpsec.com/vuln/WPSEC-2026-0578/) 2026-10-07: CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce <= 6.1.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Status Modification via 'orderId' Parameter (fixed in 6.1.6; Medium 5.3)
- [WPSEC-2026-0577](https://wpsec.com/vuln/WPSEC-2026-0577/) 2026-10-07: HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.13 - Unauthenticated Insecure Direct Object Reference to Arbitrary Post Unpublishing via Popup REST Endpoints (fixed in 2.3.15; Medium 6.5)
- [WPSEC-2026-0576](https://wpsec.com/vuln/WPSEC-2026-0576/) 2026-10-07: OnPay.io for WooCommerce <= 1.0.53 - Cross-Site Request Forgery via OAuth Callback (fixed in 1.0.54; Medium 5.3)
- [WPSEC-2026-0575](https://wpsec.com/vuln/WPSEC-2026-0575/) 2026-10-07: Booking Package <= 1.7.29 - Unauthenticated Sensitive Information Exposure via 'public' Parameter (fixed in 1.7.30; High 7.5)
- [WPSEC-2026-0574](https://wpsec.com/vuln/WPSEC-2026-0574/) 2026-10-07: Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (fixed in 1.7.30; Medium 6.4)
- [WPSEC-2026-0573](https://wpsec.com/vuln/WPSEC-2026-0573/) 2026-10-07: Parse.ly <= 3.24.1 - Unauthenticated Sensitive Information Exposure of API Secret via Recommended Widget (fixed in 3.24.2; Medium 5.3)
- [WPSEC-2026-0572](https://wpsec.com/vuln/WPSEC-2026-0572/) 2026-10-07: Parse.ly <= 3.24.1 - Authenticated (Author+) Sensitive Information Exposure of Private and Draft Posts via REST API (fixed in 3.24.2; Medium 4.3)
- [WPSEC-2026-0571](https://wpsec.com/vuln/WPSEC-2026-0571/) 2026-10-07: Parse.ly <= 3.24.1 - Server-Side Request Forgery via Remote Request Host Allowlist Bypass (fixed in 3.24.2; Medium 5.4)
- [WPSEC-2026-0570](https://wpsec.com/vuln/WPSEC-2026-0570/) 2026-10-07: Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Wallet Withdrawal Requests (fixed in 2.8.0; Medium 4.3)
- [WPSEC-2026-0569](https://wpsec.com/vuln/WPSEC-2026-0569/) 2026-10-07: Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Wallet Balance Transfer (fixed in 2.8.0; Medium 6.5)
- [WPSEC-2026-0568](https://wpsec.com/vuln/WPSEC-2026-0568/) 2026-10-07: Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Missing Authorization to Sensitive Information Exposure via Wallet Transaction Export (fixed in 2.8.0; Medium 4.3)
- [WPSEC-2026-0567](https://wpsec.com/vuln/WPSEC-2026-0567/) 2026-10-07: Wallet System for WooCommerce <= 2.7.10 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Transaction CSV Export File (fixed in 2.8.0; Low 3.7)
- [WPSEC-2026-0566](https://wpsec.com/vuln/WPSEC-2026-0566/) 2026-10-07: Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Wallet Balance Manipulation via Negative Transfer Amount (fixed in 2.8.0; Medium 6.5)
- [WPSEC-2026-0565](https://wpsec.com/vuln/WPSEC-2026-0565/) 2026-10-07: QA Assistants – Driven by data <= 5.3.0.0 - Unauthenticated Path Traversal to Limited File Overwrite via 'readers_name' and 'raw_name' Parameters (fixed in 5.3.0.1; Critical 9.1)
- [WPSEC-2026-0564](https://wpsec.com/vuln/WPSEC-2026-0564/) 2026-10-07: QA Assistants – Driven by data <= 5.3.0.0 - Authenticated (Subscriber+) Missing Authorization to Visitor Analytics Exposure and Heatmap/Replay Generation via Multiple AJAX Actions (fixed in 5.3.0.1; Medium 5.4)
- [WPSEC-2026-0563](https://wpsec.com/vuln/WPSEC-2026-0563/) 2026-10-07: Order Tracking <= 3.5.4 - Unauthenticated Email Verification Bypass for Records Without an Email Address (fixed in 3.6.0; Low 3.7)
- [WPSEC-2026-0562](https://wpsec.com/vuln/WPSEC-2026-0562/) 2026-10-07: Order Tracking <= 3.5.4 - Unauthenticated Payment Bypass via PayPal IPN (fixed in 3.6.0; Medium 5.3)
- [WPSEC-2026-0561](https://wpsec.com/vuln/WPSEC-2026-0561/) 2026-10-07: Order Tracking <= 3.5.4 - Cross-Site Request Forgery to Order Bulk Actions (fixed in 3.6.0; Medium 5.4)
- [WPSEC-2026-0560](https://wpsec.com/vuln/WPSEC-2026-0560/) 2026-10-07: Order Tracking <= 3.5.4 - Unauthenticated Email Verification Bypass to Order Customer Note Update (fixed in 3.6.0; Low 3.7)
- [WPSEC-2026-0559](https://wpsec.com/vuln/WPSEC-2026-0559/) 2026-10-07: Order Tracking <= 3.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Order Viewing and Modification (fixed in 3.6.0; Medium 5.4)
- [WPSEC-2026-0558](https://wpsec.com/vuln/WPSEC-2026-0558/) 2026-10-07: Order Tracking <= 3.5.4 - Unauthenticated Sensitive Information Exposure via Front-End Order Download (fixed in 3.6.0; Medium 5.9)
- [WPSEC-2026-0557](https://wpsec.com/vuln/WPSEC-2026-0557/) 2026-10-07: Asaas Gateway for WooCommerce <= 2.7.7 - Improper Webhook Authentication to Unauthenticated Order Status Manipulation (fixed in 2.7.8; Medium 5.9)
- [WPSEC-2026-0556](https://wpsec.com/vuln/WPSEC-2026-0556/) 2026-10-07: Login Lockdown & Protection <= 2.17 - Unauthenticated Brute Force Protection Bypass via Email Address Login (fixed in 2.18; Medium 5.3)
- [WPSEC-2026-0555](https://wpsec.com/vuln/WPSEC-2026-0555/) 2026-10-07: GutenKit <= 2.5.2 - Authenticated (Author+) Server-Side Request Forgery via Media Upload From URL Route (fixed in 2.5.3; Medium 5.0)
- [WPSEC-2026-0554](https://wpsec.com/vuln/WPSEC-2026-0554/) 2026-10-07: Forms <= 3.0.2 - Authenticated (Subscriber+) Missing Authorization to Form and Submission Data Exposure (fixed in 3.0.3; Medium 4.3)
- [WPSEC-2026-0553](https://wpsec.com/vuln/WPSEC-2026-0553/) 2026-10-07: Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Price Manipulation via Reservation Price Parameters (fixed in 2.9.9.7.2; Medium 5.3)
- [WPSEC-2026-0552](https://wpsec.com/vuln/WPSEC-2026-0552/) 2026-10-07: CMB2 <= 2.13.2 - Authenticated (Editor+) Limited Options Update via REST API 'object_type' and 'object_id' Parameters (fixed in 2.13.3; Medium 5.0)
- [WPSEC-2026-0551](https://wpsec.com/vuln/WPSEC-2026-0551/) 2026-10-07: WP Ghost (Hide My WP Ghost) <= 7.0.12 - Insufficient Session Expiration in Temporary Logins on PHP 8 (fixed in 7.0.13; Medium 4.8)
- [WPSEC-2026-0550](https://wpsec.com/vuln/WPSEC-2026-0550/) 2026-10-07: WP Ghost (Hide My WP Ghost) <= 7.0.12 - Unauthenticated Firewall and Brute Force Protection Bypass via Forged Login Cookie (fixed in 7.0.13; Medium 5.3)
- [WPSEC-2026-0549](https://wpsec.com/vuln/WPSEC-2026-0549/) 2026-10-07: Retainful <= 1.0.10 - Unauthenticated Missing Authorization to Connection Settings Update and Sensitive Information Exposure (fixed in 1.0.11; Medium 6.5)
- [WPSEC-2026-0548](https://wpsec.com/vuln/WPSEC-2026-0548/) 2026-10-07: Retainful <= 1.0.10 - Authenticated (Subscriber+) Missing Authorization to Webhook Registration and Coupon Creation via REST API (fixed in 1.0.11; High 7.1)
- [WPSEC-2026-0547](https://wpsec.com/vuln/WPSEC-2026-0547/) 2026-10-07: WebinarPress <= 1.33.30 - Unauthenticated Reflected Cross-Site Scripting via 'content' Parameter (fixed in 1.33.31; Medium 6.1)
- [WPSEC-2026-0546](https://wpsec.com/vuln/WPSEC-2026-0546/) 2026-10-07: WebinarPress <= 1.33.30 - Unauthenticated Missing Authorization to Multiple AJAX Actions (fixed in 1.33.31; Medium 6.5)
- [WPSEC-2026-0545](https://wpsec.com/vuln/WPSEC-2026-0545/) 2026-10-07: WebinarPress <= 1.33.30 - Authenticated (Subscriber+) Missing Authorization to Multiple Administrative Actions (fixed in 1.33.31; Medium 5.4)
- [WPSEC-2026-0544](https://wpsec.com/vuln/WPSEC-2026-0544/) 2026-10-07: Bookly <= 28.4 - Unauthenticated Sensitive Information Exposure via Booking Form Info Text (fixed in 28.5; Low 3.7)
- [WPSEC-2026-0543](https://wpsec.com/vuln/WPSEC-2026-0543/) 2026-10-07: Bookly <= 28.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Staff Profile Update (fixed in 28.5; Medium 5.4)
- [WPSEC-2026-0542](https://wpsec.com/vuln/WPSEC-2026-0542/) 2026-10-07: WP Map Block <= 3.0.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Map Modification, Publication and Deletion (fixed in 3.1.0; Medium 5.4)
- [WPSEC-2026-0541](https://wpsec.com/vuln/WPSEC-2026-0541/) 2026-10-07: Rank Math SEO <= 1.0.279 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (fixed in 1.0.280; Medium 4.9)
- [WPSEC-2026-0540](https://wpsec.com/vuln/WPSEC-2026-0540/) 2026-10-07: Rank Math SEO <= 1.0.279 - Missing Authorization to Unauthenticated SEO Analyzer Results Deletion (fixed in 1.0.280; Medium 5.3)
- [WPSEC-2026-0539](https://wpsec.com/vuln/WPSEC-2026-0539/) 2026-10-07: LazyLoad Plugin <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via YouTube Video Title (fixed in 2.4.1; Medium 4.9)
- [WPSEC-2026-0538](https://wpsec.com/vuln/WPSEC-2026-0538/) 2026-10-07: Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Contact Fields (fixed in 3.5.0; Medium 4.9)
- [WPSEC-2026-0537](https://wpsec.com/vuln/WPSEC-2026-0537/) 2026-10-07: WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds <= 4.4.8 - Unauthenticated Insecure Direct Object Reference to Listing Modification and Deletion via 'listing_id' Parameter (fixed in 4.4.9; High 7.3)
- [WPSEC-2026-0536](https://wpsec.com/vuln/WPSEC-2026-0536/) 2026-10-07: Responsive Blocks <= 2.2.9 - Authenticated (Contributor+) Missing Authorization to Media Library Image Upload via Template Import REST Endpoint (fixed in 2.3.0; Medium 4.3)
- [WPSEC-2026-0535](https://wpsec.com/vuln/WPSEC-2026-0535/) 2026-10-07: Team Manager <= 2.6.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via dwl_create_team Shortcode (fixed in 2.6.8; Medium 4.3)
- [WPSEC-2026-0534](https://wpsec.com/vuln/WPSEC-2026-0534/) 2026-10-07: Team Manager <= 2.6.7 - Unauthenticated Sensitive Information Exposure via Password-Protected Team Members (fixed in 2.6.8; Medium 5.3)
- [WPSEC-2026-0533](https://wpsec.com/vuln/WPSEC-2026-0533/) 2026-10-07: affiliate-toolkit <= 3.9.0 - Authenticated (Contributor+) Remote Code Execution via Template Reference (fixed in 3.9.1; High 8.8)
- [WPSEC-2026-0532](https://wpsec.com/vuln/WPSEC-2026-0532/) 2026-10-07: rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Authenticated (Subscriber+) Limited File Read and Deletion via 'files' Parameter (fixed in 4.7.14; High 7.6)
- [WPSEC-2026-0531](https://wpsec.com/vuln/WPSEC-2026-0531/) 2026-10-07: rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Authenticated (Subscriber+) Missing Authorization to Media Attribute and Post Modification via Media Edit (fixed in 4.7.14; Medium 6.5)
- [WPSEC-2026-0530](https://wpsec.com/vuln/WPSEC-2026-0530/) 2026-10-07: WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Cross-Site Request Forgery via REST API Nonce Check Bypass (fixed in 4.2.0; High 8.8)
- [WPSEC-2026-0529](https://wpsec.com/vuln/WPSEC-2026-0529/) 2026-10-07: WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Unauthenticated Two-Factor Authentication Bypass via Flywheel Direct Login Handling (fixed in 4.2.0; High 8.1)
- [WPSEC-2026-0528](https://wpsec.com/vuln/WPSEC-2026-0528/) 2026-10-07: WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Unauthenticated Two-Factor Authentication Downgrade via 'provider' Parameter (fixed in 4.2.0; High 7.4)
- [WPSEC-2026-0527](https://wpsec.com/vuln/WPSEC-2026-0527/) 2026-10-07: WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Unauthenticated Two-Factor Authentication Bypass via Brute Force (fixed in 4.2.0; High 7.4)
- [WPSEC-2026-0526](https://wpsec.com/vuln/WPSEC-2026-0526/) 2026-10-07: WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Unauthenticated Open Redirect via 'redirect_to' Parameter (fixed in 4.2.0; Medium 6.1)
- [WPSEC-2026-0525](https://wpsec.com/vuln/WPSEC-2026-0525/) 2026-10-07: Tickera – Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated Payment Bypass via 2Checkout IPN Handler (fixed in 3.6.0.7; Medium 5.9)
- [WPSEC-2026-0524](https://wpsec.com/vuln/WPSEC-2026-0524/) 2026-10-07: Tickera – Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated Sales API Authentication Bypass via Empty API Key (fixed in 3.6.0.7; Medium 5.3)
- [WPSEC-2026-0523](https://wpsec.com/vuln/WPSEC-2026-0523/) 2026-10-07: Tickera – Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated SQL Injection via Sales API 'period_compare' Parameter (fixed in 3.6.0.7; High 7.5)
- [WPSEC-2026-0522](https://wpsec.com/vuln/WPSEC-2026-0522/) 2026-10-07: Event Tickets and Registration <= 5.30.0.1 - Unauthenticated Payment Bypass via RSVP Order REST Endpoint (fixed in 5.30.0.2; Medium 5.3)
- [WPSEC-2026-0521](https://wpsec.com/vuln/WPSEC-2026-0521/) 2026-10-07: Event Tickets and Registration <= 5.30.0.1 - Authenticated (Subscriber+) Missing Authorization to Attendee QR Check-In Status Modification (fixed in 5.30.0.2; Medium 4.3)
- [WPSEC-2026-0520](https://wpsec.com/vuln/WPSEC-2026-0520/) 2026-10-07: WPForms <= 2.0.2.1 - Unauthenticated Reflected Cross-Site Scripting via Smart Tags (fixed in 2.0.2.2; Medium 4.7)
- [WPSEC-2026-0519](https://wpsec.com/vuln/WPSEC-2026-0519/) 2026-10-07: Tutor LMS <= 4.1.0 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting via Quiz Question Feedback (fixed in 4.1.1; Medium 6.4)
- [WPSEC-2026-0518](https://wpsec.com/vuln/WPSEC-2026-0518/) 2026-10-07: Tutor LMS <= 4.1.0 - Unauthenticated Missing Authorization via Page Regeneration Action (fixed in 4.1.1; Medium 5.3)
- [WPSEC-2026-0517](https://wpsec.com/vuln/WPSEC-2026-0517/) 2026-10-07: Tutor LMS <= 4.1.0 - Unauthenticated Reflected Cross-Site Scripting via 'tab' Parameter (fixed in 4.1.1; Medium 4.7)
- [WPSEC-2026-0516](https://wpsec.com/vuln/WPSEC-2026-0516/) 2026-10-07: Tutor LMS <= 4.1.0 - Authenticated (Tutor Instructor+) Insecure Direct Object Reference to Arbitrary Post Overwrite via Course Creation 'ID' Parameter (fixed in 4.1.1; Medium 5.4)
- [WPSEC-2026-0515](https://wpsec.com/vuln/WPSEC-2026-0515/) 2026-10-07: Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Grade Manipulation via Quiz Attempt Submission (fixed in 4.1.1; Medium 4.3)
- [WPSEC-2026-0514](https://wpsec.com/vuln/WPSEC-2026-0514/) 2026-10-07: Tutor LMS <= 4.1.0 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting via Quiz Layout Setting (fixed in 4.1.1; Medium 6.4)
- [WPSEC-2026-0513](https://wpsec.com/vuln/WPSEC-2026-0513/) 2026-10-07: Robo Gallery <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Reparenting and Reordering via Gallery Hierarchy Save (fixed in 5.2.6; Medium 4.3)
- [WPSEC-2026-0512](https://wpsec.com/vuln/WPSEC-2026-0512/) 2026-10-07: Robo Gallery <= 5.1.6 - Authenticated (Contributor+) Insecure Direct Object Reference to Gallery Cloning (fixed in 5.2.6; Medium 5.4)
- [WPSEC-2026-0511](https://wpsec.com/vuln/WPSEC-2026-0511/) 2026-10-07: Robo Gallery <= 5.1.6 - Authenticated (Contributor+) Sensitive Information Exposure of Private and Draft Page Titles (fixed in 5.2.6; Medium 4.3)
- [WPSEC-2026-0510](https://wpsec.com/vuln/WPSEC-2026-0510/) 2026-10-07: Robo Gallery <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Search Label Setting (fixed in 5.2.6; Medium 6.4)
- [WPSEC-2026-0509](https://wpsec.com/vuln/WPSEC-2026-0509/) 2026-10-07: Cooked – Recipe Management <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode (fixed in 1.16.2; Medium 6.4)
- [WPSEC-2026-0508](https://wpsec.com/vuln/WPSEC-2026-0508/) 2026-10-07: WP Plugin Manager <= 1.4.16 - Authenticated (Subscriber+) Missing Authorization to Plugin Status Disclosure via REST API (fixed in 1.4.17; Medium 4.3)
- [WPSEC-2026-0507](https://wpsec.com/vuln/WPSEC-2026-0507/) 2026-10-07: Product Configurator for WooCommerce <= 1.7.5 - Authenticated (Shop Manager+) PHP Object Injection via Configurator Data (fixed in 1.7.6; Medium 6.6)
