| 2026-10-07 |
WPSEC-2026-0582 |
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms | Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Unauthenticated Missing Authorization to Image Upload via upload_image_from_url AJAX Action |
Medium 5.3 |
2.10.1 |
| 2026-10-07 |
WPSEC-2026-0581 |
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms | Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Unauthenticated Missing Authorization to Limited Attachment Deletion |
Medium 5.3 |
2.10.1 |
| 2026-10-07 |
WPSEC-2026-0580 |
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms | Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Reflected Cross-Site Scripting via 'error_msg_*' Parameters |
Medium 6.1 |
2.10.1 |
| 2026-10-07 |
WPSEC-2026-0579 |
Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms | Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Unauthenticated Information Exposure via Failed Form Submissions |
Low 3.7 |
2.10.1 |
| 2026-10-07 |
WPSEC-2026-0578 |
CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce | CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce <= 6.1.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Status Modification via 'orderId' Parameter |
Medium 5.3 |
6.1.6 |
| 2026-10-07 |
WPSEC-2026-0577 |
HollerBox — Fast & Effective Popups & Lead-Generation | HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.13 - Unauthenticated Insecure Direct Object Reference to Arbitrary Post Unpublishing via Popup REST Endpoints |
Medium 6.5 |
2.3.15 |
| 2026-10-07 |
WPSEC-2026-0576 |
OnPay.io for WooCommerce | OnPay.io for WooCommerce <= 1.0.53 - Cross-Site Request Forgery via OAuth Callback |
Medium 5.3 |
1.0.54 |
| 2026-10-07 |
WPSEC-2026-0575 |
Booking Package | Booking Package <= 1.7.29 - Unauthenticated Sensitive Information Exposure via 'public' Parameter |
High 7.5 |
1.7.30 |
| 2026-10-07 |
WPSEC-2026-0574 |
Booking Package | Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute |
Medium 6.4 |
1.7.30 |
| 2026-10-07 |
WPSEC-2026-0573 |
Parse.ly | Parse.ly <= 3.24.1 - Unauthenticated Sensitive Information Exposure of API Secret via Recommended Widget |
Medium 5.3 |
3.24.2 |
| 2026-10-07 |
WPSEC-2026-0572 |
Parse.ly | Parse.ly <= 3.24.1 - Authenticated (Author+) Sensitive Information Exposure of Private and Draft Posts via REST API |
Medium 4.3 |
3.24.2 |
| 2026-10-07 |
WPSEC-2026-0571 |
Parse.ly | Parse.ly <= 3.24.1 - Server-Side Request Forgery via Remote Request Host Allowlist Bypass |
Medium 5.4 |
3.24.2 |
| 2026-10-07 |
WPSEC-2026-0570 |
Wallet System for WooCommerce | Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Wallet Withdrawal Requests |
Medium 4.3 |
2.8.0 |
| 2026-10-07 |
WPSEC-2026-0569 |
Wallet System for WooCommerce | Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Wallet Balance Transfer |
Medium 6.5 |
2.8.0 |
| 2026-10-07 |
WPSEC-2026-0568 |
Wallet System for WooCommerce | Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Missing Authorization to Sensitive Information Exposure via Wallet Transaction Export |
Medium 4.3 |
2.8.0 |
| 2026-10-07 |
WPSEC-2026-0567 |
Wallet System for WooCommerce | Wallet System for WooCommerce <= 2.7.10 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Transaction CSV Export File |
Low 3.7 |
2.8.0 |
| 2026-10-07 |
WPSEC-2026-0566 |
