| 2026-10-03 |
WPSEC-2026-0381 |
WP Coder | WP Coder <= 4.5.1 - Authenticated (Editor+) Remote Code Execution via PHP Code Snippets |
High 7.2 |
4.5.2 |
| 2026-10-03 |
WPSEC-2026-0380 |
PowerFolio – Portfolio & Image Gallery for Elementor | PowerFolio – Portfolio & Image Gallery for Elementor <= 3.2.7 - Authenticated (Contributor+) CSS Injection via Gutenberg Block Attributes |
Medium 5.0 |
3.2.8 |
| 2026-10-03 |
WPSEC-2026-0379 |
GeoDirectory | GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter |
Critical 9.8 |
2.8.188 |
| 2026-10-03 |
WPSEC-2026-0378 |
Ivory Search | Ivory Search <= 5.5.18 - Unauthenticated Reflected Cross-Site Scripting via Highlight Search Terms |
Medium 6.1 |
5.5.19 |
| 2026-10-03 |
WPSEC-2026-0377 |
Download Manager | Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute |
Medium 5.4 |
3.3.72 |
| 2026-10-03 |
WPSEC-2026-0376 |
Download Manager | Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Tokens |
Medium 5.7 |
3.3.72 |
| 2026-10-03 |
WPSEC-2026-0375 |
10Web Booster – Website speed optimization, Cache & Page Speed optimizer | 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.34.5 - Unauthenticated Path Traversal via Page Cache Path |
Medium 6.5 |
2.34.8 |
| 2026-10-03 |
WPSEC-2026-0374 |
Contact Form Widget | Contact Form Widget <= 1.5.2 - Unauthenticated CSV Injection via Contact Form Submissions |
Medium 6.1 |
1.5.3 |
| 2026-10-03 |
WPSEC-2026-0373 |
Quran multilanguage Text & Audio | Quran multilanguage Text & Audio < 3.0.4 - Unauthenticated Path Traversal to Arbitrary .txt File Read via 'lang' Parameter |
Medium 5.3 |
3.0.4 |
| 2026-10-03 |
WPSEC-2026-0372 |
JS Help Desk – Best Help Desk & Support Plugin | JS Help Desk – Best Help Desk & Support Plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Internal Note Attachment Download |
Medium 4.3 |
5.0.0 |
| 2026-10-03 |
WPSEC-2026-0371 |
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.2 - Unauthenticated Sensitive Information Exposure via Predictable Folder Download Archive |
Low 3.7 |
3.2.3 |
| 2026-10-03 |
WPSEC-2026-0370 |
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Folder Structure Modification |
Medium 4.3 |
3.2.3 |
| 2026-10-03 |
WPSEC-2026-0369 |
Premium Packages | Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Billing State, Phone and Tax ID Fields |
Medium 6.4 |
7.2.7 |
| 2026-10-03 |
WPSEC-2026-0368 |
Groundhogg — CRM, Newsletters, and Marketing Automation | Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Subscriber+) Privilege Escalation via Support User Impersonation |
High 7.1 |
4.9 |
| 2026-10-03 |
WPSEC-2026-0367 |
WPC Estimated Delivery Date for WooCommerce | WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Term and Shipping Configuration Disclosure |
Medium 4.3 |
4.0.2 |
| 2026-10-03 |
WPSEC-2026-0366 |
WPC Smart Quick View for WooCommerce | WPC Smart Quick View for WooCommerce <= 4.4.0 - Unauthenticated Reflected Cross-Site Scripting via 'woosq-redirect' Parameter |
Medium 6.1 |
4.4.1 |
| 2026-10-03 |
WPSEC-2026-0365 |
Calculated Fields Form | Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via Nested Field References in Calculated Field Equations |
Medium 4.7 |
5.5.1.6 |
| 2026-10-02 |
WPSEC-2026-0364 |
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
Medium 6.4 |
5.15 |
| 2026-10-02 |
WPSEC-2026-0363 |
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Store Popup Content |
Medium 5.4 |
5.15 |
| 2026-10-02 |
WPSEC-2026-0362 |
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Unauthenticated Sensitive Information Exposure via load_post_by_ajax AJAX Action |
Medium 5.3 |
5.15 |
| 2026-10-02 |
WPSEC-2026-0361 |
GiveWP – Donation Plugin and Fundraising Platform | GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Reflected Cross-Site Scripting via Stripe Webhook Event Type |