- [WPSEC-2026-0506](https://wpsec.com/vuln/WPSEC-2026-0506/) 2026-10-07: AutomatorWP <= 6.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Pending Redirect URL Disclosure (fixed in 6.0.4; Low 3.1)
- [WPSEC-2026-0505](https://wpsec.com/vuln/WPSEC-2026-0505/) 2026-10-07: Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.214.0 - Authenticated (Author+) Insecure Direct Object Reference to Arbitrary Post Read, Modification and Deletion via FAQ AJAX Actions (fixed in 17.311.0; High 7.6)
- [WPSEC-2026-0504](https://wpsec.com/vuln/WPSEC-2026-0504/) 2026-10-07: Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.214.0 - Unauthenticated Reflected Cross-Site Scripting via 'new_kb_config' Parameter (fixed in 17.311.0; Medium 6.1)
- [WPSEC-2026-0503](https://wpsec.com/vuln/WPSEC-2026-0503/) 2026-10-07: Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.214.0 - Unauthenticated REST API Nonce Exposure via AI Chat 'start-session' Endpoint (fixed in 17.311.0; High 7.5)
- [WPSEC-2026-0502](https://wpsec.com/vuln/WPSEC-2026-0502/) 2026-10-07: BackWPup – WordPress Backup & Restore Plugin <= 5.7.6 - Unauthenticated Sensitive Information Exposure via Predictable Restore Working Directory (fixed in 5.7.7; Medium 5.9)
- [WPSEC-2026-0501](https://wpsec.com/vuln/WPSEC-2026-0501/) 2026-10-07: BackWPup – WordPress Backup & Restore Plugin <= 5.7.6 - Missing Authorization to Unauthenticated Backup Job Execution (fixed in 5.7.7; Medium 6.5)
- [WPSEC-2026-0500](https://wpsec.com/vuln/WPSEC-2026-0500/) 2026-10-07: MailPoet – Newsletters, Email Marketing, and Automation <= 5.40.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Newsletter Style Settings (fixed in 5.41.0; Medium 4.4)
- [WPSEC-2026-0499](https://wpsec.com/vuln/WPSEC-2026-0499/) 2026-10-07: MailPoet – Newsletters, Email Marketing, and Automation <= 5.40.0 - Unauthenticated Authentication Bypass via Brute-Forceable Subscriber Link Tokens (fixed in 5.41.0; Medium 4.8)
- [WPSEC-2026-0498](https://wpsec.com/vuln/WPSEC-2026-0498/) 2026-10-07: Slider by 10Web – Responsive Image Slider <= 1.2.62 - Authenticated (Contributor+) PHP Object Injection via 'two_page_speed' Post Meta (fixed in 1.2.63; High 7.5)
- [WPSEC-2026-0497](https://wpsec.com/vuln/WPSEC-2026-0497/) 2026-10-07: MasterStudy LMS <= 3.7.52 - Authenticated (Contributor+) Missing Authorization to Payout Record Creation and Modification (fixed in 3.7.53; Medium 4.3)
- [WPSEC-2026-0496](https://wpsec.com/vuln/WPSEC-2026-0496/) 2026-10-07: MasterStudy LMS <= 3.7.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Payout Transaction ID (fixed in 3.7.53; Medium 6.4)
- [WPSEC-2026-0495](https://wpsec.com/vuln/WPSEC-2026-0495/) 2026-10-07: Ultimate Post Kit Addons for Elementor <= 4.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Author Widget Social Links Setting (fixed in 4.5.6; Medium 6.5)
- [WPSEC-2026-0494](https://wpsec.com/vuln/WPSEC-2026-0494/) 2026-10-07: YITH WooCommerce Product Add-Ons <= 4.34.0 - Unauthenticated Information Exposure of Unpublished Product Prices (fixed in 4.34.1; Medium 5.3)
- [WPSEC-2026-0493](https://wpsec.com/vuln/WPSEC-2026-0493/) 2026-10-07: YITH WooCommerce Product Add-Ons <= 4.34.0 - Authenticated (Shop Manager+) SQL Injection via 's' Parameter (fixed in 4.34.1; Medium 4.9)
- [WPSEC-2026-0492](https://wpsec.com/vuln/WPSEC-2026-0492/) 2026-10-07: Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cursor Effects Settings (fixed in 8.8.7; Medium 6.4)
- [WPSEC-2026-0491](https://wpsec.com/vuln/WPSEC-2026-0491/) 2026-10-07: Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Creative Button Widget 'button_css_id' Setting (fixed in 8.8.7; Medium 6.4)
- [WPSEC-2026-0490](https://wpsec.com/vuln/WPSEC-2026-0490/) 2026-10-07: Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via UIkit Component Attributes (fixed in 8.8.7; Medium 6.4)
- [WPSEC-2026-0489](https://wpsec.com/vuln/WPSEC-2026-0489/) 2026-10-07: Prime Slider – Addons For Elementor <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via UIkit Component Attributes (fixed in 4.7.0; Medium 6.4)
- [WPSEC-2026-0488](https://wpsec.com/vuln/WPSEC-2026-0488/) 2026-10-07: Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Tags (fixed in 8.10.1; Medium 6.4)
- [WPSEC-2026-0487](https://wpsec.com/vuln/WPSEC-2026-0487/) 2026-10-07: Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10 - Unauthenticated Sensitive Information Exposure via REST API (fixed in 8.10.1; Medium 5.3)
- [WPSEC-2026-0486](https://wpsec.com/vuln/WPSEC-2026-0486/) 2026-10-07: Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Map Info Window Phone Number and Coordinates (fixed in 8.10.1; Medium 6.4)
- [WPSEC-2026-0485](https://wpsec.com/vuln/WPSEC-2026-0485/) 2026-10-07: SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 2.7.0 - Unauthenticated Price Manipulation via 'sellkit_product_prices' Parameter (fixed in 2.8.0; High 7.5)
- [WPSEC-2026-0484](https://wpsec.com/vuln/WPSEC-2026-0484/) 2026-10-07: Contact Form 7 <= 6.1.7 - Authenticated (Editor+) Sensitive Information Exposure via User-Related Special Mail-Tags (fixed in 6.2; Medium 4.5)
- [WPSEC-2026-0483](https://wpsec.com/vuln/WPSEC-2026-0483/) 2026-10-06: Firelight Lightbox <= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Block src Attribute (fixed in 2.3.24; Medium 6.4)
- [WPSEC-2026-0482](https://wpsec.com/vuln/WPSEC-2026-0482/) 2026-10-06: Wise Chat <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via Chat Message Links (fixed in 3.4.2; Medium 6.1)
- [WPSEC-2026-0481](https://wpsec.com/vuln/WPSEC-2026-0481/) 2026-10-06: Motors – Car Dealership & Classified Listings <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter (fixed in 1.4.125; Medium 6.4)
- [WPSEC-2026-0480](https://wpsec.com/vuln/WPSEC-2026-0480/) 2026-10-06: User Activity Tracking and Log <= 4.3.1 - Unauthenticated IP Address Spoofing via Client-IP Header (fixed in 4.3.2; Medium 5.3)
- [WPSEC-2026-0479](https://wpsec.com/vuln/WPSEC-2026-0479/) 2026-10-06: Form Maker by 10Web <= 1.15.47 - Unauthenticated Reflected Cross-Site Scripting via 'inputs' Parameter Keys (fixed in 1.15.48; Medium 6.1)
- [WPSEC-2026-0478](https://wpsec.com/vuln/WPSEC-2026-0478/) 2026-10-06: LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress <= 10.2.1 - Authenticated (Instructor's Assistant+) PHP Object Injection via Course Builder Custom Fields (fixed in 10.3.0; High 7.5)
- [WPSEC-2026-0477](https://wpsec.com/vuln/WPSEC-2026-0477/) 2026-10-06: LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress <= 10.2.1 - Unauthenticated Sensitive Information Exposure via RSS Feeds (fixed in 10.3.0; Medium 5.3)
- [WPSEC-2026-0476](https://wpsec.com/vuln/WPSEC-2026-0476/) 2026-10-06: LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress <= 10.2.1 - Authenticated (Instructor's Assistant+) PHP Object Injection via Lesson Clone and Course Import (fixed in 10.3.0; High 7.5)
- [WPSEC-2026-0475](https://wpsec.com/vuln/WPSEC-2026-0475/) 2026-10-06: Zero Spam for WordPress <= 5.7.11 - Unauthenticated Country Block Bypass via 'CF-IPCountry' and 'X-Forwarded-Country' Headers (fixed in 5.7.12; Low 3.7)
- [WPSEC-2026-0474](https://wpsec.com/vuln/WPSEC-2026-0474/) 2026-10-06: Zero Spam for WordPress <= 5.7.11 - Unauthenticated Login Protection Bypass via 'woocommerce-login-nonce' and 'pp_current_url' Parameters (fixed in 5.7.12; Medium 5.3)
- [WPSEC-2026-0473](https://wpsec.com/vuln/WPSEC-2026-0473/) 2026-10-06: WP Attachments <= 6.0.3 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via 'download' Parameter (fixed in 6.1; Medium 5.3)
- [WPSEC-2026-0472](https://wpsec.com/vuln/WPSEC-2026-0472/) 2026-10-06: WooCommerce EU VAT Assistant <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via VAT Number (fixed in 2.2.0.261001; High 7.2)
- [WPSEC-2026-0471](https://wpsec.com/vuln/WPSEC-2026-0471/) 2026-10-06: Event Booking Manager for WooCommerce <= 5.7.5 - Unauthenticated Missing Authorization to Paid Event RSVP Registration and Online Event Details Disclosure (fixed in 5.7.6; Medium 4.8)
- [WPSEC-2026-0470](https://wpsec.com/vuln/WPSEC-2026-0470/) 2026-10-06: AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via Subscriber Name and Custom Field Values (fixed in 11.1.1; Medium 6.1)
- [WPSEC-2026-0469](https://wpsec.com/vuln/WPSEC-2026-0469/) 2026-10-06: Extensions For CF7 <= 3.4.5 - Unauthenticated Limited Arbitrary File Upload via Signature Field (fixed in 3.4.6; High 8.1)
- [WPSEC-2026-0468](https://wpsec.com/vuln/WPSEC-2026-0468/) 2026-10-06: GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Email Custom Field (fixed in 2.8.189; Medium 5.4)
- [WPSEC-2026-0467](https://wpsec.com/vuln/WPSEC-2026-0467/) 2026-10-06: WP Meteor Website Speed Optimization Addon <= 3.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via onload/onerror Attribute Rewriting (fixed in 3.4.19; Medium 6.4)
- [WPSEC-2026-0466](https://wpsec.com/vuln/WPSEC-2026-0466/) 2026-10-06: Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'result_id' and 'qsm_unique_key' Parameters (fixed in 11.2.8; High 7.3)
- [WPSEC-2026-0465](https://wpsec.com/vuln/WPSEC-2026-0465/) 2026-10-06: Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Question Modification and Deletion (fixed in 11.2.8; Medium 5.4)
- [WPSEC-2026-0464](https://wpsec.com/vuln/WPSEC-2026-0464/) 2026-10-06: Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection via Quiz Settings (fixed in 11.2.8; High 7.5)
- [WPSEC-2026-0463](https://wpsec.com/vuln/WPSEC-2026-0463/) 2026-10-06: Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Question Length Settings (fixed in 11.2.8; Medium 6.4)
- [WPSEC-2026-0462](https://wpsec.com/vuln/WPSEC-2026-0462/) 2026-10-06: YOP Poll <= 7.0.12 - Unauthenticated Information Exposure of Results on Registered-Only Polls (fixed in 7.0.13; Medium 5.3)
- [WPSEC-2026-0461](https://wpsec.com/vuln/WPSEC-2026-0461/) 2026-10-06: MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.4 - Unauthenticated Admin Email Flooding via subscribe_to_email_list (fixed in 1.2.78.5; Medium 5.3)
- [WPSEC-2026-0460](https://wpsec.com/vuln/WPSEC-2026-0460/) 2026-10-06: MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 - Unauthenticated PHP Object Injection via Clone/Restore Database Values (fixed in 6.2.2; High 7.5)
- [WPSEC-2026-0459](https://wpsec.com/vuln/WPSEC-2026-0459/) 2026-10-06: WPC Smart Quick View for WooCommerce <= 4.4.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Products in Quick View (fixed in 4.4.2; Medium 5.3)
- [WPSEC-2026-0458](https://wpsec.com/vuln/WPSEC-2026-0458/) 2026-10-06: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Authenticated (Subscriber+) Missing Authorization to Application-Level Microsoft Graph Access via 'application' Parameter (fixed in 45.0; High 8.2)
- [WPSEC-2026-0457](https://wpsec.com/vuln/WPSEC-2026-0457/) 2026-10-06: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via ID Token Claims in Health Messages (fixed in 45.0; High 7.2)
- [WPSEC-2026-0456](https://wpsec.com/vuln/WPSEC-2026-0456/) 2026-10-06: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Authenticated (Subscriber+) Server-Side Request Forgery via Microsoft Graph Proxy (fixed in 45.0; High 7.1)
- [WPSEC-2026-0455](https://wpsec.com/vuln/WPSEC-2026-0455/) 2026-10-06: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via Missing ID Token Issuer and Audience Validation (fixed in 45.0; Medium 6.5)
- [WPSEC-2026-0454](https://wpsec.com/vuln/WPSEC-2026-0454/) 2026-10-06: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection via 'pms-view' Parameter on Payments List (fixed in 3.1.2; Medium 6.5)
- [WPSEC-2026-0453](https://wpsec.com/vuln/WPSEC-2026-0453/) 2026-10-06: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection via 'pms-view' Parameter on Members List (fixed in 3.1.2; Medium 6.5)
- [WPSEC-2026-0452](https://wpsec.com/vuln/WPSEC-2026-0452/) 2026-10-06: Appointment Booking Plugin <= 5.7.3 - Unauthenticated Sensitive Information Exposure via Template Variable Injection in Customer Name and Notes (fixed in 5.7.4; Medium 5.3)
- [WPSEC-2026-0451](https://wpsec.com/vuln/WPSEC-2026-0451/) 2026-10-06: Appointment Booking Plugin <= 5.7.3 - Unauthenticated Insecure Direct Object Reference to Cart Item Modification via 'active_cart_item[id]' (fixed in 5.7.4; Medium 5.3)
- [WPSEC-2026-0450](https://wpsec.com/vuln/WPSEC-2026-0450/) 2026-10-06: Admin and Site Enhancements (ASE) <= 9.1.4 - Unauthenticated Denial of Service via 'asenha_password_protection' Cookie (fixed in 9.2.0; Medium 5.9)
- [WPSEC-2026-0449](https://wpsec.com/vuln/WPSEC-2026-0449/) 2026-10-06: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Missing Authorization to Booking Status Update (fixed in 4.1.26; Medium 5.3)
- [WPSEC-2026-0448](https://wpsec.com/vuln/WPSEC-2026-0448/) 2026-10-06: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Sensitive Information Exposure via Event Structured Data (fixed in 4.1.26; Low 3.7)
- [WPSEC-2026-0447](https://wpsec.com/vuln/WPSEC-2026-0447/) 2026-10-06: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Sensitive Information Exposure via Event REST API (fixed in 4.1.26; Medium 5.3)
- [WPSEC-2026-0446](https://wpsec.com/vuln/WPSEC-2026-0446/) 2026-10-06: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Payment Bypass via Mismatched Order Attendees (fixed in 4.1.26; Medium 5.3)
- [WPSEC-2026-0445](https://wpsec.com/vuln/WPSEC-2026-0445/) 2026-10-06: YITH WooCommerce Compare <= 3.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_woocompare_counter Shortcode Attributes (fixed in 3.15.0; Medium 6.4)
- [WPSEC-2026-0444](https://wpsec.com/vuln/WPSEC-2026-0444/) 2026-10-06: Wallet for WooCommerce <= 1.7.0 - Authenticated (Vendor+) Incorrect Authorization to Wallet Partial Payment Refund (fixed in 1.7.1; Low 3.1)
- [WPSEC-2026-0443](https://wpsec.com/vuln/WPSEC-2026-0443/) 2026-10-06: Wallet for WooCommerce <= 1.7.0 - Cross-Site Request Forgery to Wallet Partial Payment Refund (fixed in 1.7.1; Medium 4.3)
- [WPSEC-2026-0442](https://wpsec.com/vuln/WPSEC-2026-0442/) 2026-10-06: Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 - Missing Authorization to Authenticated (Subscriber+) Non-Public Post Title Disclosure (fixed in 7.8.14.3; Medium 4.3)
- [WPSEC-2026-0441](https://wpsec.com/vuln/WPSEC-2026-0441/) 2026-10-06: Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.41 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Archive Title Block (fixed in 5.1.0; Medium 4.9)
- [WPSEC-2026-0440](https://wpsec.com/vuln/WPSEC-2026-0440/) 2026-10-06: Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.41 - Authenticated (Subscriber+) Sensitive Information Exposure via Localized Plugin Settings (fixed in 5.1.0; Medium 4.3)
- [WPSEC-2026-0439](https://wpsec.com/vuln/WPSEC-2026-0439/) 2026-10-06: Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via GLightbox Slide Options (fixed in 2.7.10; Medium 6.4)
- [WPSEC-2026-0438](https://wpsec.com/vuln/WPSEC-2026-0438/) 2026-10-06: Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nivo Lightbox HiDPI Image Source (fixed in 2.7.10; Medium 4.4)
- [WPSEC-2026-0437](https://wpsec.com/vuln/WPSEC-2026-0437/) 2026-10-06: Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Link Title Attribute (fixed in 2.7.10; Medium 6.4)
- [WPSEC-2026-0436](https://wpsec.com/vuln/WPSEC-2026-0436/) 2026-10-06: Master Slider <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode Attributes (fixed in 3.11.3; Medium 6.4)