Wallet System for WooCommerce | Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Wallet Balance Manipulation via Negative Transfer Amount |
Medium 6.5 |
2.8.0 |
| 2026-10-07 |
WPSEC-2026-0565 |
QA Assistants – Driven by data | QA Assistants – Driven by data <= 5.3.0.0 - Unauthenticated Path Traversal to Limited File Overwrite via 'readers_name' and 'raw_name' Parameters |
Critical 9.1 |
5.3.0.1 |
| 2026-10-07 |
WPSEC-2026-0564 |
QA Assistants – Driven by data | QA Assistants – Driven by data <= 5.3.0.0 - Authenticated (Subscriber+) Missing Authorization to Visitor Analytics Exposure and Heatmap/Replay Generation via Multiple AJAX Actions |
Medium 5.4 |
5.3.0.1 |
| 2026-10-07 |
WPSEC-2026-0563 |
Order Tracking | Order Tracking <= 3.5.4 - Unauthenticated Email Verification Bypass for Records Without an Email Address |
Low 3.7 |
3.6.0 |
| 2026-10-07 |
WPSEC-2026-0562 |
Order Tracking | Order Tracking <= 3.5.4 - Unauthenticated Payment Bypass via PayPal IPN |
Medium 5.3 |
3.6.0 |
| 2026-10-07 |
WPSEC-2026-0561 |
Order Tracking | Order Tracking <= 3.5.4 - Cross-Site Request Forgery to Order Bulk Actions |
Medium 5.4 |
3.6.0 |
| 2026-10-07 |
WPSEC-2026-0560 |
Order Tracking | Order Tracking <= 3.5.4 - Unauthenticated Email Verification Bypass to Order Customer Note Update |
Low 3.7 |
3.6.0 |
| 2026-10-07 |
WPSEC-2026-0559 |
Order Tracking | Order Tracking <= 3.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Order Viewing and Modification |
Medium 5.4 |
3.6.0 |
| 2026-10-07 |
WPSEC-2026-0558 |
Order Tracking | Order Tracking <= 3.5.4 - Unauthenticated Sensitive Information Exposure via Front-End Order Download |
Medium 5.9 |
3.6.0 |
| 2026-10-07 |
WPSEC-2026-0557 |
Asaas Gateway for WooCommerce | Asaas Gateway for WooCommerce <= 2.7.7 - Improper Webhook Authentication to Unauthenticated Order Status Manipulation |
Medium 5.9 |
2.7.8 |
| 2026-10-07 |
WPSEC-2026-0556 |
Login Lockdown & Protection | Login Lockdown & Protection <= 2.17 - Unauthenticated Brute Force Protection Bypass via Email Address Login |
Medium 5.3 |
2.18 |
| 2026-10-07 |
WPSEC-2026-0555 |
GutenKit | GutenKit <= 2.5.2 - Authenticated (Author+) Server-Side Request Forgery via Media Upload From URL Route |
Medium 5.0 |
2.5.3 |
| 2026-10-07 |
WPSEC-2026-0554 |
Forms | Forms <= 3.0.2 - Authenticated (Subscriber+) Missing Authorization to Form and Submission Data Exposure |
Medium 4.3 |
3.0.3 |
| 2026-10-07 |
WPSEC-2026-0553 |
Pinpoint Booking System | Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Price Manipulation via Reservation Price Parameters |
Medium 5.3 |
2.9.9.7.2 |
| 2026-10-07 |
WPSEC-2026-0552 |
CMB2 | CMB2 <= 2.13.2 - Authenticated (Editor+) Limited Options Update via REST API 'object_type' and 'object_id' Parameters |
Medium 5.0 |
2.13.3 |
| 2026-10-07 |
WPSEC-2026-0551 |
WP Ghost (Hide My WP Ghost) | WP Ghost (Hide My WP Ghost) <= 7.0.12 - Insufficient Session Expiration in Temporary Logins on PHP 8 |
Medium 4.8 |
7.0.13 |
| 2026-10-07 |
WPSEC-2026-0550 |
WP Ghost (Hide My WP Ghost) | WP Ghost (Hide My WP Ghost) <= 7.0.12 - Unauthenticated Firewall and Brute Force Protection Bypass via Forged Login Cookie |
Medium 5.3 |
7.0.13 |
| 2026-10-07 |
WPSEC-2026-0549 |
Retainful | Retainful <= 1.0.10 - Unauthenticated Missing Authorization to Connection Settings Update and Sensitive Information Exposure |
Medium 6.5 |
1.0.11 |
| 2026-10-07 |