Medium 6.1 |
4.18.0 |
| 2026-10-02 |
WPSEC-2026-0360 |
GiveWP – Donation Plugin and Fundraising Platform | GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Sensitive Information Exposure via Email Meta Tag Injection |
Medium 5.3 |
4.18.0 |
| 2026-10-02 |
WPSEC-2026-0359 |
GiveWP – Donation Plugin and Fundraising Platform | GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Grid Shortcode and Campaign Block Attributes |
Medium 6.4 |
4.18.0 |
| 2026-10-02 |
WPSEC-2026-0358 |
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.1 - Authenticated (Author+) Mass Assignment to Arbitrary Post Overwrite/Deletion and Gallery Path Change via REST API |
Medium 5.4 |
4.5.2 |
| 2026-10-02 |
WPSEC-2026-0357 |
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.1 - Authenticated (Author+) Path Traversal via ZIP Archive Upload |
Low 3.1 |
4.5.2 |
| 2026-10-02 |
WPSEC-2026-0356 |
Name Directory | Name Directory <= 1.34.2 - Unauthenticated Arbitrary Shortcode Execution via Public Name Submission Description |
Medium 6.5 |
1.34.3 |
| 2026-10-02 |
WPSEC-2026-0355 |
Name Directory | Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute |
Medium 6.4 |
1.34.3 |
| 2026-10-02 |
WPSEC-2026-0354 |
All in One SEO | All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via Search Query |
High 7.3 |
5.0.2.1 |
| 2026-10-02 |
WPSEC-2026-0353 |
Blocksy Companion | Blocksy Companion <= 2.1.57 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
Medium 6.4 |
2.1.58 |
| 2026-10-02 |
WPSEC-2026-0352 |
Blocksy Companion | Blocksy Companion <= 2.1.57 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Search Block Placeholder |
Medium 6.4 |
2.1.58 |
| 2026-10-02 |
WPSEC-2026-0351 |
Blocksy Companion | Blocksy Companion <= 2.1.57 - Authenticated (Contributor+) Stored Cross-Site Scripting via Breadcrumbs Block Attributes |
Medium 6.4 |
2.1.58 |
| 2026-10-02 |
WPSEC-2026-0350 |
Envira Gallery | Envira Gallery <= 1.16.0 - Authenticated (Contributor+) Path Traversal to Image File Write via 'crop_position' Gallery Setting |
Low 3.1 |
1.16.1 |
| 2026-10-02 |
WPSEC-2026-0349 |
Envira Gallery | Envira Gallery <= 1.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Configuration Values |
Medium 6.4 |
1.16.1 |
| 2026-10-02 |
WPSEC-2026-0348 |
GeoDirectory | GeoDirectory <= 2.8.186 - Authenticated (Subscriber+) SQL Injection via Listing Latitude and Longitude |
Medium 6.5 |
2.8.187 |
| 2026-10-02 |
WPSEC-2026-0347 |
GeoDirectory | GeoDirectory <= 2.8.186 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Latitude and Longitude |
Medium 5.4 |
2.8.187 |
| 2026-10-02 |
WPSEC-2026-0346 |
VikBooking Hotel Booking Engine & PMS | VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via Chat Attachment File Name |
High 7.2 |
1.8.16 |
| 2026-10-02 |
WPSEC-2026-0345 |
VikBooking Hotel Booking Engine & PMS | VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Reflected Cross-Site Scripting via Pagination Links |
Medium 6.1 |
1.8.16 |
| 2026-10-02 |
WPSEC-2026-0344 |
SmartVideo | SmartVideo <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call-to-Action Overlay Shortcode and Block Attributes |
Medium 6.4 |
2.4.5 |
| 2026-10-02 |
WPSEC-2026-0343 |
Create Block Theme | Create Block Theme <= 2.10.1 - Authenticated (Author+) PHP Code Injection via Theme Export |
High 7.1 |
2.10.2 |
| 2026-10-02 |
WPSEC-2026-0342 |
Academy LMS | Academy LMS <= 4.0.1 - Authenticated (Contributor+) Path Traversal to Arbitrary .html File Read via Block Template Slug |
Medium 4.3 |
4.0.2 |
| 2026-10-02 |
WPSEC-2026-0341 |
EventPrime | EventPrime <= 4.3.4.8 - Unauthenticated Information Exposure of Password-Protected Event Content via REST API and Abilities |
Medium 5.3 |
4.3.5.0 |
| 2026-10-02 |
WPSEC-2026-0340 |
EventPrime | EventPrime <= 4.3.4.8 - Missing Authorization to Unauthenticated Booking and User Account Creation via 'eventprime/create-booking' Ability |