- [WPSEC-2026-0435](https://wpsec.com/vuln/WPSEC-2026-0435/) 2026-10-06: HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Bar Page Settings (fixed in 3.50.1; Medium 6.4)
- [WPSEC-2026-0434](https://wpsec.com/vuln/WPSEC-2026-0434/) 2026-10-05: Site Reviews <= 8.3.3 - Authenticated (Subscriber+) Missing Authorization to User Information Exposure via REST Shortcode Options Endpoint (fixed in 8.3.4; Medium 4.3)
- [WPSEC-2026-0433](https://wpsec.com/vuln/WPSEC-2026-0433/) 2026-10-05: Page Builder by SiteOrigin <= 2.36.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'panels_data' Post Meta (fixed in 2.37.0; Medium 6.4)
- [WPSEC-2026-0432](https://wpsec.com/vuln/WPSEC-2026-0432/) 2026-10-05: Rate My Post – Star Rating Plugin by FeedbackWP <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Top Rated Posts Widget (fixed in 4.5.3; Medium 6.4)
- [WPSEC-2026-0431](https://wpsec.com/vuln/WPSEC-2026-0431/) 2026-10-05: Unlimited Elements For Elementor <= 2.0.22 - Authenticated (Contributor+) Limited Arbitrary Function Call via Post List 'includeby_function_name' Setting (fixed in 2.0.23; High 7.6)
- [WPSEC-2026-0430](https://wpsec.com/vuln/WPSEC-2026-0430/) 2026-10-04: Salon booking system <= 10.31.8 - Unauthenticated Sensitive Information Exposure via PWA index.html Access Token (fixed in 10.31.9; Critical 9.8)
- [WPSEC-2026-0429](https://wpsec.com/vuln/WPSEC-2026-0429/) 2026-10-04: Salon booking system <= 10.31.8 - Unauthenticated Authentication Bypass via Predictable Zapier API Key (fixed in 10.31.9; Medium 6.5)
- [WPSEC-2026-0428](https://wpsec.com/vuln/WPSEC-2026-0428/) 2026-10-04: Salon booking system <= 10.31.8 - Unauthenticated Authentication Bypass via Predictable REST API Access Tokens (fixed in 10.31.9; High 8.1)
- [WPSEC-2026-0427](https://wpsec.com/vuln/WPSEC-2026-0427/) 2026-10-04: GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via sq_keyword Custom Field (fixed in 14.2.7; Medium 6.4)
- [WPSEC-2026-0426](https://wpsec.com/vuln/WPSEC-2026-0426/) 2026-10-04: GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Editor+) Missing Authorization to Arbitrary Plugin Settings Update (fixed in 14.2.7; Low 2.7)
- [WPSEC-2026-0425](https://wpsec.com/vuln/WPSEC-2026-0425/) 2026-10-04: GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Facebook Pixel Code (fixed in 14.2.7; Medium 6.4)
- [WPSEC-2026-0424](https://wpsec.com/vuln/WPSEC-2026-0424/) 2026-10-04: GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Page SEO Modification (fixed in 14.2.7; Medium 4.3)
- [WPSEC-2026-0423](https://wpsec.com/vuln/WPSEC-2026-0423/) 2026-10-04: GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure (fixed in 14.2.7; Medium 4.3)
- [WPSEC-2026-0422](https://wpsec.com/vuln/WPSEC-2026-0422/) 2026-10-04: GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Editor+) Arbitrary File Read via Favicon Setting (fixed in 14.2.7; Medium 4.9)
- [WPSEC-2026-0421](https://wpsec.com/vuln/WPSEC-2026-0421/) 2026-10-04: WP Mailster <= 1.9.0.0 - Authenticated (Contributor+) Missing Authorization to Mail Server Settings Exposure and Modification (fixed in 1.9.1.0; High 7.6)
- [WPSEC-2026-0420](https://wpsec.com/vuln/WPSEC-2026-0420/) 2026-10-04: WP Mailster <= 1.9.0.0 - Unauthenticated Stored Cross-Site Scripting via Subscriber Name (fixed in 1.9.1.0; High 7.2)
- [WPSEC-2026-0419](https://wpsec.com/vuln/WPSEC-2026-0419/) 2026-10-04: GoodMeet <= 2.0.0 - Authenticated (Contributor+) Missing Authorization to Restricted Meeting Disclosure via 'goodmeet-google-meeting' Shortcode (fixed in 2.1.0; Medium 4.3)
- [WPSEC-2026-0418](https://wpsec.com/vuln/WPSEC-2026-0418/) 2026-10-04: GoodMeet <= 2.0.0 - Unauthenticated Sensitive Information Exposure via 'goodmeet_meeting_list' AJAX Action (fixed in 2.1.0; Medium 5.3)
- [WPSEC-2026-0417](https://wpsec.com/vuln/WPSEC-2026-0417/) 2026-10-04: Mapster WP Maps <= 2.0.4 - Reflected Cross-Site Scripting via 'id' Parameter (fixed in 2.0.5; Medium 6.1)
- [WPSEC-2026-0416](https://wpsec.com/vuln/WPSEC-2026-0416/) 2026-10-04: Ni WooCommerce Payment Gateway Charges < 1.7.0 - Missing Authorization to Unauthenticated Settings Update (fixed in 1.7.0; Medium 5.3)
- [WPSEC-2026-0415](https://wpsec.com/vuln/WPSEC-2026-0415/) 2026-10-04: Split Pay for Stripe on WooCommerce <= 3.8.4 - Authenticated (Vendor+) Missing Authorization to Dokan Supplier Vendor Payout Modification (fixed in 3.8.5; Medium 4.3)
- [WPSEC-2026-0414](https://wpsec.com/vuln/WPSEC-2026-0414/) 2026-10-04: SMS Alert <= 4.0.0 - Unauthenticated OTP Verification Bypass via Form Submission (fixed in 4.0.1; Medium 5.3)
- [WPSEC-2026-0413](https://wpsec.com/vuln/WPSEC-2026-0413/) 2026-10-04: SMS Alert <= 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP (fixed in 4.0.1; High 8.1)
- [WPSEC-2026-0412](https://wpsec.com/vuln/WPSEC-2026-0412/) 2026-10-04: Advanced Form Integration <= 2.9.0 - Unauthenticated Privilege Escalation via Account Takeover in Ultimate Member 'Update Profile Field' Action (fixed in 2.10.0; High 8.1)
- [WPSEC-2026-0411](https://wpsec.com/vuln/WPSEC-2026-0411/) 2026-10-03: Fattura24 <= 8.1.15 - Unauthenticated Sensitive Information Exposure via Log Files (fixed in 8.2.0; High 7.5)
- [WPSEC-2026-0410](https://wpsec.com/vuln/WPSEC-2026-0410/) 2026-10-03: Fattura24 <= 8.1.15 - Unauthenticated Sensitive Information Exposure via Predictable Document PDF File Names (fixed in 8.2.0; Medium 5.3)
- [WPSEC-2026-0409](https://wpsec.com/vuln/WPSEC-2026-0409/) 2026-10-03: Better Sharing <= 2.9.0 - Unauthenticated Content Injection via Share Email REST Route (fixed in 2.10.0; Medium 5.3)
- [WPSEC-2026-0408](https://wpsec.com/vuln/WPSEC-2026-0408/) 2026-10-03: Better Sharing <= 2.9.0 - Missing Authorization to Unauthenticated Arbitrary Email Sending via Test Email REST Route (fixed in 2.10.0; Medium 5.3)
- [WPSEC-2026-0407](https://wpsec.com/vuln/WPSEC-2026-0407/) 2026-10-03: Wicked Folders <= 4.1.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Screen State Overwrite via REST API (fixed in 4.2.0; Medium 4.3)
- [WPSEC-2026-0406](https://wpsec.com/vuln/WPSEC-2026-0406/) 2026-10-03: Wicked Folders <= 4.1.3 - Authenticated (Contributor+) Missing Authorization to Folder Assignment of Arbitrary Posts via REST API (fixed in 4.2.0; Medium 4.3)
- [WPSEC-2026-0405](https://wpsec.com/vuln/WPSEC-2026-0405/) 2026-10-03: GPTranslate <= 2.34.12 - Unauthenticated Stored Cross-Site Scripting via Translated Attributes in the DOMDocument Rendering Method (fixed in 2.34.13; Medium 5.4)
- [WPSEC-2026-0404](https://wpsec.com/vuln/WPSEC-2026-0404/) 2026-10-03: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Brute Force Protection Bypass (fixed in 4.17.6; Medium 4.8)
- [WPSEC-2026-0403](https://wpsec.com/vuln/WPSEC-2026-0403/) 2026-10-03: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content (fixed in 4.17.6; Medium 6.3)
- [WPSEC-2026-0402](https://wpsec.com/vuln/WPSEC-2026-0402/) 2026-10-03: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Sensitive Information Exposure via Member Directory Filters (fixed in 4.17.6; Medium 5.3)
- [WPSEC-2026-0401](https://wpsec.com/vuln/WPSEC-2026-0401/) 2026-10-03: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Privilege Escalation via Registration Form ID Tampering (fixed in 4.17.6; High 8.1)
- [WPSEC-2026-0400](https://wpsec.com/vuln/WPSEC-2026-0400/) 2026-10-03: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Content Restriction Bypass via REST API (fixed in 4.17.6; Medium 5.3)
- [WPSEC-2026-0399](https://wpsec.com/vuln/WPSEC-2026-0399/) 2026-10-03: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Limited File Upload via Non-File Custom Fields (fixed in 4.17.6; Medium 5.3)
- [WPSEC-2026-0398](https://wpsec.com/vuln/WPSEC-2026-0398/) 2026-10-03: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Reflected Cross-Site Scripting via 'start_date' and 'end_date' Parameters (fixed in 4.17.6; Medium 6.1)
- [WPSEC-2026-0397](https://wpsec.com/vuln/WPSEC-2026-0397/) 2026-10-03: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Reflected Cross-Site Scripting via Member Directory Date Filter (fixed in 4.17.6; Medium 6.1)
- [WPSEC-2026-0396](https://wpsec.com/vuln/WPSEC-2026-0396/) 2026-10-03: WP User Manager – User Profile Builder & Membership <= 2.9.21 - Unauthenticated Sensitive Information Exposure via REST API (fixed in 2.9.22; Medium 5.3)
- [WPSEC-2026-0395](https://wpsec.com/vuln/WPSEC-2026-0395/) 2026-10-03: WP Captcha PRO <= 5.40 - Unauthenticated CAPTCHA Bypass via 'rest_route' Parameter (fixed in 5.41; Medium 5.3)
- [WPSEC-2026-0394](https://wpsec.com/vuln/WPSEC-2026-0394/) 2026-10-03: WP Captcha PRO <= 5.40 - Unauthenticated Login CAPTCHA and Lockout Bypass for Incorrect Passwords (fixed in 5.41; Medium 5.3)
- [WPSEC-2026-0393](https://wpsec.com/vuln/WPSEC-2026-0393/) 2026-10-03: Animated Number Counters <= 2.9 - Authenticated (Editor+) SQL Injection via 'rearrange_counter_list' Parameter (fixed in 3.1; Medium 4.9)
- [WPSEC-2026-0392](https://wpsec.com/vuln/WPSEC-2026-0392/) 2026-10-03: Import and export users and customers <= 2.5.6 - Authenticated (Custom+) Privilege Escalation via Account Takeover in Cron Import (fixed in 2.5.7; High 7.2)
- [WPSEC-2026-0391](https://wpsec.com/vuln/WPSEC-2026-0391/) 2026-10-03: SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection in Widget Style Values (fixed in 1.75.0; Medium 6.5)
- [WPSEC-2026-0390](https://wpsec.com/vuln/WPSEC-2026-0390/) 2026-10-03: AI Puffer – Chat. Create. Automate. (formerly AI Power) <= 2.4.89 - Authenticated (Knowledge Base Access) Missing Authorization to Content Indexing Settings Update (fixed in 2.4.90; Low 3.1)
- [WPSEC-2026-0389](https://wpsec.com/vuln/WPSEC-2026-0389/) 2026-10-03: AI Puffer – Chat. Create. Automate. (formerly AI Power) <= 2.4.89 - Authenticated (Knowledge Base Access) Missing Authorization to Semantic Search Settings Update (fixed in 2.4.90; Low 3.1)
- [WPSEC-2026-0388](https://wpsec.com/vuln/WPSEC-2026-0388/) 2026-10-03: 404 Solution <= 4.3.5 - Unauthenticated Open Redirect via Regex Redirect Captures (fixed in 4.3.6; Medium 4.7)
- [WPSEC-2026-0387](https://wpsec.com/vuln/WPSEC-2026-0387/) 2026-10-03: Import and export users and customers <= 2.5.5 - Authenticated (Custom+) Missing Authorization to User Role Removal via Import and Cron Settings (fixed in 2.5.6; Medium 4.9)
- [WPSEC-2026-0386](https://wpsec.com/vuln/WPSEC-2026-0386/) 2026-10-03: Comment Cleaner — Bulk Delete & Disable Comments <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Comment Deletion (fixed in 7.2; Medium 4.3)
- [WPSEC-2026-0385](https://wpsec.com/vuln/WPSEC-2026-0385/) 2026-10-03: JS Job Manager < 2.0.3 - Unauthenticated Arbitrary File Deletion via Company Deletion (fixed in 2.0.3; Critical 9.1)
- [WPSEC-2026-0384](https://wpsec.com/vuln/WPSEC-2026-0384/) 2026-10-03: JS Job Manager < 2.0.3 - Unauthenticated Privilege Escalation via Post Installation Wizard (fixed in 2.0.3; Critical 9.8)
- [WPSEC-2026-0383](https://wpsec.com/vuln/WPSEC-2026-0383/) 2026-10-03: JS Job Manager < 2.0.3 - Unauthenticated Stored Cross-Site Scripting via Resume Video Field (fixed in 2.0.3; High 7.2)
- [WPSEC-2026-0382](https://wpsec.com/vuln/WPSEC-2026-0382/) 2026-10-03: Form Block <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data (fixed in 1.8.2; High 7.2)
- [WPSEC-2026-0381](https://wpsec.com/vuln/WPSEC-2026-0381/) 2026-10-03: WP Coder <= 4.5.1 - Authenticated (Editor+) Remote Code Execution via PHP Code Snippets (fixed in 4.5.2; High 7.2)
- [WPSEC-2026-0380](https://wpsec.com/vuln/WPSEC-2026-0380/) 2026-10-03: PowerFolio – Portfolio & Image Gallery for Elementor <= 3.2.7 - Authenticated (Contributor+) CSS Injection via Gutenberg Block Attributes (fixed in 3.2.8; Medium 5.0)
- [WPSEC-2026-0379](https://wpsec.com/vuln/WPSEC-2026-0379/) 2026-10-03: GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter (fixed in 2.8.188; Critical 9.8)
- [WPSEC-2026-0378](https://wpsec.com/vuln/WPSEC-2026-0378/) 2026-10-03: Ivory Search <= 5.5.18 - Unauthenticated Reflected Cross-Site Scripting via Highlight Search Terms (fixed in 5.5.19; Medium 6.1)
- [WPSEC-2026-0377](https://wpsec.com/vuln/WPSEC-2026-0377/) 2026-10-03: Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute (fixed in 3.3.72; Medium 5.4)
- [WPSEC-2026-0376](https://wpsec.com/vuln/WPSEC-2026-0376/) 2026-10-03: Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Tokens (fixed in 3.3.72; Medium 5.7)
- [WPSEC-2026-0375](https://wpsec.com/vuln/WPSEC-2026-0375/) 2026-10-03: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.34.5 - Unauthenticated Path Traversal via Page Cache Path (fixed in 2.34.8; Medium 6.5)
- [WPSEC-2026-0374](https://wpsec.com/vuln/WPSEC-2026-0374/) 2026-10-03: Contact Form Widget <= 1.5.2 - Unauthenticated CSV Injection via Contact Form Submissions (fixed in 1.5.3; Medium 6.1)
- [WPSEC-2026-0373](https://wpsec.com/vuln/WPSEC-2026-0373/) 2026-10-03: Quran multilanguage Text & Audio < 3.0.4 - Unauthenticated Path Traversal to Arbitrary .txt File Read via 'lang' Parameter (fixed in 3.0.4; Medium 5.3)
- [WPSEC-2026-0372](https://wpsec.com/vuln/WPSEC-2026-0372/) 2026-10-03: JS Help Desk – Best Help Desk & Support Plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Internal Note Attachment Download (fixed in 5.0.0; Medium 4.3)
- [WPSEC-2026-0371](https://wpsec.com/vuln/WPSEC-2026-0371/) 2026-10-03: Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.2 - Unauthenticated Sensitive Information Exposure via Predictable Folder Download Archive (fixed in 3.2.3; Low 3.7)
- [WPSEC-2026-0370](https://wpsec.com/vuln/WPSEC-2026-0370/) 2026-10-03: Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Folder Structure Modification (fixed in 3.2.3; Medium 4.3)
- [WPSEC-2026-0369](https://wpsec.com/vuln/WPSEC-2026-0369/) 2026-10-03: Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Billing State, Phone and Tax ID Fields (fixed in 7.2.7; Medium 6.4)
- [WPSEC-2026-0368](https://wpsec.com/vuln/WPSEC-2026-0368/) 2026-10-03: Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Subscriber+) Privilege Escalation via Support User Impersonation (fixed in 4.9; High 7.1)
- [WPSEC-2026-0367](https://wpsec.com/vuln/WPSEC-2026-0367/) 2026-10-03: WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Term and Shipping Configuration Disclosure (fixed in 4.0.2; Medium 4.3)
- [WPSEC-2026-0366](https://wpsec.com/vuln/WPSEC-2026-0366/) 2026-10-03: WPC Smart Quick View for WooCommerce <= 4.4.0 - Unauthenticated Reflected Cross-Site Scripting via 'woosq-redirect' Parameter (fixed in 4.4.1; Medium 6.1)
- [WPSEC-2026-0365](https://wpsec.com/vuln/WPSEC-2026-0365/) 2026-10-03: Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via Nested Field References in Calculated Field Equations (fixed in 5.5.1.6; Medium 4.7)
- [WPSEC-2026-0364](https://wpsec.com/vuln/WPSEC-2026-0364/) 2026-10-02: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (fixed in 5.15; Medium 6.4)
- [WPSEC-2026-0363](https://wpsec.com/vuln/WPSEC-2026-0363/) 2026-10-02: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Store Popup Content (fixed in 5.15; Medium 5.4)
- [WPSEC-2026-0362](https://wpsec.com/vuln/WPSEC-2026-0362/) 2026-10-02: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Unauthenticated Sensitive Information Exposure via load_post_by_ajax AJAX Action (fixed in 5.15; Medium 5.3)