WPSEC-2026-0548 |
Retainful | Retainful <= 1.0.10 - Authenticated (Subscriber+) Missing Authorization to Webhook Registration and Coupon Creation via REST API |
High 7.1 |
1.0.11 |
| 2026-10-07 |
WPSEC-2026-0547 |
WebinarPress | WebinarPress <= 1.33.30 - Unauthenticated Reflected Cross-Site Scripting via 'content' Parameter |
Medium 6.1 |
1.33.31 |
| 2026-10-07 |
WPSEC-2026-0546 |
WebinarPress | WebinarPress <= 1.33.30 - Unauthenticated Missing Authorization to Multiple AJAX Actions |
Medium 6.5 |
1.33.31 |
| 2026-10-07 |
WPSEC-2026-0545 |
WebinarPress | WebinarPress <= 1.33.30 - Authenticated (Subscriber+) Missing Authorization to Multiple Administrative Actions |
Medium 5.4 |
1.33.31 |
| 2026-10-07 |
WPSEC-2026-0544 |
Bookly | Bookly <= 28.4 - Unauthenticated Sensitive Information Exposure via Booking Form Info Text |
Low 3.7 |
28.5 |
| 2026-10-07 |
WPSEC-2026-0543 |
Bookly | Bookly <= 28.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Staff Profile Update |
Medium 5.4 |
28.5 |
| 2026-10-07 |
WPSEC-2026-0542 |
WP Map Block | WP Map Block <= 3.0.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Map Modification, Publication and Deletion |
Medium 5.4 |
3.1.0 |
| 2026-10-07 |
WPSEC-2026-0541 |
Rank Math SEO | Rank Math SEO <= 1.0.279 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug |
Medium 4.9 |
1.0.280 |
| 2026-10-07 |
WPSEC-2026-0540 |
Rank Math SEO | Rank Math SEO <= 1.0.279 - Missing Authorization to Unauthenticated SEO Analyzer Results Deletion |
Medium 5.3 |
1.0.280 |
| 2026-10-07 |
WPSEC-2026-0539 |
LazyLoad Plugin | LazyLoad Plugin <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via YouTube Video Title |
Medium 4.9 |
2.4.1 |
| 2026-10-07 |
WPSEC-2026-0538 |
Advanced Classifieds & Directory Pro | Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Contact Fields |
Medium 4.9 |
3.5.0 |
| 2026-10-07 |
WPSEC-2026-0537 |
WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds | WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds <= 4.4.8 - Unauthenticated Insecure Direct Object Reference to Listing Modification and Deletion via 'listing_id' Parameter |
High 7.3 |
4.4.9 |
| 2026-10-07 |
WPSEC-2026-0536 |
Responsive Blocks | Responsive Blocks <= 2.2.9 - Authenticated (Contributor+) Missing Authorization to Media Library Image Upload via Template Import REST Endpoint |
Medium 4.3 |
2.3.0 |
| 2026-10-07 |
WPSEC-2026-0535 |
Team Manager | Team Manager <= 2.6.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via dwl_create_team Shortcode |
Medium 4.3 |
2.6.8 |
| 2026-10-07 |
WPSEC-2026-0534 |
Team Manager | Team Manager <= 2.6.7 - Unauthenticated Sensitive Information Exposure via Password-Protected Team Members |
Medium 5.3 |
2.6.8 |
| 2026-10-07 |
WPSEC-2026-0533 |
affiliate-toolkit | affiliate-toolkit <= 3.9.0 - Authenticated (Contributor+) Remote Code Execution via Template Reference |
High 8.8 |
3.9.1 |
| 2026-10-07 |
WPSEC-2026-0532 |
rtMedia for WordPress, BuddyPress and bbPress | rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Authenticated (Subscriber+) Limited File Read and Deletion via 'files' Parameter |
High 7.6 |
4.7.14 |
| 2026-10-07 |
WPSEC-2026-0531 |
rtMedia for WordPress, BuddyPress and bbPress | rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Authenticated (Subscriber+) Missing Authorization to Media Attribute and Post Modification via Media Edit |