Medium 5.3 |
4.3.5.0 |
| 2026-10-02 |
WPSEC-2026-0339 |
EventPrime | EventPrime <= 4.3.4.8 - Unauthenticated reCAPTCHA Bypass via Login and Registration Forms |
Medium 5.3 |
4.3.5.0 |
| 2026-10-02 |
WPSEC-2026-0338 |
Zoom for WordPress | Zoom for WordPress <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Webinar and Product Data Exposure via AJAX Actions |
Medium 4.3 |
1.6.0 |
| 2026-10-02 |
WPSEC-2026-0337 |
Zoom for WordPress | Zoom for WordPress <= 1.5.4 - Missing Authorization to Unauthenticated Zoom Connection Reset and OAuth Token Overwrite |
Medium 6.5 |
1.6.0 |
| 2026-10-02 |
WPSEC-2026-0336 |
Zoom for WordPress | Zoom for WordPress <= 1.5.4 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Log Files |
Medium 5.3 |
1.6.0 |
| 2026-10-02 |
WPSEC-2026-0335 |
Zoom for WordPress | Zoom for WordPress <= 1.5.4 - Cross-Site Request Forgery to Zoom OAuth Token Overwrite |
Medium 4.3 |
1.6.0 |
| 2026-10-02 |
WPSEC-2026-0334 |
GD Rating System | GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via Rating Item 'title' and 'url' Arguments |
High 7.2 |
3.7.2 |
| 2026-10-02 |
WPSEC-2026-0333 |
Flexy Breadcrumb | Flexy Breadcrumb <= 1.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name |
Medium 6.4 |
1.3.1 |
| 2026-10-02 |
WPSEC-2026-0332 |
Flexy Breadcrumb | Flexy Breadcrumb <= 1.3.0 - Unauthenticated Reflected Cross-Site Scripting via Search Query |
Medium 6.1 |
1.3.1 |
| 2026-10-02 |
WPSEC-2026-0331 |
PowerPress | PowerPress <= 11.17.9 - Unauthenticated Sensitive Information Exposure via Embed and Play in New Window Endpoints |
Medium 5.3 |
11.17.11 |
| 2026-10-02 |
WPSEC-2026-0330 |
PowerPress | PowerPress <= 11.17.9 - Authenticated (Contributor+) Server-Side Request Forgery via Episode Media URL |
Medium 6.4 |
11.17.11 |
| 2026-10-02 |
WPSEC-2026-0329 |
PowerPress | PowerPress <= 11.17.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Player Settings |
Medium 6.1 |
11.17.11 |
| 2026-10-02 |
WPSEC-2026-0328 |
Backuply | Backuply <= 1.5.8 - Unauthenticated Second-Order SQL Injection via Backup Restoration |
High 7.5 |
1.5.9 |
| 2026-10-02 |
WPSEC-2026-0327 |
Premium Addons for Elementor | Premium Addons for Elementor <= 4.11.109 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Box Widget |
Medium 6.4 |
4.11.110 |
| 2026-10-02 |
WPSEC-2026-0326 |
Ecwid by Lightspeed Ecommerce Shopping Cart | Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.9 - Stored Cross-Site Scripting via Product Name in Single Product Block and Shortcode |
Medium 4.4 |
7.0.10 |
| 2026-10-02 |
WPSEC-2026-0325 |
The Ultimate Video Player For WordPress – by Presto Player | The Ultimate Video Player For WordPress – by Presto Player <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes |
Medium 6.4 |
4.5.3 |
| 2026-10-02 |
WPSEC-2026-0324 |
Sirv | Sirv <= 8.2.5 - Authenticated (Contributor+) SQL Injection via 'shortcode_data' Parameter Keys |
High 8.1 |
8.2.6 |
| 2026-10-02 |
WPSEC-2026-0323 |
PublishPress Permissions: Access Control, Content Permissions, User Access | PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.8.4 - Cross-Site Request Forgery to Sub-Permissions Fix Action |
Medium 4.3 |
4.9.0 |
| 2026-10-02 |
WPSEC-2026-0322 |
PublishPress Permissions: Access Control, Content Permissions, User Access | PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.8.4 - Missing Authorization to Supplemental Role Removal |
Low 2.7 |
4.9.0 |
| 2026-10-02 |
WPSEC-2026-0321 |
Aurora Heatmap | Aurora Heatmap <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting via Report URL |
Medium 6.1 |
1.7.3 |
| 2026-10-02 |
WPSEC-2026-0320 |
Spectra Blocks | Spectra Blocks <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'htmlAttributes' Attribute |
Medium 6.4 |
1.0.9 |
| 2026-10-02 |