- [WPSEC-2026-0361](https://wpsec.com/vuln/WPSEC-2026-0361/) 2026-10-02: GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Reflected Cross-Site Scripting via Stripe Webhook Event Type (fixed in 4.18.0; Medium 6.1)
- [WPSEC-2026-0360](https://wpsec.com/vuln/WPSEC-2026-0360/) 2026-10-02: GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Sensitive Information Exposure via Email Meta Tag Injection (fixed in 4.18.0; Medium 5.3)
- [WPSEC-2026-0359](https://wpsec.com/vuln/WPSEC-2026-0359/) 2026-10-02: GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Grid Shortcode and Campaign Block Attributes (fixed in 4.18.0; Medium 6.4)
- [WPSEC-2026-0358](https://wpsec.com/vuln/WPSEC-2026-0358/) 2026-10-02: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.1 - Authenticated (Author+) Mass Assignment to Arbitrary Post Overwrite/Deletion and Gallery Path Change via REST API (fixed in 4.5.2; Medium 5.4)
- [WPSEC-2026-0357](https://wpsec.com/vuln/WPSEC-2026-0357/) 2026-10-02: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.1 - Authenticated (Author+) Path Traversal via ZIP Archive Upload (fixed in 4.5.2; Low 3.1)
- [WPSEC-2026-0356](https://wpsec.com/vuln/WPSEC-2026-0356/) 2026-10-02: Name Directory <= 1.34.2 - Unauthenticated Arbitrary Shortcode Execution via Public Name Submission Description (fixed in 1.34.3; Medium 6.5)
- [WPSEC-2026-0355](https://wpsec.com/vuln/WPSEC-2026-0355/) 2026-10-02: Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute (fixed in 1.34.3; Medium 6.4)
- [WPSEC-2026-0354](https://wpsec.com/vuln/WPSEC-2026-0354/) 2026-10-02: All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via Search Query (fixed in 5.0.2.1; High 7.3)
- [WPSEC-2026-0353](https://wpsec.com/vuln/WPSEC-2026-0353/) 2026-10-02: Blocksy Companion <= 2.1.57 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (fixed in 2.1.58; Medium 6.4)
- [WPSEC-2026-0352](https://wpsec.com/vuln/WPSEC-2026-0352/) 2026-10-02: Blocksy Companion <= 2.1.57 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Search Block Placeholder (fixed in 2.1.58; Medium 6.4)
- [WPSEC-2026-0351](https://wpsec.com/vuln/WPSEC-2026-0351/) 2026-10-02: Blocksy Companion <= 2.1.57 - Authenticated (Contributor+) Stored Cross-Site Scripting via Breadcrumbs Block Attributes (fixed in 2.1.58; Medium 6.4)
- [WPSEC-2026-0350](https://wpsec.com/vuln/WPSEC-2026-0350/) 2026-10-02: Envira Gallery <= 1.16.0 - Authenticated (Contributor+) Path Traversal to Image File Write via 'crop_position' Gallery Setting (fixed in 1.16.1; Low 3.1)
- [WPSEC-2026-0349](https://wpsec.com/vuln/WPSEC-2026-0349/) 2026-10-02: Envira Gallery <= 1.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Configuration Values (fixed in 1.16.1; Medium 6.4)
- [WPSEC-2026-0348](https://wpsec.com/vuln/WPSEC-2026-0348/) 2026-10-02: GeoDirectory <= 2.8.186 - Authenticated (Subscriber+) SQL Injection via Listing Latitude and Longitude (fixed in 2.8.187; Medium 6.5)
- [WPSEC-2026-0347](https://wpsec.com/vuln/WPSEC-2026-0347/) 2026-10-02: GeoDirectory <= 2.8.186 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Latitude and Longitude (fixed in 2.8.187; Medium 5.4)
- [WPSEC-2026-0346](https://wpsec.com/vuln/WPSEC-2026-0346/) 2026-10-02: VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via Chat Attachment File Name (fixed in 1.8.16; High 7.2)
- [WPSEC-2026-0345](https://wpsec.com/vuln/WPSEC-2026-0345/) 2026-10-02: VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Reflected Cross-Site Scripting via Pagination Links (fixed in 1.8.16; Medium 6.1)
- [WPSEC-2026-0344](https://wpsec.com/vuln/WPSEC-2026-0344/) 2026-10-02: SmartVideo <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call-to-Action Overlay Shortcode and Block Attributes (fixed in 2.4.5; Medium 6.4)
- [WPSEC-2026-0343](https://wpsec.com/vuln/WPSEC-2026-0343/) 2026-10-02: Create Block Theme <= 2.10.1 - Authenticated (Author+) PHP Code Injection via Theme Export (fixed in 2.10.2; High 7.1)
- [WPSEC-2026-0342](https://wpsec.com/vuln/WPSEC-2026-0342/) 2026-10-02: Academy LMS <= 4.0.1 - Authenticated (Contributor+) Path Traversal to Arbitrary .html File Read via Block Template Slug (fixed in 4.0.2; Medium 4.3)
- [WPSEC-2026-0341](https://wpsec.com/vuln/WPSEC-2026-0341/) 2026-10-02: EventPrime <= 4.3.4.8 - Unauthenticated Information Exposure of Password-Protected Event Content via REST API and Abilities (fixed in 4.3.5.0; Medium 5.3)
- [WPSEC-2026-0340](https://wpsec.com/vuln/WPSEC-2026-0340/) 2026-10-02: EventPrime <= 4.3.4.8 - Missing Authorization to Unauthenticated Booking and User Account Creation via 'eventprime/create-booking' Ability (fixed in 4.3.5.0; Medium 5.3)
- [WPSEC-2026-0339](https://wpsec.com/vuln/WPSEC-2026-0339/) 2026-10-02: EventPrime <= 4.3.4.8 - Unauthenticated reCAPTCHA Bypass via Login and Registration Forms (fixed in 4.3.5.0; Medium 5.3)
- [WPSEC-2026-0338](https://wpsec.com/vuln/WPSEC-2026-0338/) 2026-10-02: Zoom for WordPress <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Webinar and Product Data Exposure via AJAX Actions (fixed in 1.6.0; Medium 4.3)
- [WPSEC-2026-0337](https://wpsec.com/vuln/WPSEC-2026-0337/) 2026-10-02: Zoom for WordPress <= 1.5.4 - Missing Authorization to Unauthenticated Zoom Connection Reset and OAuth Token Overwrite (fixed in 1.6.0; Medium 6.5)
- [WPSEC-2026-0336](https://wpsec.com/vuln/WPSEC-2026-0336/) 2026-10-02: Zoom for WordPress <= 1.5.4 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Log Files (fixed in 1.6.0; Medium 5.3)
- [WPSEC-2026-0335](https://wpsec.com/vuln/WPSEC-2026-0335/) 2026-10-02: Zoom for WordPress <= 1.5.4 - Cross-Site Request Forgery to Zoom OAuth Token Overwrite (fixed in 1.6.0; Medium 4.3)
- [WPSEC-2026-0334](https://wpsec.com/vuln/WPSEC-2026-0334/) 2026-10-02: GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via Rating Item 'title' and 'url' Arguments (fixed in 3.7.2; High 7.2)
- [WPSEC-2026-0333](https://wpsec.com/vuln/WPSEC-2026-0333/) 2026-10-02: Flexy Breadcrumb <= 1.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name (fixed in 1.3.1; Medium 6.4)
- [WPSEC-2026-0332](https://wpsec.com/vuln/WPSEC-2026-0332/) 2026-10-02: Flexy Breadcrumb <= 1.3.0 - Unauthenticated Reflected Cross-Site Scripting via Search Query (fixed in 1.3.1; Medium 6.1)
- [WPSEC-2026-0331](https://wpsec.com/vuln/WPSEC-2026-0331/) 2026-10-02: PowerPress <= 11.17.9 - Unauthenticated Sensitive Information Exposure via Embed and Play in New Window Endpoints (fixed in 11.17.11; Medium 5.3)
- [WPSEC-2026-0330](https://wpsec.com/vuln/WPSEC-2026-0330/) 2026-10-02: PowerPress <= 11.17.9 - Authenticated (Contributor+) Server-Side Request Forgery via Episode Media URL (fixed in 11.17.11; Medium 6.4)
- [WPSEC-2026-0329](https://wpsec.com/vuln/WPSEC-2026-0329/) 2026-10-02: PowerPress <= 11.17.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Player Settings (fixed in 11.17.11; Medium 6.1)
- [WPSEC-2026-0328](https://wpsec.com/vuln/WPSEC-2026-0328/) 2026-10-02: Backuply <= 1.5.8 - Unauthenticated Second-Order SQL Injection via Backup Restoration (fixed in 1.5.9; High 7.5)
- [WPSEC-2026-0327](https://wpsec.com/vuln/WPSEC-2026-0327/) 2026-10-02: Premium Addons for Elementor <= 4.11.109 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Box Widget (fixed in 4.11.110; Medium 6.4)
- [WPSEC-2026-0326](https://wpsec.com/vuln/WPSEC-2026-0326/) 2026-10-02: Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.9 - Stored Cross-Site Scripting via Product Name in Single Product Block and Shortcode (fixed in 7.0.10; Medium 4.4)
- [WPSEC-2026-0325](https://wpsec.com/vuln/WPSEC-2026-0325/) 2026-10-02: The Ultimate Video Player For WordPress – by Presto Player <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (fixed in 4.5.3; Medium 6.4)
- [WPSEC-2026-0324](https://wpsec.com/vuln/WPSEC-2026-0324/) 2026-10-02: Sirv <= 8.2.5 - Authenticated (Contributor+) SQL Injection via 'shortcode_data' Parameter Keys (fixed in 8.2.6; High 8.1)
- [WPSEC-2026-0323](https://wpsec.com/vuln/WPSEC-2026-0323/) 2026-10-02: PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.8.4 - Cross-Site Request Forgery to Sub-Permissions Fix Action (fixed in 4.9.0; Medium 4.3)
- [WPSEC-2026-0322](https://wpsec.com/vuln/WPSEC-2026-0322/) 2026-10-02: PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.8.4 - Missing Authorization to Supplemental Role Removal (fixed in 4.9.0; Low 2.7)
- [WPSEC-2026-0321](https://wpsec.com/vuln/WPSEC-2026-0321/) 2026-10-02: Aurora Heatmap <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting via Report URL (fixed in 1.7.3; Medium 6.1)
- [WPSEC-2026-0320](https://wpsec.com/vuln/WPSEC-2026-0320/) 2026-10-02: Spectra Blocks <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'htmlAttributes' Attribute (fixed in 1.0.9; Medium 6.4)
- [WPSEC-2026-0319](https://wpsec.com/vuln/WPSEC-2026-0319/) 2026-10-02: AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Upload via Email Attachment in POP3 Mailbox Processing (fixed in 11.1.0; High 8.1)
- [WPSEC-2026-0318](https://wpsec.com/vuln/WPSEC-2026-0318/) 2026-10-02: AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion via File Custom Field (fixed in 11.1.0; High 7.4)
- [WPSEC-2026-0317](https://wpsec.com/vuln/WPSEC-2026-0317/) 2026-10-02: User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter (fixed in 4.3.13; Medium 6.4)
- [WPSEC-2026-0316](https://wpsec.com/vuln/WPSEC-2026-0316/) 2026-10-02: RegistrationMagic <= 6.1.0.0 - Unauthenticated Reflected Cross-Site Scripting via 'total_price' and 'description' Parameters (fixed in 6.1.0.1; Medium 6.1)
- [WPSEC-2026-0315](https://wpsec.com/vuln/WPSEC-2026-0315/) 2026-10-02: Logo Slider <= 5.5.5 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Post Order Modification (fixed in 6.0.0; Medium 4.3)
- [WPSEC-2026-0314](https://wpsec.com/vuln/WPSEC-2026-0314/) 2026-10-02: WP Socializer <= 7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Share Icons Shortcode (fixed in 8.0; Medium 6.4)
- [WPSEC-2026-0313](https://wpsec.com/vuln/WPSEC-2026-0313/) 2026-10-02: Filter Everything <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Pro 'Load More' / Infinite Scroll Pagination (fixed in 1.9.7; Medium 6.1)
- [WPSEC-2026-0312](https://wpsec.com/vuln/WPSEC-2026-0312/) 2026-10-02: WP Visitor Statistics (Real Time Traffic) <= 8.5 - Unauthenticated Stored Cross-Site Scripting via 'fullRef' Parameter (fixed in 8.6; High 7.2)
- [WPSEC-2026-0311](https://wpsec.com/vuln/WPSEC-2026-0311/) 2026-10-02: Icegram Engage <= 3.1.43 - Authenticated (Contributor+) PHP Object Injection via 'messages' Custom Field (fixed in 3.1.44; High 7.5)
- [WPSEC-2026-0310](https://wpsec.com/vuln/WPSEC-2026-0310/) 2026-10-02: Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Unauthenticated Unpaid Booking Injection via Additional 'bookings' Entries (fixed in 2.4.11; Medium 5.3)
- [WPSEC-2026-0309](https://wpsec.com/vuln/WPSEC-2026-0309/) 2026-10-02: Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Unauthenticated Payment Bypass via Package Reference (Incomplete Fix for CVE-2026-16582) (fixed in 2.4.11; Medium 5.3)
- [WPSEC-2026-0308](https://wpsec.com/vuln/WPSEC-2026-0308/) 2026-10-02: Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Authenticated (Amelia Employee+) Insecure Direct Object Reference to Arbitrary Booking Status Update (fixed in 2.4.11; Medium 4.3)
- [WPSEC-2026-0307](https://wpsec.com/vuln/WPSEC-2026-0307/) 2026-10-02: GeoDirectory <= 2.8.182 - Authenticated (Subscriber+) Stored Cross-Site Scripting via URL Custom Field Link Label (fixed in 2.8.183; Medium 6.4)
- [WPSEC-2026-0306](https://wpsec.com/vuln/WPSEC-2026-0306/) 2026-10-02: WooCommerce Square <= 5.5.0 - Missing Authorization to Unauthenticated Apple Pay Domain Registration (fixed in 5.5.1; Medium 6.5)
- [WPSEC-2026-0305](https://wpsec.com/vuln/WPSEC-2026-0305/) 2026-10-02: Defender Security <= 6.2.4 - Unauthenticated Firewall Lockout Bypass via 'wpmudev_is_staff' Cookie (fixed in 6.3.0; Low 3.7)
- [WPSEC-2026-0304](https://wpsec.com/vuln/WPSEC-2026-0304/) 2026-10-02: Defender Security <= 6.2.4 - Cross-Site Request Forgery to Two-Factor Authentication Reset (fixed in 6.3.0; Medium 4.3)
- [WPSEC-2026-0303](https://wpsec.com/vuln/WPSEC-2026-0303/) 2026-10-02: Defender Security <= 6.2.4 - Unauthenticated Privilege Escalation via Account Takeover in Masked Login Password Reset (fixed in 6.3.0; High 7.5)
- [WPSEC-2026-0302](https://wpsec.com/vuln/WPSEC-2026-0302/) 2026-10-02: Iptanus File Upload <= 5.1.10 - Unauthenticated SQL Injection via 'uniqueuploadid' Parameter (fixed in 5.2.0; Medium 5.3)
- [WPSEC-2026-0301](https://wpsec.com/vuln/WPSEC-2026-0301/) 2026-10-02: UiCore Elements <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form Widget (fixed in 1.3.18; Medium 6.4)
- [WPSEC-2026-0300](https://wpsec.com/vuln/WPSEC-2026-0300/) 2026-10-02: BetterLinks <= 3.1.3 - Unauthenticated Open Redirect via OAuth Authorization Endpoint (fixed in 3.1.4; Medium 6.1)
- [WPSEC-2026-0299](https://wpsec.com/vuln/WPSEC-2026-0299/) 2026-10-02: BetterLinks <= 3.1.3 - Incorrect Authorization to Click Analytics Deletion (fixed in 3.1.4; Medium 4.3)
- [WPSEC-2026-0298](https://wpsec.com/vuln/WPSEC-2026-0298/) 2026-10-02: wpForo Forum <= 3.1.7 - Unauthenticated SQL Injection via Custom Field Search Values (fixed in 3.2.0; Medium 5.9)
- [WPSEC-2026-0297](https://wpsec.com/vuln/WPSEC-2026-0297/) 2026-10-02: Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.6 - Unauthenticated Stored Cross-Site Scripting via 'qsm_hidden_questions' Parameter (fixed in 11.2.7; Medium 6.1)
- [WPSEC-2026-0296](https://wpsec.com/vuln/WPSEC-2026-0296/) 2026-10-02: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Attachment Replacement (fixed in 4.2.15; Medium 6.4)
- [WPSEC-2026-0295](https://wpsec.com/vuln/WPSEC-2026-0295/) 2026-10-02: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Unauthenticated CSS Injection via Background Lazyload Selectors (fixed in 4.2.15; Medium 5.8)
- [WPSEC-2026-0294](https://wpsec.com/vuln/WPSEC-2026-0294/) 2026-10-02: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Authenticated (Subscriber+) Sensitive Information Exposure via Dashboard Widget (fixed in 4.2.15; Medium 6.5)
- [WPSEC-2026-0293](https://wpsec.com/vuln/WPSEC-2026-0293/) 2026-10-02: Multiline files upload for contact form 7 <= 3.1.0 - Cross-Site Request Forgery to Plugin Deactivation (fixed in 3.1.1; Medium 4.3)
- [WPSEC-2026-0292](https://wpsec.com/vuln/WPSEC-2026-0292/) 2026-10-02: Admin and Site Enhancements (ASE) <= 9.1.2 - Unauthenticated Custom Login URL Disclosure and Login Protection Bypass (fixed in 9.1.3; Medium 5.3)
- [WPSEC-2026-0291](https://wpsec.com/vuln/WPSEC-2026-0291/) 2026-10-02: The Ultimate Video Player For WordPress – by Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via presto-player Tag (fixed in 4.5.2; High 7.2)
- [WPSEC-2026-0290](https://wpsec.com/vuln/WPSEC-2026-0290/) 2026-10-02: If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Condition Type (fixed in 1.10.2; Medium 6.4)
- [WPSEC-2026-0289](https://wpsec.com/vuln/WPSEC-2026-0289/) 2026-10-02: If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.1 - Authenticated (Author+) Stored Cross-Site Scripting via Trigger Version Name (fixed in 1.10.2; Medium 6.4)
- [WPSEC-2026-0288](https://wpsec.com/vuln/WPSEC-2026-0288/) 2026-10-02: User Role Editor <= 4.66.1 - Authenticated (Custom-level+) Privilege Escalation via Add Role/Grant Roles AJAX Actions (fixed in 4.66.2; High 7.2)