Medium 6.5 |
4.7.14 |
| 2026-10-07 |
WPSEC-2026-0530 |
WP 2FA – Two-factor authentication for WordPress | WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Cross-Site Request Forgery via REST API Nonce Check Bypass |
High 8.8 |
4.2.0 |
| 2026-10-07 |
WPSEC-2026-0529 |
WP 2FA – Two-factor authentication for WordPress | WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Unauthenticated Two-Factor Authentication Bypass via Flywheel Direct Login Handling |
High 8.1 |
4.2.0 |
| 2026-10-07 |
WPSEC-2026-0528 |
WP 2FA – Two-factor authentication for WordPress | WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Unauthenticated Two-Factor Authentication Downgrade via 'provider' Parameter |
High 7.4 |
4.2.0 |
| 2026-10-07 |
WPSEC-2026-0527 |
WP 2FA – Two-factor authentication for WordPress | WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Unauthenticated Two-Factor Authentication Bypass via Brute Force |
High 7.4 |
4.2.0 |
| 2026-10-07 |
WPSEC-2026-0526 |
WP 2FA – Two-factor authentication for WordPress | WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Unauthenticated Open Redirect via 'redirect_to' Parameter |
Medium 6.1 |
4.2.0 |
| 2026-10-07 |
WPSEC-2026-0525 |
Tickera – Sell Tickets & Manage Events | Tickera – Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated Payment Bypass via 2Checkout IPN Handler |
Medium 5.9 |
3.6.0.7 |
| 2026-10-07 |
WPSEC-2026-0524 |
Tickera – Sell Tickets & Manage Events | Tickera – Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated Sales API Authentication Bypass via Empty API Key |
Medium 5.3 |
3.6.0.7 |
| 2026-10-07 |
WPSEC-2026-0523 |
Tickera – Sell Tickets & Manage Events | Tickera – Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated SQL Injection via Sales API 'period_compare' Parameter |
High 7.5 |
3.6.0.7 |
| 2026-10-07 |
WPSEC-2026-0522 |
Event Tickets and Registration | Event Tickets and Registration <= 5.30.0.1 - Unauthenticated Payment Bypass via RSVP Order REST Endpoint |
Medium 5.3 |
5.30.0.2 |
| 2026-10-07 |
WPSEC-2026-0521 |
Event Tickets and Registration | Event Tickets and Registration <= 5.30.0.1 - Authenticated (Subscriber+) Missing Authorization to Attendee QR Check-In Status Modification |
Medium 4.3 |
5.30.0.2 |
| 2026-10-07 |
WPSEC-2026-0520 |
WPForms | WPForms <= 2.0.2.1 - Unauthenticated Reflected Cross-Site Scripting via Smart Tags |
Medium 4.7 |
2.0.2.2 |
| 2026-10-07 |
WPSEC-2026-0519 |
Tutor LMS | Tutor LMS <= 4.1.0 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting via Quiz Question Feedback |
Medium 6.4 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0518 |
Tutor LMS | Tutor LMS <= 4.1.0 - Unauthenticated Missing Authorization via Page Regeneration Action |
Medium 5.3 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0517 |
Tutor LMS | Tutor LMS <= 4.1.0 - Unauthenticated Reflected Cross-Site Scripting via 'tab' Parameter |
Medium 4.7 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0516 |
Tutor LMS | Tutor LMS <= 4.1.0 - Authenticated (Tutor Instructor+) Insecure Direct Object Reference to Arbitrary Post Overwrite via Course Creation 'ID' Parameter |
Medium 5.4 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0515 |
Tutor LMS | Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Grade Manipulation via Quiz Attempt Submission |
Medium 4.3 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0514 |
Tutor LMS | Tutor LMS <= 4.1.0 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting via Quiz Layout Setting |
Medium 6.4 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0513 |
Robo Gallery | Robo Gallery <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Reparenting and Reordering via Gallery Hierarchy Save |
Medium 4.3 |
5.2.6 |
| 2026-10-07 |
WPSEC-2026-0512 |
Robo Gallery | Robo Gallery <= 5.1.6 - Authenticated (Contributor+) Insecure Direct Object Reference to Gallery Cloning |
Medium 5.4 |
5.2.6 |
| 2026-10-07 |
WPSEC-2026-0511 |
Robo Gallery | Robo Gallery <= 5.1.6 - Authenticated (Contributor+) Sensitive Information Exposure of Private and Draft Page Titles |
Medium 4.3 |
5.2.6 |
| 2026-10-07 |
WPSEC-2026-0510 |
Robo Gallery | Robo Gallery <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Search Label Setting |
Medium 6.4 |
5.2.6 |
| 2026-10-07 |
WPSEC-2026-0509 |
Cooked – Recipe Management | Cooked – Recipe Management <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode |
Medium 6.4 |
1.16.2 |
| 2026-10-07 |
WPSEC-2026-0508 |
WP Plugin Manager | WP Plugin Manager <= 1.4.16 - Authenticated (Subscriber+) Missing Authorization to Plugin Status Disclosure via REST API |
Medium 4.3 |
1.4.17 |
| 2026-10-07 |
WPSEC-2026-0507 |
Product Configurator for WooCommerce | Product Configurator for WooCommerce <= 1.7.5 - Authenticated (Shop Manager+) PHP Object Injection via Configurator Data |
Medium 6.6 |
1.7.6 |
| 2026-10-07 |
WPSEC-2026-0506 |
AutomatorWP | AutomatorWP <= 6.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Pending Redirect URL Disclosure |
Low 3.1 |
6.0.4 |
| 2026-10-07 |
WPSEC-2026-0505 |
Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search | Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.214.0 - Authenticated (Author+) Insecure Direct Object Reference to Arbitrary Post Read, Modification and Deletion via FAQ AJAX Actions |
High 7.6 |
17.311.0 |
| 2026-10-07 |
WPSEC-2026-0504 |
Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search | Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.214.0 - Unauthenticated Reflected Cross-Site Scripting via 'new_kb_config' Parameter |
Medium 6.1 |
17.311.0 |
| 2026-10-07 |
WPSEC-2026-0503 |
Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search | Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.214.0 - Unauthenticated REST API Nonce Exposure via AI Chat 'start-session' Endpoint |
High 7.5 |
17.311.0 |
| 2026-10-07 |
WPSEC-2026-0502 |
BackWPup – WordPress Backup & Restore Plugin | BackWPup – WordPress Backup & Restore Plugin <= 5.7.6 - Unauthenticated Sensitive Information Exposure via Predictable Restore Working Directory |
Medium 5.9 |
5.7.7 |
| 2026-10-07 |
WPSEC-2026-0501 |
BackWPup – WordPress Backup & Restore Plugin | BackWPup – WordPress Backup & Restore Plugin <= 5.7.6 - Missing Authorization to Unauthenticated Backup Job Execution |
Medium 6.5 |
5.7.7 |
| 2026-10-07 |
WPSEC-2026-0500 |
MailPoet – Newsletters, Email Marketing, and Automation | MailPoet – Newsletters, Email Marketing, and Automation <= 5.40.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Newsletter Style Settings |
Medium 4.4 |
5.41.0 |
| 2026-10-07 |
WPSEC-2026-0499 |