- [WPSEC-2026-0287](https://wpsec.com/vuln/WPSEC-2026-0287/) 2026-10-02: Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute (fixed in 2.0.6; Medium 6.4)
- [WPSEC-2026-0286](https://wpsec.com/vuln/WPSEC-2026-0286/) 2026-10-02: LatePoint <= 5.7.2 - Unauthenticated Insecure Direct Object Reference to Payment Bypass and Customer Information Disclosure via 'order_item_id' Parameter (fixed in 5.7.3; Medium 6.5)
- [WPSEC-2026-0285](https://wpsec.com/vuln/WPSEC-2026-0285/) 2026-10-02: LatePoint <= 5.7.2 - Unauthenticated Account Takeover of Subscriber-Level Users via Customer Email to Username Matching (fixed in 5.7.3; Medium 4.8)
- [WPSEC-2026-0284](https://wpsec.com/vuln/WPSEC-2026-0284/) 2026-10-02: LatePoint <= 5.7.2 - Unauthenticated SQL Injection via Booking Parameters (fixed in 5.7.3; High 7.5)
- [WPSEC-2026-0283](https://wpsec.com/vuln/WPSEC-2026-0283/) 2026-10-02: SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Ticket Attachment Disclosure via Attachment ID (fixed in 3.5.4; Medium 5.4)
- [WPSEC-2026-0282](https://wpsec.com/vuln/WPSEC-2026-0282/) 2026-10-02: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.0 - Unauthenticated Missing Authorization to Payment and Subscription Processing via Stripe Return URL (fixed in 3.1.1; Low 3.7)
- [WPSEC-2026-0281](https://wpsec.com/vuln/WPSEC-2026-0281/) 2026-10-02: Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content (fixed in 5.3.6; High 7.2)
- [WPSEC-2026-0280](https://wpsec.com/vuln/WPSEC-2026-0280/) 2026-10-02: Beaver Builder – WordPress Page Builder (Free & Pro) <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via Auto-Suggest Field Values (fixed in 2.11.0.6; Medium 6.5)
- [WPSEC-2026-0279](https://wpsec.com/vuln/WPSEC-2026-0279/) 2026-10-02: Beaver Builder – WordPress Page Builder (Free & Pro) <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module (fixed in 2.11.0.6; Medium 4.8)
- [WPSEC-2026-0278](https://wpsec.com/vuln/WPSEC-2026-0278/) 2026-10-02: Mixed Media Gallery Blocks <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Global Presets (fixed in 3.4.3; Medium 6.4)
- [WPSEC-2026-0277](https://wpsec.com/vuln/WPSEC-2026-0277/) 2026-10-02: Mixed Media Gallery Blocks <= 3.4.2 - Unauthenticated Sensitive Information Exposure via Gallery Block Video API Access Token (fixed in 3.4.3; Medium 5.3)
- [WPSEC-2026-0276](https://wpsec.com/vuln/WPSEC-2026-0276/) 2026-10-02: Speed Optimizer <= 7.8.2 - Unauthenticated Sensitive Information Exposure via Forged Logged-In Cookie in File Cache (fixed in 7.8.3; Medium 5.9)
- [WPSEC-2026-0275](https://wpsec.com/vuln/WPSEC-2026-0275/) 2026-10-02: WPFront Notification Bar <= 3.5.1 - Unauthenticated Reflected Cross-Site Scripting via Request URL in Debug Log Output (fixed in 3.5.2; Medium 4.7)
- [WPSEC-2026-0274](https://wpsec.com/vuln/WPSEC-2026-0274/) 2026-10-02: Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms <= 3.53.0 - Reflected Cross-Site Scripting via Terms Row-Action URLs (fixed in 3.54.0; Medium 6.1)
- [WPSEC-2026-0273](https://wpsec.com/vuln/WPSEC-2026-0273/) 2026-10-02: JetFormBuilder <= 3.6.5.4 - Unauthenticated Arbitrary Attachment Deletion via Media Field (fixed in 3.6.6; Medium 4.8)
- [WPSEC-2026-0272](https://wpsec.com/vuln/WPSEC-2026-0272/) 2026-10-02: Simple Membership <= 4.8.3 - Unauthenticated Email Verification Bypass via Activation Email Resend (fixed in 4.8.4; Medium 5.3)
- [WPSEC-2026-0271](https://wpsec.com/vuln/WPSEC-2026-0271/) 2026-10-02: The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hover Card Widget Script Content (fixed in 6.5.2; Medium 5.4)
- [WPSEC-2026-0270](https://wpsec.com/vuln/WPSEC-2026-0270/) 2026-10-02: The Plus Addons for Elementor <= 6.5.1 - Unauthenticated Information Exposure of Unapproved Comments via Post Comment Widget (fixed in 6.5.2; Medium 5.3)
- [WPSEC-2026-0269](https://wpsec.com/vuln/WPSEC-2026-0269/) 2026-10-02: The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Listing Widget 'All Posts Loaded Text' Setting (fixed in 6.5.2; Medium 5.4)
- [WPSEC-2026-0268](https://wpsec.com/vuln/WPSEC-2026-0268/) 2026-10-02: The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Missing Authorization in MCP Abilities to Sensitive Information Exposure and Template Publishing (fixed in 6.5.2; Medium 5.4)
- [WPSEC-2026-0267](https://wpsec.com/vuln/WPSEC-2026-0267/) 2026-10-02: The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Local File Inclusion via Blog Widget 'post_category_style' Setting (fixed in 6.5.2; High 8.8)
- [WPSEC-2026-0266](https://wpsec.com/vuln/WPSEC-2026-0266/) 2026-10-02: The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box and Flip Box Widget Button Text (fixed in 6.5.2; Medium 6.4)
- [WPSEC-2026-0265](https://wpsec.com/vuln/WPSEC-2026-0265/) 2026-10-02: Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Display Settings (fixed in 3.1.71; Medium 6.4)
- [WPSEC-2026-0264](https://wpsec.com/vuln/WPSEC-2026-0264/) 2026-10-02: Breeze Cache <= 2.5.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Attributes (fixed in 2.5.18; Medium 4.9)
- [WPSEC-2026-0263](https://wpsec.com/vuln/WPSEC-2026-0263/) 2026-10-02: Tutor LMS <= 4.0.9 - Unauthenticated Insecure Direct Object Reference to Quiz Attempt Disclosure via 'attempt_id' Parameter (fixed in 4.1.0; Medium 5.3)
- [WPSEC-2026-0262](https://wpsec.com/vuln/WPSEC-2026-0262/) 2026-10-02: Simple CAPTCHA with Cloudflare Turnstile <= 1.43.2 - Unauthenticated CAPTCHA Bypass via FluentAuth Compatibility 'action' Parameter (fixed in 1.44.0; Low 3.7)
- [WPSEC-2026-0261](https://wpsec.com/vuln/WPSEC-2026-0261/) 2026-10-02: Social Icons Widget & Block <= 4.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure via AI Chat Identity Signature (fixed in 4.7.4; Medium 6.5)
- [WPSEC-2026-0260](https://wpsec.com/vuln/WPSEC-2026-0260/) 2026-10-02: Shortcodes Ultimate <= 7.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_feed Shortcode Error Message (fixed in 7.9.1; Medium 6.4)
- [WPSEC-2026-0259](https://wpsec.com/vuln/WPSEC-2026-0259/) 2026-10-02: Shortcodes Ultimate <= 7.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode 'type' Attribute (fixed in 7.9.1; Medium 5.4)
- [WPSEC-2026-0258](https://wpsec.com/vuln/WPSEC-2026-0258/) 2026-10-02: Shortcodes Ultimate <= 7.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode (fixed in 7.9.1; Medium 6.4)
- [WPSEC-2026-0257](https://wpsec.com/vuln/WPSEC-2026-0257/) 2026-10-02: MailPoet – Newsletters, Email Marketing, and Automation <= 5.39.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title in 'newsletter:post_title' Shortcode (fixed in 5.40.0; Medium 6.4)
- [WPSEC-2026-0256](https://wpsec.com/vuln/WPSEC-2026-0256/) 2026-10-02: MailPoet – Newsletters, Email Marketing, and Automation <= 5.39.0 - Unauthenticated Sensitive Information Exposure of Password-Protected Post Content via Newsletters (fixed in 5.40.0; Low 3.7)
- [WPSEC-2026-0255](https://wpsec.com/vuln/WPSEC-2026-0255/) 2026-10-02: Hostinger Reach <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Subscription Form Widget 'formId' Setting (fixed in 1.8.3; Medium 6.4)
- [WPSEC-2026-0254](https://wpsec.com/vuln/WPSEC-2026-0254/) 2026-10-02: EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Widget 'showTitle' Setting (fixed in 4.6.7; Medium 6.4)
- [WPSEC-2026-0253](https://wpsec.com/vuln/WPSEC-2026-0253/) 2026-10-02: Spectra Legacy – Gutenberg Blocks <= 2.20.3 - Unauthenticated Missing Authorization to Spectra Font Deletion and theme.json Modification (fixed in 2.20.4; Medium 6.5)
- [WPSEC-2026-0252](https://wpsec.com/vuln/WPSEC-2026-0252/) 2026-10-02: Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) <= 3.7.1 - Authenticated (Share-Link Viewer) Insufficient Session Expiration via Viewer Account Profile Update (fixed in 3.7.2; Medium 4.3)
- [WPSEC-2026-0251](https://wpsec.com/vuln/WPSEC-2026-0251/) 2026-10-02: Photo Gallery by 10Web <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection via 'two_page_speed' Post Meta (fixed in 1.8.47; High 7.5)
- [WPSEC-2026-0250](https://wpsec.com/vuln/WPSEC-2026-0250/) 2026-10-02: Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via Image Editor (fixed in 1.8.47; Medium 6.1)
- [WPSEC-2026-0249](https://wpsec.com/vuln/WPSEC-2026-0249/) 2026-10-02: Photo Gallery by 10Web <= 1.8.46 - Cross-Site Request Forgery to Arbitrary File Overwrite via Image Editor (fixed in 1.8.47; High 8.1)
- [WPSEC-2026-0248](https://wpsec.com/vuln/WPSEC-2026-0248/) 2026-10-02: Download Manager <= 3.3.70 - Cross-Site Request Forgery to Privacy Settings Update (fixed in 3.3.71; Medium 4.3)
- [WPSEC-2026-0247](https://wpsec.com/vuln/WPSEC-2026-0247/) 2026-10-02: Download Manager <= 3.3.70 - Unauthenticated Missing Authorization to Protected File Download via CAPTCHA Validation (fixed in 3.3.71; High 7.5)
- [WPSEC-2026-0246](https://wpsec.com/vuln/WPSEC-2026-0246/) 2026-10-02: Download Manager <= 3.3.70 - Authenticated (Author+) Stored Cross-Site Scripting via Package Icon URL (fixed in 3.3.71; Medium 6.4)
- [WPSEC-2026-0245](https://wpsec.com/vuln/WPSEC-2026-0245/) 2026-10-02: Download Manager <= 3.3.70 - Authenticated (Author+) Stored Cross-Site Scripting via Package Title in Download History Filter (fixed in 3.3.71; Medium 5.4)
- [WPSEC-2026-0244](https://wpsec.com/vuln/WPSEC-2026-0244/) 2026-10-02: Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name (fixed in 3.3.71; Medium 5.4)
- [WPSEC-2026-0243](https://wpsec.com/vuln/WPSEC-2026-0243/) 2026-10-02: EWWW Image Optimizer <= 8.7.7 - Authenticated (Contributor+) PHP Object Injection via 'eio_page_settings' Post Meta (fixed in 8.8.0; High 7.5)
- [WPSEC-2026-0242](https://wpsec.com/vuln/WPSEC-2026-0242/) 2026-10-02: EWWW Image Optimizer <= 8.7.7 - Authenticated (Administrator+) Limited File Deletion and Renaming via WebP Migration on Multisite (fixed in 8.8.0; Medium 4.4)
- [WPSEC-2026-0241](https://wpsec.com/vuln/WPSEC-2026-0241/) 2026-10-02: EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via Request URI in Support Debug Information (fixed in 8.8.0; Medium 6.1)
- [WPSEC-2026-0240](https://wpsec.com/vuln/WPSEC-2026-0240/) 2026-10-02: Autoptimize <= 3.1.15.1 - Unauthenticated Open Redirect via 404 Fallback Handler (fixed in 3.1.16; Medium 4.7)
- [WPSEC-2026-0239](https://wpsec.com/vuln/WPSEC-2026-0239/) 2026-10-02: Click to Chat – HoliThemes <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via Greetings Dialog Placeholders (fixed in 4.45; Medium 4.8)
- [WPSEC-2026-0238](https://wpsec.com/vuln/WPSEC-2026-0238/) 2026-10-02: Newsletter <= 9.4.3 - Unauthenticated Open Redirect via 'redirect' Parameter (fixed in 9.4.4; Medium 4.7)
- [WPSEC-2026-0237](https://wpsec.com/vuln/WPSEC-2026-0237/) 2026-10-02: Smush – Lazy Load Images, Optimize & Compress Images <= 4.3.3 - Authenticated (Administrator+) Missing Authorization to Network-Wide Settings Modification on Multisite (fixed in 4.3.4; Low 3.3)
- [WPSEC-2026-0236](https://wpsec.com/vuln/WPSEC-2026-0236/) 2026-10-02: Smush – Lazy Load Images, Optimize & Compress Images <= 4.3.3 - Improper Certificate Validation to WPMU DEV API Key Exposure in Hub Connector (fixed in 4.3.4; Medium 6.5)
- [WPSEC-2026-0235](https://wpsec.com/vuln/WPSEC-2026-0235/) 2026-10-02: The Events Calendar <= 6.17.5 - Authenticated (Contributor+) Missing Authorization to Event, Venue and Organizer Author Assignment via REST API (fixed in 6.17.5.1; Medium 4.3)
- [WPSEC-2026-0234](https://wpsec.com/vuln/WPSEC-2026-0234/) 2026-10-02: The Events Calendar <= 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via Events QR Code Widget (fixed in 6.17.5.1; High 7.3)
- [WPSEC-2026-0233](https://wpsec.com/vuln/WPSEC-2026-0233/) 2026-10-02: ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Builder Control Values (fixed in 4.0.7; Medium 6.4)
- [WPSEC-2026-0232](https://wpsec.com/vuln/WPSEC-2026-0232/) 2026-10-02: ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title in Blog Posts Widget (fixed in 4.0.7; Medium 6.4)
- [WPSEC-2026-0231](https://wpsec.com/vuln/WPSEC-2026-0231/) 2026-10-02: Kadence Blocks <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Link Block 'imageRatio' Attribute (fixed in 3.7.11.1; Medium 6.4)
- [WPSEC-2026-0230](https://wpsec.com/vuln/WPSEC-2026-0230/) 2026-10-02: WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Currency Exchange Rate (fixed in 5.5.8; Medium 4.9)
- [WPSEC-2026-0229](https://wpsec.com/vuln/WPSEC-2026-0229/) 2026-10-02: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via Uploaded Filename (fixed in 4.17.5; Medium 6.1)
- [WPSEC-2026-0228](https://wpsec.com/vuln/WPSEC-2026-0228/) 2026-10-02: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Nickname and Biographical Info Profile Fields (fixed in 4.17.5; Medium 6.3)
- [WPSEC-2026-0227](https://wpsec.com/vuln/WPSEC-2026-0227/) 2026-10-02: Newsletter <= 9.3.9 - Unauthenticated Missing Authorization to Subscriber Data Overwrite via Re-Subscription (fixed in 9.4.0; Medium 5.3)
- [WPSEC-2026-0226](https://wpsec.com/vuln/WPSEC-2026-0226/) 2026-10-02: Newsletter <= 9.3.9 - Cross-Site Request Forgery to Subscriber Profile Update (fixed in 9.4.0; Medium 4.3)
- [WPSEC-2026-0225](https://wpsec.com/vuln/WPSEC-2026-0225/) 2026-10-02: Newsletter <= 9.3.9 - Unauthenticated Authentication Bypass via Predictable Subscriber Token (fixed in 9.4.0; Medium 4.8)
- [WPSEC-2026-0224](https://wpsec.com/vuln/WPSEC-2026-0224/) 2026-10-02: Premium Addons for Elementor <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Box Widget 'preload' Setting (fixed in 4.11.106; Medium 6.4)
- [WPSEC-2026-0223](https://wpsec.com/vuln/WPSEC-2026-0223/) 2026-10-02: Site Kit by Google <= 1.187.0 - Unauthenticated Authentication Bypass via Sign in with Google (fixed in 1.188.0; High 7.5)
- [WPSEC-2026-0222](https://wpsec.com/vuln/WPSEC-2026-0222/) 2026-10-02: Site Kit by Google <= 1.187.0 - Cross-Site Request Forgery via Sign in with Google Callback (fixed in 1.188.0; Medium 4.2)
- [WPSEC-2026-0221](https://wpsec.com/vuln/WPSEC-2026-0221/) 2026-10-02: WooCommerce <= 11.1.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via REST API v1/v2 Product Review Creation (fixed in 11.1.2; Medium 5.5)
- [WPSEC-2026-0220](https://wpsec.com/vuln/WPSEC-2026-0220/) 2026-10-01: Tutor LMS Elementor Addons <= 4.0.1 - Cross-Site Request Forgery to Dependency Plugin Activation (fixed in 4.0.2; Medium 4.3)
- [WPSEC-2026-0219](https://wpsec.com/vuln/WPSEC-2026-0219/) 2026-10-01: s2Member <= 260913 - Authenticated (Subscriber+) Remote Code Execution via Custom Profile Fields in Payment Notification Emails and Tracking Codes (fixed in 260917; High 7.5)
- [WPSEC-2026-0218](https://wpsec.com/vuln/WPSEC-2026-0218/) 2026-10-01: s2Member <= 260913 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute (fixed in 260917; High 7.5)
- [WPSEC-2026-0217](https://wpsec.com/vuln/WPSEC-2026-0217/) 2026-10-01: miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.9.0 - Unauthenticated Authentication Bypass via Social Login Account Linking (fixed in 7.9.1; High 8.1)
- [WPSEC-2026-0216](https://wpsec.com/vuln/WPSEC-2026-0216/) 2026-10-01: PageLayer <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Site Option Update via Global Styles and Homepage Settings (fixed in 2.2.1; Medium 4.3)
- [WPSEC-2026-0215](https://wpsec.com/vuln/WPSEC-2026-0215/) 2026-10-01: PageLayer <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Page/Post Modification and Deletion (fixed in 2.2.1; Medium 6.3)
- [WPSEC-2026-0214](https://wpsec.com/vuln/WPSEC-2026-0214/) 2026-10-01: miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.3.1 - Unauthenticated Registration OTP Verification Bypass via Custom Registration Form (fixed in 6.3.2; Medium 5.3)
- [WPSEC-2026-0213](https://wpsec.com/vuln/WPSEC-2026-0213/) 2026-10-01: miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.3.1 - Authenticated (Subscriber+) Two-Factor Authentication Bypass via Login Method Substitution and Grace-Period Skip (fixed in 6.3.2; High 8.1)
- [WPSEC-2026-0212](https://wpsec.com/vuln/WPSEC-2026-0212/) 2026-10-01: miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.3.1 - Authenticated (Administrator+) Missing Authorization to Network-Wide 2FA Settings Modification on Multisite (fixed in 6.3.2; Low 3.3)
- [WPSEC-2026-0211](https://wpsec.com/vuln/WPSEC-2026-0211/) 2026-10-01: Social Share Icons & Social Share Buttons <= 3.7.4 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via WeChat Share Icon (fixed in 3.7.5; Medium 6.1)
- [WPSEC-2026-0210](https://wpsec.com/vuln/WPSEC-2026-0210/) 2026-10-01: Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.9.5 - Authenticated (Subscriber+) Missing Authorization to Review Moderation (fixed in 8.9.6; Medium 5.4)
- [WPSEC-2026-0209](https://wpsec.com/vuln/WPSEC-2026-0209/) 2026-10-01: Redirection <= 5.10.0 - Unauthenticated Open Redirect via Regex Redirect Targets (fixed in 5.10.1; Medium 4.7)
- [WPSEC-2026-0208](https://wpsec.com/vuln/WPSEC-2026-0208/) 2026-10-01: Redirection <= 5.10.0 - Unauthenticated CSV Injection via 404 and Redirect Log Exports (fixed in 5.10.1; Medium 4.7)
- [WPSEC-2026-0207](https://wpsec.com/vuln/WPSEC-2026-0207/) 2026-10-01: Top 10 <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Popular Posts Block thumb_size Attribute (fixed in 4.5.1; Medium 6.4)
- [WPSEC-2026-0206](https://wpsec.com/vuln/WPSEC-2026-0206/) 2026-10-01: WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.83 - Authenticated (Contributor+) Missing Authorization to Database Table Access via wpdadiehard Shortcode (fixed in 5.5.84; Medium 5.4)
- [WPSEC-2026-0205](https://wpsec.com/vuln/WPSEC-2026-0205/) 2026-10-01: Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Counter Block Separator and Decimal Settings (fixed in 3.0.2; Medium 6.4)
- [WPSEC-2026-0204](https://wpsec.com/vuln/WPSEC-2026-0204/) 2026-10-01: Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Hotspot Block (fixed in 3.0.2; Medium 6.4)
- [WPSEC-2026-0203](https://wpsec.com/vuln/WPSEC-2026-0203/) 2026-10-01: Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Block Marker Description (fixed in 3.0.2; Medium 6.4)
- [WPSEC-2026-0202](https://wpsec.com/vuln/WPSEC-2026-0202/) 2026-10-01: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter (fixed in 3.6.2; Medium 6.1)
- [WPSEC-2026-0201](https://wpsec.com/vuln/WPSEC-2026-0201/) 2026-10-01: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Unauthenticated Sensitive Information Exposure via Smart Tags in Submitted Form Field Values (fixed in 3.6.2; Low 3.7)
- [WPSEC-2026-0200](https://wpsec.com/vuln/WPSEC-2026-0200/) 2026-10-01: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Authenticated (Delegated+) Insecure Direct Object Reference via MCP Form and Entry Abilities (fixed in 3.6.2; Medium 6.3)
- [WPSEC-2026-0199](https://wpsec.com/vuln/WPSEC-2026-0199/) 2026-10-01: LearnPress <= 4.4.7 - Reflected Cross-Site Scripting via 'orderby' Parameter (fixed in 4.4.8; Medium 6.1)
- [WPSEC-2026-0198](https://wpsec.com/vuln/WPSEC-2026-0198/) 2026-10-01: All-In-One Security (AIOS) – Security and Firewall <= 5.4.9 - Unauthenticated Login Lockout Bypass via Unlock Request (fixed in 5.4.10; Low 3.7)
- [WPSEC-2026-0197](https://wpsec.com/vuln/WPSEC-2026-0197/) 2026-10-01: Events Manager <= 7.4.3 - Unauthenticated User Interface Misrepresentation via 'client_name' Parameter on OAuth Consent Screen (fixed in 7.4.4; Medium 4.3)
- [WPSEC-2026-0196](https://wpsec.com/vuln/WPSEC-2026-0196/) 2026-10-01: Events Manager <= 7.4.3 - Unauthenticated Insecure Direct Object Reference to Booking Timeslot Capacity Bypass (fixed in 7.4.4; Medium 5.3)
- [WPSEC-2026-0195](https://wpsec.com/vuln/WPSEC-2026-0195/) 2026-10-01: Events Manager <= 7.4.3 - Unauthenticated Sensitive Information Exposure via Password-Protected Events in REST API and iCal Feed (fixed in 7.4.4; Medium 5.3)
- [WPSEC-2026-0194](https://wpsec.com/vuln/WPSEC-2026-0194/) 2026-10-01: Events Manager <= 7.4.3 - Authenticated (Author+) Insecure Direct Object Reference via REST API Media Endpoint (fixed in 7.4.4; Medium 4.3)
- [WPSEC-2026-0193](https://wpsec.com/vuln/WPSEC-2026-0193/) 2026-10-01: Kadence Blocks <= 3.7.10 - Unauthenticated HTML Injection in Form Notification Emails via Uploaded File Name (fixed in 3.7.11; Medium 4.3)
- [WPSEC-2026-0192](https://wpsec.com/vuln/WPSEC-2026-0192/) 2026-10-01: Plugin for Google Reviews <= 7.1 - Unauthenticated Sensitive Information Exposure via Business Photo URL (fixed in 7.1.1; Low 3.7)
- [WPSEC-2026-0191](https://wpsec.com/vuln/WPSEC-2026-0191/) 2026-10-01: Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) <= 3.7.0 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via AJAX REST Fallback (fixed in 3.7.1; Medium 4.3)
- [WPSEC-2026-0190](https://wpsec.com/vuln/WPSEC-2026-0190/) 2026-10-01: Essential Blocks <= 6.4.3 - Unauthenticated Denial of Service via Post Grid Pagination (fixed in 6.4.4; Medium 5.3)
- [WPSEC-2026-0189](https://wpsec.com/vuln/WPSEC-2026-0189/) 2026-10-01: Essential Blocks <= 6.4.3 - Authenticated (Contributor+) Sensitive Information Exposure via Post Grid Block 'featuredPostId' Attribute (fixed in 6.4.4; Medium 4.3)
- [WPSEC-2026-0188](https://wpsec.com/vuln/WPSEC-2026-0188/) 2026-10-01: Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.87 - Unauthenticated Stored Cross-Site Scripting via Contact Encoder Shortcode Placeholders (fixed in 6.88; Medium 5.4)
- [WPSEC-2026-0187](https://wpsec.com/vuln/WPSEC-2026-0187/) 2026-10-01: Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Global Settings Endpoint (fixed in 6.2.14; Medium 4.9)
- [WPSEC-2026-0186](https://wpsec.com/vuln/WPSEC-2026-0186/) 2026-10-01: Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Stored Cross-Site Scripting via Form Field Attributes and Payment Option Labels (fixed in 6.2.14; Medium 6.4)
- [WPSEC-2026-0185](https://wpsec.com/vuln/WPSEC-2026-0185/) 2026-10-01: Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Cross-Form Entry Modification, Deletion and Disclosure via 'entry_id' Parameter (fixed in 6.2.14; Medium 4.7)
- [WPSEC-2026-0184](https://wpsec.com/vuln/WPSEC-2026-0184/) 2026-10-01: Fluent Forms <= 6.2.13 - Unauthenticated Payment Amount Manipulation via Omitted Payment Inputs and Negative Custom Subscription Amounts (fixed in 6.2.14; Medium 5.3)
- [WPSEC-2026-0183](https://wpsec.com/vuln/WPSEC-2026-0183/) 2026-10-01: Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Embedded Post Author Smartcodes (fixed in 6.2.14; Medium 4.9)
- [WPSEC-2026-0182](https://wpsec.com/vuln/WPSEC-2026-0182/) 2026-10-01: Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.6 - Authenticated (Author+) Limited Server-Side Request Forgery via Image Sideload Endpoints (fixed in 4.7.7; Low 3.5)
- [WPSEC-2026-0181](https://wpsec.com/vuln/WPSEC-2026-0181/) 2026-10-01: Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.6 - Authenticated (Contributor+) Missing Authorization to Template Data Request and CartFlows, Cart Abandonment Recovery and LatePoint Data Import (fixed in 4.7.7; Medium 5.4)
- [WPSEC-2026-0180](https://wpsec.com/vuln/WPSEC-2026-0180/) 2026-10-01: Cookie Notice & Compliance for GDPR / CCPA <= 3.1.9 - Authenticated (Administrator+) Missing Authorization to Network-Wide Settings Modification (fixed in 3.1.10; Medium 5.8)
- [WPSEC-2026-0179](https://wpsec.com/vuln/WPSEC-2026-0179/) 2026-10-01: Cookie Notice & Compliance for GDPR / CCPA <= 3.1.9 - Authenticated (Administrator+) Privilege Escalation via 'cn_network' Parameter (fixed in 3.1.10; Medium 6.8)
- [WPSEC-2026-0178](https://wpsec.com/vuln/WPSEC-2026-0178/) 2026-10-01: WooCommerce <= 11.1.0 - Authenticated (Shop Manager+) Privilege Escalation via Mobile App QR Login Token Generation (fixed in 11.1.1; Low 3.8)
- [WPSEC-2026-0177](https://wpsec.com/vuln/WPSEC-2026-0177/) 2026-10-01: WooCommerce <= 11.1.0 - REST API Key Scope Bypass via Non-REST Requests (fixed in 11.1.1; Medium 4.2)
- [WPSEC-2026-0176](https://wpsec.com/vuln/WPSEC-2026-0176/) 2026-10-01: GPTranslate <= 2.34.11 - Unauthenticated Stored Cross-Site Scripting via Translated Image, Iframe and Video Attributes (fixed in 2.34.12; Medium 5.4)
- [WPSEC-2026-0175](https://wpsec.com/vuln/WPSEC-2026-0175/) 2026-10-01: PPWP – Password Protect Pages <= 1.9.25 - Unauthenticated Sensitive Information Exposure via Predictable Auto-Generated Page Password (fixed in 1.9.26; Low 3.7)
- [WPSEC-2026-0174](https://wpsec.com/vuln/WPSEC-2026-0174/) 2026-10-01: WPFunnels <= 3.13.1 - Reflected Cross-Site Scripting via 'per_page' Parameter (fixed in 3.13.2; Medium 6.1)
- [WPSEC-2026-0173](https://wpsec.com/vuln/WPSEC-2026-0173/) 2026-10-01: WPFunnels <= 3.13.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Bump Settings (fixed in 3.13.2; Medium 6.4)
- [WPSEC-2026-0172](https://wpsec.com/vuln/WPSEC-2026-0172/) 2026-10-01: Charitable <= 1.8.12.3 - Unauthenticated Reflected Cross-Site Scripting via Donate Button Shortcode (fixed in 1.8.13; Medium 6.1)
- [WPSEC-2026-0171](https://wpsec.com/vuln/WPSEC-2026-0171/) 2026-10-01: Charitable <= 1.8.12.3 - Authenticated (Subscriber+) Limited File Upload via 'charitable_plupload_image_upload' AJAX Action (fixed in 1.8.13; Medium 4.3)
- [WPSEC-2026-0170](https://wpsec.com/vuln/WPSEC-2026-0170/) 2026-10-01: Charitable <= 1.8.12.3 - Authenticated (Contributor+) Sensitive Information Exposure via 'charitable_campaign_preview' Parameter (fixed in 1.8.13; Medium 4.3)
- [WPSEC-2026-0169](https://wpsec.com/vuln/WPSEC-2026-0169/) 2026-10-01: WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated Second-Order SQL Injection via fullRef Parameter (fixed in 8.7.1; Medium 6.5)
- [WPSEC-2026-0168](https://wpsec.com/vuln/WPSEC-2026-0168/) 2026-10-01: Visitor Traffic Real Time Statistics < 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' and Forwarded-IP HTTP Headers (fixed in 8.16; High 7.2)
- [WPSEC-2026-0167](https://wpsec.com/vuln/WPSEC-2026-0167/) 2026-10-01: Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Configuration 'script' Field (fixed in 3.6.14; Medium 6.4)
- [WPSEC-2026-0166](https://wpsec.com/vuln/WPSEC-2026-0166/) 2026-10-01: Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Insecure Direct Object Reference to Gallery, Image and Post Meta Modification (fixed in 3.6.14; Medium 4.3)
- [WPSEC-2026-0165](https://wpsec.com/vuln/WPSEC-2026-0165/) 2026-10-01: Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (fixed in 3.6.14; Medium 6.4)
- [WPSEC-2026-0164](https://wpsec.com/vuln/WPSEC-2026-0164/) 2026-10-01: Jeg Kit for Elementor <= 3.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-item-indicator' Attribute (fixed in 3.2.20; Medium 6.4)
- [WPSEC-2026-0163](https://wpsec.com/vuln/WPSEC-2026-0163/) 2026-10-01: Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comments (fixed in 3.2.20; High 7.2)
- [WPSEC-2026-0162](https://wpsec.com/vuln/WPSEC-2026-0162/) 2026-10-01: Salon booking system <= 10.31.6 - Authenticated (Salon Staff+) Stored Cross-Site Scripting via Customer Notes (fixed in 10.31.7; Medium 5.5)
- [WPSEC-2026-0161](https://wpsec.com/vuln/WPSEC-2026-0161/) 2026-10-01: Ecomail <= 2.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Email Newsletter Subscription Changes via 'ecmid' Parameter (fixed in 2.5.0; Medium 4.3)
- [WPSEC-2026-0160](https://wpsec.com/vuln/WPSEC-2026-0160/) 2026-10-01: Ecomail <= 2.4.3 - Cross-Site Request Forgery to Bulk Data Synchronization and List Refresh (fixed in 2.5.0; Medium 4.3)
- [WPSEC-2026-0159](https://wpsec.com/vuln/WPSEC-2026-0159/) 2026-10-01: Ecomail <= 2.4.3 - Authenticated (Contributor+) Missing Authorization to Bulk Data Synchronization and List Refresh (fixed in 2.5.0; Medium 4.3)
- [WPSEC-2026-0158](https://wpsec.com/vuln/WPSEC-2026-0158/) 2026-10-01: Ecomail <= 2.4.3 - Unauthenticated Missing Authorization to Arbitrary Cart Tracking Events via 'email' Parameter (fixed in 2.5.0; Medium 5.3)
- [WPSEC-2026-0157](https://wpsec.com/vuln/WPSEC-2026-0157/) 2026-10-01: Ecomail <= 2.4.3 - Missing Authorization to Subscription Status Modification via Webhook REST Endpoint (fixed in 2.5.0; Medium 6.5)
- [WPSEC-2026-0156](https://wpsec.com/vuln/WPSEC-2026-0156/) 2026-10-01: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (fixed in 4.2.16; Medium 6.4)
- [WPSEC-2026-0155](https://wpsec.com/vuln/WPSEC-2026-0155/) 2026-10-01: Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Missing Authorization to Zoom Host and Meeting Disclosure via Block Editor AJAX Actions (fixed in 4.6.11; Medium 4.3)
- [WPSEC-2026-0154](https://wpsec.com/vuln/WPSEC-2026-0154/) 2026-10-01: Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Missing Authorization to Sensitive Information Exposure via 'get_assign_host_id' AJAX Action (fixed in 4.6.11; Medium 4.3)
- [WPSEC-2026-0153](https://wpsec.com/vuln/WPSEC-2026-0153/) 2026-10-01: Web-Art Login Shield with reCAPTCHA <= 1.2.2 - Unauthenticated reCAPTCHA and Login Protect Bypass via 'action' Parameter (fixed in 1.2.3; Medium 5.3)
- [WPSEC-2026-0152](https://wpsec.com/vuln/WPSEC-2026-0152/) 2026-10-01: Web-Art Login Shield with reCAPTCHA <= 1.2.2 - Unauthenticated Login Protect Bypass via Race Condition (fixed in 1.2.3; Low 3.7)
- [WPSEC-2026-0151](https://wpsec.com/vuln/WPSEC-2026-0151/) 2026-10-01: Frontend File Manager & Sharing – User Private Files <= 2.1.9 - Unauthenticated Sensitive Information Exposure via Attachment Pages (fixed in 2.2.0; Medium 5.3)
- [WPSEC-2026-0150](https://wpsec.com/vuln/WPSEC-2026-0150/) 2026-10-01: Frontend File Manager & Sharing – User Private Files <= 2.1.9 - Unauthenticated Sensitive Information Exposure via Direct Access to Private Files (fixed in 2.2.0; Medium 5.9)
- [WPSEC-2026-0149](https://wpsec.com/vuln/WPSEC-2026-0149/) 2026-10-01: Document Engine <= 1.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via PDF Viewer Block (fixed in 2.0.0; Medium 4.3)
- [WPSEC-2026-0148](https://wpsec.com/vuln/WPSEC-2026-0148/) 2026-10-01: Document Engine <= 1.3 - Authenticated (Author+) Server-Side Request Forgery via Post to PDF Images (fixed in 2.0.0; Medium 5.0)
- [WPSEC-2026-0147](https://wpsec.com/vuln/WPSEC-2026-0147/) 2026-10-01: Document Engine <= 1.3 - Unauthenticated Sensitive Information Exposure via Post to PDF Export (fixed in 2.0.0; Medium 5.3)
- [WPSEC-2026-0146](https://wpsec.com/vuln/WPSEC-2026-0146/) 2026-10-01: CoCart – Headless REST API for WooCommerce <= 4.9.6 - Cross-Site Request Forgery via REST API Nonce Verification Bypass (fixed in 4.9.7; High 8.8)
- [WPSEC-2026-0145](https://wpsec.com/vuln/WPSEC-2026-0145/) 2026-10-01: EazyDocs <= 2.14.0 - Login Cross-Site Request Forgery via Google Login Callback (fixed in 2.14.1; Medium 4.3)
- [WPSEC-2026-0144](https://wpsec.com/vuln/WPSEC-2026-0144/) 2026-10-01: EazyDocs <= 2.14.0 - Unauthenticated Authentication Bypass via Google Login (fixed in 2.14.1; High 8.1)