MailPoet – Newsletters, Email Marketing, and Automation | MailPoet – Newsletters, Email Marketing, and Automation <= 5.40.0 - Unauthenticated Authentication Bypass via Brute-Forceable Subscriber Link Tokens |
Medium 4.8 |
5.41.0 |
| 2026-10-07 |
WPSEC-2026-0498 |
Slider by 10Web – Responsive Image Slider | Slider by 10Web – Responsive Image Slider <= 1.2.62 - Authenticated (Contributor+) PHP Object Injection via 'two_page_speed' Post Meta |
High 7.5 |
1.2.63 |
| 2026-10-07 |
WPSEC-2026-0497 |
MasterStudy LMS | MasterStudy LMS <= 3.7.52 - Authenticated (Contributor+) Missing Authorization to Payout Record Creation and Modification |
Medium 4.3 |
3.7.53 |
| 2026-10-07 |
WPSEC-2026-0496 |
MasterStudy LMS | MasterStudy LMS <= 3.7.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Payout Transaction ID |
Medium 6.4 |
3.7.53 |
| 2026-10-07 |
WPSEC-2026-0495 |
Ultimate Post Kit Addons for Elementor | Ultimate Post Kit Addons for Elementor <= 4.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Author Widget Social Links Setting |
Medium 6.5 |
4.5.6 |
| 2026-10-07 |
WPSEC-2026-0494 |
YITH WooCommerce Product Add-Ons | YITH WooCommerce Product Add-Ons <= 4.34.0 - Unauthenticated Information Exposure of Unpublished Product Prices |
Medium 5.3 |
4.34.1 |
| 2026-10-07 |
WPSEC-2026-0493 |
YITH WooCommerce Product Add-Ons | YITH WooCommerce Product Add-Ons <= 4.34.0 - Authenticated (Shop Manager+) SQL Injection via 's' Parameter |
Medium 4.9 |
4.34.1 |
| 2026-10-07 |
WPSEC-2026-0492 |
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cursor Effects Settings |
Medium 6.4 |
8.8.7 |
| 2026-10-07 |
WPSEC-2026-0491 |
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Creative Button Widget 'button_css_id' Setting |
Medium 6.4 |
8.8.7 |
| 2026-10-07 |
WPSEC-2026-0490 |
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via UIkit Component Attributes |
Medium 6.4 |
8.8.7 |
| 2026-10-07 |
WPSEC-2026-0489 |
Prime Slider – Addons For Elementor | Prime Slider – Addons For Elementor <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via UIkit Component Attributes |
Medium 6.4 |
4.7.0 |
| 2026-10-07 |
WPSEC-2026-0488 |
Directorist: AI-Powered Business Directory, Listings & Classified Ads | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Tags |
Medium 6.4 |
8.10.1 |
| 2026-10-07 |
WPSEC-2026-0487 |
Directorist: AI-Powered Business Directory, Listings & Classified Ads | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10 - Unauthenticated Sensitive Information Exposure via REST API |
Medium 5.3 |
8.10.1 |
| 2026-10-07 |
WPSEC-2026-0486 |
Directorist: AI-Powered Business Directory, Listings & Classified Ads | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Map Info Window Phone Number and Coordinates |
Medium 6.4 |
8.10.1 |
| 2026-10-07 |
WPSEC-2026-0485 |
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster | SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 2.7.0 - Unauthenticated Price Manipulation via 'sellkit_product_prices' Parameter |
High 7.5 |
2.8.0 |
| 2026-10-07 |
WPSEC-2026-0484 |
Contact Form 7 | Contact Form 7 <= 6.1.7 - Authenticated (Editor+) Sensitive Information Exposure via User-Related Special Mail-Tags |
Medium 4.5 |
6.2 |
| 2026-10-06 |
WPSEC-2026-0483 |
Firelight Lightbox | Firelight Lightbox <= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Block src Attribute |
Medium 6.4 |
2.3.24 |