- [WPSEC-2026-0143](https://wpsec.com/vuln/WPSEC-2026-0143/) 2026-10-01: EazyDocs <= 2.14.0 - Missing Authorization to Unauthenticated Analytics Table Schema Update (fixed in 2.14.1; Medium 5.3)
- [WPSEC-2026-0142](https://wpsec.com/vuln/WPSEC-2026-0142/) 2026-10-01: Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.9.6 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via Listing Renewal (fixed in 8.10; Low 3.1)
- [WPSEC-2026-0141](https://wpsec.com/vuln/WPSEC-2026-0141/) 2026-10-01: Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG and XML File Uploads (fixed in 4.7.8; Medium 6.4)
- [WPSEC-2026-0140](https://wpsec.com/vuln/WPSEC-2026-0140/) 2026-10-01: Coming Soon & Maintenance Mode by Colorlib <= 1.4.0 - Unauthenticated Sensitive Information Exposure via Comment Form Redirect (fixed in 1.4.1; Medium 5.3)
- [WPSEC-2026-0139](https://wpsec.com/vuln/WPSEC-2026-0139/) 2026-10-01: GPTranslate <= 2.34.10 - Unauthenticated Stored Cross-Site Scripting via Translation Values (fixed in 2.34.11; High 7.2)
- [WPSEC-2026-0138](https://wpsec.com/vuln/WPSEC-2026-0138/) 2026-10-01: Bus Ticket Booking with Seat Reservation < 5.9.5 - Missing Authorization to Booking Billing Details Modification via wbtm_standalone_checkout_pay AJAX Action (fixed in 5.9.5; Medium 6.5)
- [WPSEC-2026-0137](https://wpsec.com/vuln/WPSEC-2026-0137/) 2026-10-01: Bus Ticket Booking with Seat Reservation < 5.9.5 - Unauthenticated Insecure Direct Object Reference to Booking Cancellation and Status Manipulation via Payment Return Handler (fixed in 5.9.5; Medium 6.5)
- [WPSEC-2026-0136](https://wpsec.com/vuln/WPSEC-2026-0136/) 2026-10-01: Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Authenticated (Subscriber+) Missing Authorization to Account Connection and Plugin Settings Modification (fixed in 3.5.18; Medium 5.4)
- [WPSEC-2026-0135](https://wpsec.com/vuln/WPSEC-2026-0135/) 2026-10-01: Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Missing Authorization to Account Disconnection (fixed in 3.5.18; Medium 6.5)
- [WPSEC-2026-0134](https://wpsec.com/vuln/WPSEC-2026-0134/) 2026-10-01: Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (fixed in 3.5.18; Medium 6.4)
- [WPSEC-2026-0133](https://wpsec.com/vuln/WPSEC-2026-0133/) 2026-10-01: Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Unauthenticated Authorization Bypass to Admin-Scoped REST API Proxy (fixed in 3.5.18; High 8.2)
- [WPSEC-2026-0132](https://wpsec.com/vuln/WPSEC-2026-0132/) 2026-10-01: Simple Gallery with Filter < 2.4.1 - Cross-Site Request Forgery to Image Caption Modification (fixed in 2.4.1; Medium 4.3)
- [WPSEC-2026-0131](https://wpsec.com/vuln/WPSEC-2026-0131/) 2026-10-01: Video Conferencing with BigBlueButton (BBB) <= 3.2.0 - Unauthenticated Open Redirect via 'current_page' Parameter (fixed in 3.2.15; Medium 6.1)
- [WPSEC-2026-0130](https://wpsec.com/vuln/WPSEC-2026-0130/) 2026-10-01: HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Missing Authorization to Unauthenticated Secret Key Update and Cache Deletion (fixed in 1.9.5; Medium 6.5)
- [WPSEC-2026-0129](https://wpsec.com/vuln/WPSEC-2026-0129/) 2026-10-01: HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Cross-Site Request Forgery to Google Account Connection and Logout (fixed in 1.9.5; Medium 5.4)
- [WPSEC-2026-0128](https://wpsec.com/vuln/WPSEC-2026-0128/) 2026-10-01: HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Unauthenticated Insecure Direct Object Reference to Order Data Exposure via 'order' Parameter (fixed in 1.9.5; Medium 5.3)
- [WPSEC-2026-0127](https://wpsec.com/vuln/WPSEC-2026-0127/) 2026-10-01: UiChemy <= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Import (fixed in 5.2.3; Medium 6.4)
- [WPSEC-2026-0126](https://wpsec.com/vuln/WPSEC-2026-0126/) 2026-10-01: UiChemy <= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Composer Section Code (fixed in 5.2.3; Medium 6.4)
- [WPSEC-2026-0125](https://wpsec.com/vuln/WPSEC-2026-0125/) 2026-10-01: Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.6 - Unauthenticated reCAPTCHA Bypass via Inline Payment Forms (fixed in 8.5.7; Medium 5.3)
- [WPSEC-2026-0124](https://wpsec.com/vuln/WPSEC-2026-0124/) 2026-10-01: Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure of Hidden Chat Room Participants via 'getChatRooms' REST Endpoint (fixed in 3.0.12; Medium 4.3)
- [WPSEC-2026-0123](https://wpsec.com/vuln/WPSEC-2026-0123/) 2026-10-01: Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure via Favorites Page (fixed in 3.0.12; Medium 4.3)
- [WPSEC-2026-0122](https://wpsec.com/vuln/WPSEC-2026-0122/) 2026-10-01: Better Messages <= 3.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting via End-to-End Encrypted Messages (fixed in 3.0.12; Medium 6.4)
- [WPSEC-2026-0121](https://wpsec.com/vuln/WPSEC-2026-0121/) 2026-10-01: Five Star Restaurant Reservations <= 2.7.24 - Unauthenticated Sensitive Information Exposure via View Bookings Form (fixed in 2.8.0; Medium 5.3)
- [WPSEC-2026-0120](https://wpsec.com/vuln/WPSEC-2026-0120/) 2026-10-01: WP User Avatars <= 1.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Assignment via assign_wp_user_avatars_media AJAX Action (fixed in 2.0.0; Medium 4.3)
- [WPSEC-2026-0119](https://wpsec.com/vuln/WPSEC-2026-0119/) 2026-10-01: Advanced Shipment Tracking for WooCommerce <= 4.0.3 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure via ast_email_preview AJAX Action (fixed in 4.0.4; Medium 4.3)
- [WPSEC-2026-0118](https://wpsec.com/vuln/WPSEC-2026-0118/) 2026-10-01: WP Ghost (Hide My WP Ghost) <= 7.0.11 - Unauthenticated Login CAPTCHA Bypass via 'woocommerce-login-nonce' Parameter (fixed in 7.0.12; Medium 5.3)
- [WPSEC-2026-0117](https://wpsec.com/vuln/WPSEC-2026-0117/) 2026-10-01: CMB2 <= 2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Field Display Values (fixed in 2.13.2; Medium 6.4)
- [WPSEC-2026-0116](https://wpsec.com/vuln/WPSEC-2026-0116/) 2026-10-01: DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Link Attributes (fixed in 3.6.1; High 7.2)
- [WPSEC-2026-0115](https://wpsec.com/vuln/WPSEC-2026-0115/) 2026-10-01: MultiVendorX <= 5.0.18 - Authenticated (Subscriber+) Missing Authorization to Marketplace-Wide WooCommerce REST API Access (fixed in 5.0.19; High 8.8)
- [WPSEC-2026-0114](https://wpsec.com/vuln/WPSEC-2026-0114/) 2026-10-01: MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Missing Authorization to Withdrawal Approval and Balance Bypass (fixed in 5.0.19; Medium 6.5)
- [WPSEC-2026-0113](https://wpsec.com/vuln/WPSEC-2026-0113/) 2026-10-01: MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Missing Authorization to Marketplace Module Activation and Deactivation (fixed in 5.0.19; Medium 5.4)
- [WPSEC-2026-0112](https://wpsec.com/vuln/WPSEC-2026-0112/) 2026-10-01: MultiVendorX <= 5.0.18 - Authenticated (Customer+) Insecure Direct Object Reference to Refund Request on Arbitrary Orders (fixed in 5.0.19; Medium 4.3)
- [WPSEC-2026-0111](https://wpsec.com/vuln/WPSEC-2026-0111/) 2026-10-01: MultiVendorX <= 5.0.18 - Authenticated (Subscriber+) Privilege Escalation via Store REST Endpoint Admin-Only Fields (fixed in 5.0.19; Medium 6.5)
- [WPSEC-2026-0110](https://wpsec.com/vuln/WPSEC-2026-0110/) 2026-10-01: MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Cross-Store Follower Information Disclosure via FollowStore REST Endpoint (fixed in 5.0.19; Medium 4.3)
- [WPSEC-2026-0109](https://wpsec.com/vuln/WPSEC-2026-0109/) 2026-10-01: Mihdan: No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Redirect Logs (fixed in 5.3.0; Medium 5.4)
- [WPSEC-2026-0108](https://wpsec.com/vuln/WPSEC-2026-0108/) 2026-10-01: WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.20 - Unauthenticated Sensitive Information Exposure via Product REST API Endpoints (fixed in 3.0.21; Medium 5.3)
- [WPSEC-2026-0107](https://wpsec.com/vuln/WPSEC-2026-0107/) 2026-10-01: Export All Posts, Products, Orders, Refunds & Users <= 3.0 - Unauthenticated Sensitive Information Exposure via Debug Log File (fixed in 3.1; Medium 5.3)
- [WPSEC-2026-0106](https://wpsec.com/vuln/WPSEC-2026-0106/) 2026-10-01: WP Ultimate CSV Importer <= 9.1 - Unauthenticated Sensitive Information Exposure via Import Files and Logs (fixed in 9.2; Low 3.7)
- [WPSEC-2026-0105](https://wpsec.com/vuln/WPSEC-2026-0105/) 2026-10-01: WP Ultimate CSV Importer <= 9.1 - Unauthenticated Sensitive Information Exposure via Single Post CSV Export (fixed in 9.2; Medium 5.3)
- [WPSEC-2026-0104](https://wpsec.com/vuln/WPSEC-2026-0104/) 2026-10-01: FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Contact Field Smartcodes in Fluent Forms (fixed in 3.2.5; Medium 5.4)
- [WPSEC-2026-0103](https://wpsec.com/vuln/WPSEC-2026-0103/) 2026-10-01: FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.0 - Authenticated (Custom Contact-Read Access) Sensitive Information Exposure via Contact Email History (fixed in 3.2.5; Medium 4.3)
- [WPSEC-2026-0102](https://wpsec.com/vuln/WPSEC-2026-0102/) 2026-10-01: Forms <= 3.0.1 - Reflected Cross-Site Scripting via Form Field Parameters (fixed in 3.0.2; Medium 6.1)
- [WPSEC-2026-0101](https://wpsec.com/vuln/WPSEC-2026-0101/) 2026-10-01: Forms <= 3.0.1 - Authenticated (Contributor+) Missing Authorization to Forms and Submissions Access (fixed in 3.0.2; Medium 5.4)
- [WPSEC-2026-0100](https://wpsec.com/vuln/WPSEC-2026-0100/) 2026-10-01: Forms <= 3.0.1 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values (fixed in 3.0.2; High 7.2)
- [WPSEC-2026-0099](https://wpsec.com/vuln/WPSEC-2026-0099/) 2026-10-01: Forms <= 3.0.1 - Unauthenticated Information Exposure of Submitter IP Addresses via REST API (fixed in 3.0.2; Medium 5.3)
- [WPSEC-2026-0098](https://wpsec.com/vuln/WPSEC-2026-0098/) 2026-10-01: SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Name Fields (fixed in 1.12.1; Medium 6.4)
- [WPSEC-2026-0097](https://wpsec.com/vuln/WPSEC-2026-0097/) 2026-10-01: Five Star Restaurant Menu <= 2.5.4 - Unauthenticated Price Manipulation via Cart Item Data (fixed in 2.6.0; Medium 5.3)
- [WPSEC-2026-0096](https://wpsec.com/vuln/WPSEC-2026-0096/) 2026-10-01: Five Star Restaurant Menu <= 2.5.4 - Unauthenticated Payment Bypass via Order Submission and Payment Handlers (fixed in 2.6.0; Medium 5.3)
- [WPSEC-2026-0095](https://wpsec.com/vuln/WPSEC-2026-0095/) 2026-10-01: Five Star Restaurant Menu <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_prostyle' Shortcode Attribute (fixed in 2.6.0; Medium 6.4)
- [WPSEC-2026-0094](https://wpsec.com/vuln/WPSEC-2026-0094/) 2026-10-01: Five Star Restaurant Menu <= 2.5.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Overwrite via Menu Item Import (fixed in 2.6.0; Medium 5.4)
- [WPSEC-2026-0093](https://wpsec.com/vuln/WPSEC-2026-0093/) 2026-10-01: Product Feed PRO for WooCommerce <= 13.5.7 - Missing Authorization to Authenticated (Subscriber+) Shipping Zone Disclosure (fixed in 13.5.8; Medium 4.3)
- [WPSEC-2026-0092](https://wpsec.com/vuln/WPSEC-2026-0092/) 2026-10-01: Product Feed PRO for WooCommerce <= 13.5.7 - Authenticated (Shop Manager+) PHP Object Injection via Product Attribute Meta (fixed in 13.5.8; High 7.2)
- [WPSEC-2026-0091](https://wpsec.com/vuln/WPSEC-2026-0091/) 2026-10-01: Captivate Sync <= 3.3.2 - Authenticated (Editor+) SQL Injection via Episode Duplication (fixed in 3.3.3; Medium 4.9)
- [WPSEC-2026-0090](https://wpsec.com/vuln/WPSEC-2026-0090/) 2026-10-01: Five Star Business Profile and Schema <= 2.3.21 - Authenticated (Author+) Sensitive Information Exposure via Schema Rule Field Defaults (fixed in 2.4.0; Medium 6.5)
- [WPSEC-2026-0089](https://wpsec.com/vuln/WPSEC-2026-0089/) 2026-10-01: Pie Register <= 3.8.4.13 - Missing Authorization to Unauthenticated User Email Disclosure via 'invitaion_code' Parameter (fixed in 3.8.4.14; Medium 5.3)
- [WPSEC-2026-0088](https://wpsec.com/vuln/WPSEC-2026-0088/) 2026-10-01: BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via Service Quantity (fixed in 1.8.29; High 7.2)
- [WPSEC-2026-0087](https://wpsec.com/vuln/WPSEC-2026-0087/) 2026-10-01: LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Subscriber+) Missing Authorization to Screenshot Creation and Deletion (fixed in 1.6.3; Medium 4.3)
- [WPSEC-2026-0086](https://wpsec.com/vuln/WPSEC-2026-0086/) 2026-10-01: Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Authenticated (Author+) Insecure Direct Object Reference to Arbitrary Attachment File Rename (fixed in 3.2.2; Medium 4.3)
- [WPSEC-2026-0085](https://wpsec.com/vuln/WPSEC-2026-0085/) 2026-10-01: Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Missing Authorization to Authenticated (Contributor+) Folder Assignment Modification of Arbitrary Posts (fixed in 3.2.2; Medium 4.3)
- [WPSEC-2026-0084](https://wpsec.com/vuln/WPSEC-2026-0084/) 2026-10-01: Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Authenticated (Author+) Arbitrary File Upload via Media Replace (fixed in 3.2.2; High 8.8)
- [WPSEC-2026-0083](https://wpsec.com/vuln/WPSEC-2026-0083/) 2026-10-01: WP Document Revisions <= 5.4.5 - Authenticated (Contributor+) Sensitive Information Exposure via Document List Shortcode, Blocks and get_documents() (fixed in 5.4.6; Medium 4.3)
- [WPSEC-2026-0082](https://wpsec.com/vuln/WPSEC-2026-0082/) 2026-10-01: WP Document Revisions <= 5.4.5 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Attachment Rename and Deletion via Validate Structure Fix Endpoint (fixed in 5.4.6; Medium 5.4)
- [WPSEC-2026-0081](https://wpsec.com/vuln/WPSEC-2026-0081/) 2026-10-01: WP Document Revisions <= 5.4.5 - Authenticated (Contributor+) Missing Authorization to Revision History Disclosure via document_revisions Shortcode and Block (fixed in 5.4.6; Medium 4.3)
- [WPSEC-2026-0080](https://wpsec.com/vuln/WPSEC-2026-0080/) 2026-10-01: WP Document Revisions <= 5.4.5 - Unauthenticated Missing Authorization via Case-Altered Document REST Routes (fixed in 5.4.6; Low 3.7)
- [WPSEC-2026-0079](https://wpsec.com/vuln/WPSEC-2026-0079/) 2026-10-01: WP Document Revisions <= 5.4.5 - Authenticated (Subscriber+) Missing Authorization to Password-Protected Document and Revision Access via AI Summary and Diff REST Endpoints (fixed in 5.4.6; Medium 4.3)
- [WPSEC-2026-0078](https://wpsec.com/vuln/WPSEC-2026-0078/) 2026-10-01: WP Document Revisions <= 5.5.0 - Authenticated (Contributor+) Missing Authorization to Revision History Disclosure via document_revisions Shortcode and Block (fixed in 5.5.1; Medium 4.3)
- [WPSEC-2026-0077](https://wpsec.com/vuln/WPSEC-2026-0077/) 2026-10-01: WP Document Revisions <= 5.5.0 - Unauthenticated Authorization Bypass via REST Route Case Manipulation (fixed in 5.5.1; Low 3.7)
- [WPSEC-2026-0076](https://wpsec.com/vuln/WPSEC-2026-0076/) 2026-10-01: WP Document Revisions <= 5.5.0 - Authenticated (Subscriber+) Missing Authorization to Restricted Revision Content via AI Summary and Diff REST Endpoints (fixed in 5.5.1; Medium 4.3)
- [WPSEC-2026-0075](https://wpsec.com/vuln/WPSEC-2026-0075/) 2026-10-01: WP Document Revisions <= 5.5.0 - Authenticated (Contributor+) Sensitive Information Exposure via Document List Shortcode, Blocks and get_documents() (fixed in 5.5.1; Medium 4.3)
- [WPSEC-2026-0074](https://wpsec.com/vuln/WPSEC-2026-0074/) 2026-10-01: WP Document Revisions <= 5.5.0 - Authenticated (Contributor+) Insecure Direct Object Reference to Media File Rename and Deletion via Validate Structure Endpoint (fixed in 5.5.1; Medium 5.4)
- [WPSEC-2026-0073](https://wpsec.com/vuln/WPSEC-2026-0073/) 2026-10-01: WP Document Revisions <= 5.6.0 - Authenticated (Contributor+) Insecure Direct Object Reference to Media File Rename and Deletion via Validate Structure Endpoint (fixed in 5.6.1; Medium 5.4)
- [WPSEC-2026-0072](https://wpsec.com/vuln/WPSEC-2026-0072/) 2026-10-01: WP Document Revisions <= 5.6.0 - Authenticated (Subscriber+) Missing Authorization to Restricted Revision Content via AI Summary and Diff REST Endpoints (fixed in 5.6.1; Medium 4.3)
- [WPSEC-2026-0071](https://wpsec.com/vuln/WPSEC-2026-0071/) 2026-10-01: WP Document Revisions <= 5.6.0 - Unauthenticated Authorization Bypass via REST Route Case Manipulation (fixed in 5.6.1; Low 3.7)
- [WPSEC-2026-0070](https://wpsec.com/vuln/WPSEC-2026-0070/) 2026-10-01: WP Document Revisions <= 5.6.0 - Authenticated (Contributor+) Missing Authorization to Revision History Disclosure via document_revisions Shortcode and Block (fixed in 5.6.1; Medium 4.3)
- [WPSEC-2026-0069](https://wpsec.com/vuln/WPSEC-2026-0069/) 2026-10-01: WP Document Revisions <= 5.6.0 - Authenticated (Contributor+) Sensitive Information Exposure via Document List Shortcode, Blocks and get_documents() (fixed in 5.6.1; Medium 4.3)
- [WPSEC-2026-0068](https://wpsec.com/vuln/WPSEC-2026-0068/) 2026-10-01: WP Document Revisions <= 5.6.1 - Authenticated (Author+) Sensitive Information Exposure via Media Library (fixed in 5.7.0; Medium 5.3)
- [WPSEC-2026-0067](https://wpsec.com/vuln/WPSEC-2026-0067/) 2026-10-01: Sensei LMS <= 4.26.3 - Authenticated (Subscriber+) Missing Authorization to Lesson Completion (fixed in 4.26.4; Medium 4.3)
- [WPSEC-2026-0066](https://wpsec.com/vuln/WPSEC-2026-0066/) 2026-10-01: Sensei LMS <= 4.26.3 - Unauthenticated Sensitive Information Exposure via Private Messages (fixed in 4.26.4; Medium 5.3)
- [WPSEC-2026-0065](https://wpsec.com/vuln/WPSEC-2026-0065/) 2026-10-01: Sensei LMS <= 4.26.3 - Unauthenticated Sensitive Information Exposure via Quiz Answer File Uploads (fixed in 4.26.4; Medium 5.3)
- [WPSEC-2026-0064](https://wpsec.com/vuln/WPSEC-2026-0064/) 2026-10-01: Sensei LMS <= 4.26.3 - Authenticated (Teacher+) Missing Authorization to Lesson and Module Course Reassignment (fixed in 4.26.4; Medium 4.3)
- [WPSEC-2026-0063](https://wpsec.com/vuln/WPSEC-2026-0063/) 2026-10-01: Sensei LMS <= 4.26.3 - Authenticated (Teacher+) Insecure Direct Object Reference to Arbitrary Post Overwrite via quiz_id (fixed in 4.26.4; Medium 5.3)
- [WPSEC-2026-0062](https://wpsec.com/vuln/WPSEC-2026-0062/) 2026-10-01: Sensei LMS <= 4.26.3 - Unauthenticated Sensitive Information Exposure via Restricted Lesson Content (fixed in 4.26.4; Medium 5.3)
- [WPSEC-2026-0061](https://wpsec.com/vuln/WPSEC-2026-0061/) 2026-10-01: My Agile Privacy® <= 3.3.7 - Missing Authorization to Unauthenticated Policy Metadata Modification (fixed in 3.4.0; Low 3.7)
- [WPSEC-2026-0060](https://wpsec.com/vuln/WPSEC-2026-0060/) 2026-10-01: ProfileGrid <= 6.0.0.2 - Authenticated (Subscriber+) SQL Injection via Group IDs (fixed in 6.0.0.3; Medium 4.3)
- [WPSEC-2026-0059](https://wpsec.com/vuln/WPSEC-2026-0059/) 2026-10-01: ProfileGrid <= 6.0.0.2 - Cross-Site Request Forgery to Group Joining (fixed in 6.0.0.3; Medium 4.3)
- [WPSEC-2026-0058](https://wpsec.com/vuln/WPSEC-2026-0058/) 2026-10-01: ProfileGrid <= 6.0.0.2 - Authenticated (Subscriber+) Missing Authorization to Forced Friendship via Friend Request Acceptance (fixed in 6.0.0.3; Medium 5.4)
- [WPSEC-2026-0057](https://wpsec.com/vuln/WPSEC-2026-0057/) 2026-10-01: ProfileGrid <= 6.0.0.2 - Cross-Site Request Forgery to Account Takeover via Profile Edit Form (fixed in 6.0.0.3; High 8.8)
- [WPSEC-2026-0056](https://wpsec.com/vuln/WPSEC-2026-0056/) 2026-10-01: ProfileGrid <= 6.0.0.2 - Unauthenticated Sensitive Information Exposure via Blog Post Listing AJAX Actions (fixed in 6.0.0.3; Medium 5.3)
- [WPSEC-2026-0055](https://wpsec.com/vuln/WPSEC-2026-0055/) 2026-10-01: WP User Manager – User Profile Builder & Membership <= 2.9.20 - Unauthenticated Stripe Payment Bypass to Paid Role Capabilities and Role-Restricted Content (fixed in 2.9.21; Medium 4.8)
- [WPSEC-2026-0054](https://wpsec.com/vuln/WPSEC-2026-0054/) 2026-10-01: PPOM for WooCommerce <= 34.0.9 - Unauthenticated Price Manipulation via 'ppom_option_price' Parameter (fixed in 34.0.10; Medium 5.3)
- [WPSEC-2026-0053](https://wpsec.com/vuln/WPSEC-2026-0053/) 2026-10-01: Kubio AI Page Builder <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Item Link (fixed in 2.9.3; Medium 6.4)
- [WPSEC-2026-0052](https://wpsec.com/vuln/WPSEC-2026-0052/) 2026-10-01: Kubio AI Page Builder <= 2.9.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content (fixed in 2.9.3; Medium 6.1)
- [WPSEC-2026-0051](https://wpsec.com/vuln/WPSEC-2026-0051/) 2026-10-01: Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager <= 0.0.11 - Unauthenticated Sensitive Information Exposure via Banner Settings (fixed in 0.0.12; Medium 5.3)
- [WPSEC-2026-0050](https://wpsec.com/vuln/WPSEC-2026-0050/) 2026-10-01: Awesome Support <= 6.4.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via wpas_mark_reply_read AJAX Action (fixed in 6.4.1; Medium 5.4)
- [WPSEC-2026-0049](https://wpsec.com/vuln/WPSEC-2026-0049/) 2026-10-01: UsersWP <= 1.2.74 - Unauthenticated Email Verification Bypass via Login (fixed in 1.2.75; Medium 5.3)
- [WPSEC-2026-0048](https://wpsec.com/vuln/WPSEC-2026-0048/) 2026-10-01: UsersWP <= 1.2.75 - Authenticated (Subscriber+) Limited File Deletion via Avatar/Banner Image Crop (fixed in 1.2.76; Medium 5.4)
- [WPSEC-2026-0047](https://wpsec.com/vuln/WPSEC-2026-0047/) 2026-10-01: WP Ultimate Review <= 2.4.3 - Unauthenticated Denial of Service via Review Rating (fixed in 2.4.4; Medium 5.3)
- [WPSEC-2026-0046](https://wpsec.com/vuln/WPSEC-2026-0046/) 2026-10-01: WP Ultimate Review <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Review Criteria Ratings (fixed in 2.4.4; Medium 6.4)
- [WPSEC-2026-0045](https://wpsec.com/vuln/WPSEC-2026-0045/) 2026-10-01: WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via Review Submission (fixed in 2.4.4; High 7.3)
- [WPSEC-2026-0044](https://wpsec.com/vuln/WPSEC-2026-0044/) 2026-10-01: Loco Translate <= 2.8.8 - Authenticated (Translator+) Stored Cross-Site Scripting via Project File Prefix (fixed in 2.8.9; Medium 5.5)
- [WPSEC-2026-0043](https://wpsec.com/vuln/WPSEC-2026-0043/) 2026-10-01: Loco Translate <= 2.8.8 - Authenticated (Translator+) Path Traversal to Limited File Read via Download Endpoint (fixed in 2.8.9; Medium 4.9)
- [WPSEC-2026-0042](https://wpsec.com/vuln/WPSEC-2026-0042/) 2026-10-01: Loco Translate <= 2.8.8 - Authenticated (Translator+) Arbitrary File and Directory Deletion via Backup Revision Delete (fixed in 2.8.9; Medium 6.5)
- [WPSEC-2026-0041](https://wpsec.com/vuln/WPSEC-2026-0041/) 2026-10-01: Team – Team Members Showcase Plugin <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tlpteam' Shortcode (fixed in 6.0.3; Medium 6.4)
- [WPSEC-2026-0040](https://wpsec.com/vuln/WPSEC-2026-0040/) 2026-10-01: OMGF <= 6.3.11 - Authenticated (Contributor+) Path Traversal via Font Family Name (fixed in 6.3.12; Low 3.1)
- [WPSEC-2026-0039](https://wpsec.com/vuln/WPSEC-2026-0039/) 2026-10-01: OMGF <= 6.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Font Download Error Notices (fixed in 6.3.12; Medium 4.4)
- [WPSEC-2026-0038](https://wpsec.com/vuln/WPSEC-2026-0038/) 2026-10-01: OMGF <= 6.3.11 - Authenticated (Contributor+) Server-Side Request Forgery via Font Stylesheet Link Processing (fixed in 6.3.12; Medium 4.9)
- [WPSEC-2026-0037](https://wpsec.com/vuln/WPSEC-2026-0037/) 2026-10-01: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.1.3 - Authenticated (Vendor+) Insecure Direct Object Reference to Commission Rate Disclosure via Commission Calculator REST Endpoint (fixed in 5.2.0; Medium 4.3)
- [WPSEC-2026-0036](https://wpsec.com/vuln/WPSEC-2026-0036/) 2026-10-01: Wp Social <= 3.2.1 - Cross-Site Request Forgery to Social Login Provider Settings Update (fixed in 3.2.2; Medium 4.3)
- [WPSEC-2026-0035](https://wpsec.com/vuln/WPSEC-2026-0035/) 2026-10-01: Wp Social <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute (fixed in 3.2.2; Medium 6.4)
- [WPSEC-2026-0034](https://wpsec.com/vuln/WPSEC-2026-0034/) 2026-10-01: Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Table Cell Content and Custom CSS (fixed in 1.15.3; Medium 4.4)
- [WPSEC-2026-0033](https://wpsec.com/vuln/WPSEC-2026-0033/) 2026-10-01: Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Missing Authorization to Form Submission Email Disclosure via Dashboard Widget (fixed in 3.2.7; Medium 4.3)
- [WPSEC-2026-0032](https://wpsec.com/vuln/WPSEC-2026-0032/) 2026-10-01: Prime Slider – Addons For Elementor <= 4.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Query Control Dynamic Select Search (fixed in 4.6.2; Medium 4.3)
- [WPSEC-2026-0031](https://wpsec.com/vuln/WPSEC-2026-0031/) 2026-10-01: Prime Slider – Addons For Elementor <= 4.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Blog Widget Zinest Skin Featured Posts (fixed in 4.6.2; Medium 4.3)
- [WPSEC-2026-0030](https://wpsec.com/vuln/WPSEC-2026-0030/) 2026-10-01: Unlimited Elements For Elementor < 2.0.21 - Unauthenticated SQL Injection via AJAX Search 'ucs' Parameter (fixed in 2.0.21; Medium 5.9)
- [WPSEC-2026-0029](https://wpsec.com/vuln/WPSEC-2026-0029/) 2026-10-01: Unlimited Elements For Elementor < 2.0.21 - Authenticated (Contributor+) Information Exposure via Elementor Template and Layout Rendering (fixed in 2.0.21; Medium 4.3)
- [WPSEC-2026-0028](https://wpsec.com/vuln/WPSEC-2026-0028/) 2026-10-01: Unlimited Elements For Elementor < 2.0.21 - Authenticated (Contributor+) SQL Injection via Terms 'Direct Children of Selected Terms' Setting (fixed in 2.0.21; Medium 6.5)
- [WPSEC-2026-0027](https://wpsec.com/vuln/WPSEC-2026-0027/) 2026-10-01: Event Tickets and Registration <= 5.29.5.1 - Unauthenticated Business Logic Error to Seat Overbooking via Duplicate Reservation IDs (fixed in 5.29.5.2; Medium 5.3)
- [WPSEC-2026-0026](https://wpsec.com/vuln/WPSEC-2026-0026/) 2026-10-01: Event Tickets and Registration <= 5.29.5.2 - Authenticated (Contributor+) Missing Authorization to Ticket Creation and Modification via REST API (fixed in 5.30.0; Medium 4.3)
- [WPSEC-2026-0025](https://wpsec.com/vuln/WPSEC-2026-0025/) 2026-10-01: bbPress <= 2.6.18 - Unauthenticated Sensitive Information Exposure via oEmbed Endpoint and Canonical Redirect (fixed in 2.6.19; Medium 5.3)
- [WPSEC-2026-0024](https://wpsec.com/vuln/WPSEC-2026-0024/) 2026-10-01: bbPress <= 2.6.18 - Authenticated (Contributor+) Sensitive Information Exposure via Single Topic and Single Reply Shortcodes (fixed in 2.6.19; Medium 4.3)
- [WPSEC-2026-0023](https://wpsec.com/vuln/WPSEC-2026-0023/) 2026-10-01: bbPress <= 2.6.18 - Unauthenticated Sensitive Information Exposure via Password-Protected Forum and Topic Bypass (fixed in 2.6.19; Medium 5.3)
- [WPSEC-2026-0022](https://wpsec.com/vuln/WPSEC-2026-0022/) 2026-10-01: hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via Passster REST Unlock Endpoint (fixed in 5.4.0; Low 3.7)
- [WPSEC-2026-0021](https://wpsec.com/vuln/WPSEC-2026-0021/) 2026-10-01: hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via Expired or Evicted Auto-Verification Registration (fixed in 5.4.0; Low 3.7)
- [WPSEC-2026-0020](https://wpsec.com/vuln/WPSEC-2026-0020/) 2026-10-01: hCaptcha for WP <= 5.3.0 - Unauthenticated Denial of Service via Unbounded Failed Login Data (fixed in 5.4.0; Medium 5.3)
- [WPSEC-2026-0019](https://wpsec.com/vuln/WPSEC-2026-0019/) 2026-10-01: hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via LearnPress Checkout Account Creation (fixed in 5.4.0; Low 3.7)
- [WPSEC-2026-0018](https://wpsec.com/vuln/WPSEC-2026-0018/) 2026-10-01: WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting via Report Filter Dropdown URLs (fixed in 14.16.15; Medium 6.1)
- [WPSEC-2026-0017](https://wpsec.com/vuln/WPSEC-2026-0017/) 2026-10-01: Kadence Blocks <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload in Advanced Form (fixed in 3.7.12; Medium 6.1)
- [WPSEC-2026-0016](https://wpsec.com/vuln/WPSEC-2026-0016/) 2026-10-01: MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated reCAPTCHA v3 Bypass (fixed in 4.3.1; Medium 5.3)
- [WPSEC-2026-0015](https://wpsec.com/vuln/WPSEC-2026-0015/) 2026-10-01: MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated Sensitive Information Exposure via REST API (fixed in 4.3.1; Medium 5.3)
- [WPSEC-2026-0014](https://wpsec.com/vuln/WPSEC-2026-0014/) 2026-10-01: MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated HTML Injection via Form Submission Notification Emails (fixed in 4.3.1; Medium 5.3)
- [WPSEC-2026-0013](https://wpsec.com/vuln/WPSEC-2026-0013/) 2026-10-01: MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Settings (fixed in 4.3.1; Medium 6.4)
- [WPSEC-2026-0012](https://wpsec.com/vuln/WPSEC-2026-0012/) 2026-10-01: MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Information Exposure via 'metform' Shortcode (fixed in 4.3.1; Medium 4.3)
- [WPSEC-2026-0011](https://wpsec.com/vuln/WPSEC-2026-0011/) 2026-10-01: Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Post Content in Feed Builder Preview (fixed in 4.14.0; High 7.2)
- [WPSEC-2026-0010](https://wpsec.com/vuln/WPSEC-2026-0010/) 2026-10-01: Ultimate Member <= 2.13.1 - Unauthenticated Sensitive Information Exposure via Private Profile Fields (fixed in 2.14.0; Medium 5.3)
- [WPSEC-2026-0009](https://wpsec.com/vuln/WPSEC-2026-0009/) 2026-10-01: Ultimate Member <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover (fixed in 2.14.0; High 7.5)
- [WPSEC-2026-0008](https://wpsec.com/vuln/WPSEC-2026-0008/) 2026-10-01: Ultimate Member <= 2.13.1 - Authenticated (Administrator+) SQL Injection via Directory Search-Field Identifiers (fixed in 2.14.0; Medium 4.9)
- [WPSEC-2026-0007](https://wpsec.com/vuln/WPSEC-2026-0007/) 2026-10-01: Fluent Forms <= 6.2.14 - Unauthenticated Payment Bypass via Zero or Invalid Payment Values (fixed in 6.2.15; Medium 5.3)
- [WPSEC-2026-0006](https://wpsec.com/vuln/WPSEC-2026-0006/) 2026-10-01: Fluent Forms <= 6.2.14 - Unauthenticated Reflected Cross-Site Scripting via 'get' Smartcode (fixed in 6.2.15; Medium 6.1)
- [WPSEC-2026-0005](https://wpsec.com/vuln/WPSEC-2026-0005/) 2026-10-01: Fluent Forms <= 6.2.14 - Authenticated (Fluent Forms Manager+) Stored Cross-Site Scripting via Payment Item 'price_label' and Payment Summary 'cart_empty_text' Settings (fixed in 6.2.15; Medium 4.8)
- [WPSEC-2026-0004](https://wpsec.com/vuln/WPSEC-2026-0004/) 2026-10-01: Fluent Forms <= 6.2.14 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via User Search (fixed in 6.2.15; Low 2.7)
- [WPSEC-2026-0003](https://wpsec.com/vuln/WPSEC-2026-0003/) 2026-10-01: TranslatePress <= 3.3.6 - Unauthenticated Stored Cross-Site Scripting via trp-gettext Markers in URL Attributes (fixed in 3.3.7; High 7.2)
- [WPSEC-2026-0002](https://wpsec.com/vuln/WPSEC-2026-0002/) 2026-10-01: Wordfence Security – Firewall & Malware Scan <= 9.0.1 - Unauthenticated Author Information Disclosure via REST API Username Enumeration Protection Bypass (fixed in 9.0.2; Medium 5.3)
- [WPSEC-2026-0001](https://wpsec.com/vuln/WPSEC-2026-0001/) 2026-10-01: Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Woo Product Grid Pagination (fixed in 6.8.5; Medium 6.4)