WPSEC-2026-0319 |
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Upload via Email Attachment in POP3 Mailbox Processing |
High 8.1 |
11.1.0 |
| 2026-10-02 |
WPSEC-2026-0318 |
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion via File Custom Field |
High 7.4 |
11.1.0 |
| 2026-10-02 |
WPSEC-2026-0317 |
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter |
Medium 6.4 |
4.3.13 |
| 2026-10-02 |
WPSEC-2026-0316 |
RegistrationMagic | RegistrationMagic <= 6.1.0.0 - Unauthenticated Reflected Cross-Site Scripting via 'total_price' and 'description' Parameters |
Medium 6.1 |
6.1.0.1 |
| 2026-10-02 |
WPSEC-2026-0315 |
Logo Slider | Logo Slider <= 5.5.5 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Post Order Modification |
Medium 4.3 |
6.0.0 |
| 2026-10-02 |
WPSEC-2026-0314 |
WP Socializer | WP Socializer <= 7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Share Icons Shortcode |
Medium 6.4 |
8.0 |
| 2026-10-02 |
WPSEC-2026-0313 |
Filter Everything | Filter Everything <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Pro 'Load More' / Infinite Scroll Pagination |
Medium 6.1 |
1.9.7 |
| 2026-10-02 |
WPSEC-2026-0312 |
WP Visitor Statistics (Real Time Traffic) | WP Visitor Statistics (Real Time Traffic) <= 8.5 - Unauthenticated Stored Cross-Site Scripting via 'fullRef' Parameter |
High 7.2 |
8.6 |
| 2026-10-02 |
WPSEC-2026-0311 |
Icegram Engage | Icegram Engage <= 3.1.43 - Authenticated (Contributor+) PHP Object Injection via 'messages' Custom Field |
High 7.5 |
3.1.44 |
| 2026-10-02 |
WPSEC-2026-0310 |
Booking for Appointments and Events Calendar – Amelia | Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Unauthenticated Unpaid Booking Injection via Additional 'bookings' Entries |
Medium 5.3 |
2.4.11 |
| 2026-10-02 |
WPSEC-2026-0309 |
Booking for Appointments and Events Calendar – Amelia | Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Unauthenticated Payment Bypass via Package Reference (Incomplete Fix for CVE-2026-16582) |
Medium 5.3 |
2.4.11 |
| 2026-10-02 |
WPSEC-2026-0308 |
Booking for Appointments and Events Calendar – Amelia | Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Authenticated (Amelia Employee+) Insecure Direct Object Reference to Arbitrary Booking Status Update |
Medium 4.3 |
2.4.11 |
| 2026-10-02 |
WPSEC-2026-0307 |
GeoDirectory | GeoDirectory <= 2.8.182 - Authenticated (Subscriber+) Stored Cross-Site Scripting via URL Custom Field Link Label |
Medium 6.4 |
2.8.183 |
| 2026-10-02 |
WPSEC-2026-0306 |
WooCommerce Square | WooCommerce Square <= 5.5.0 - Missing Authorization to Unauthenticated Apple Pay Domain Registration |
Medium 6.5 |
5.5.1 |
| 2026-10-02 |
WPSEC-2026-0305 |
Defender Security | Defender Security <= 6.2.4 - Unauthenticated Firewall Lockout Bypass via 'wpmudev_is_staff' Cookie |
Low 3.7 |
6.3.0 |
| 2026-10-02 |
WPSEC-2026-0304 |
Defender Security | Defender Security <= 6.2.4 - Cross-Site Request Forgery to Two-Factor Authentication Reset |
Medium 4.3 |
6.3.0 |
| 2026-10-02 |
WPSEC-2026-0303 |
Defender Security | Defender Security <= 6.2.4 - Unauthenticated Privilege Escalation via Account Takeover in Masked Login Password Reset |
High 7.5 |
6.3.0 |
| 2026-10-02 |
WPSEC-2026-0302 |
Iptanus File Upload | Iptanus File Upload <= 5.1.10 - Unauthenticated SQL Injection via 'uniqueuploadid' Parameter |
Medium 5.3 |
5.2.0 |
| 2026-10-02 |
WPSEC-2026-0301 |
UiCore Elements | UiCore Elements <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form Widget |
Medium 6.4 |
1.3.18 |
| 2026-10-02 |
WPSEC-2026-0300 |
BetterLinks | BetterLinks <= 3.1.3 - Unauthenticated Open Redirect via OAuth Authorization Endpoint |
Medium 6.1 |
3.1.4 |
| 2026-10-02 |
WPSEC-2026-0299 |
BetterLinks | BetterLinks <= 3.1.3 - Incorrect Authorization to Click Analytics Deletion |
Medium 4.3 |
3.1.4 |
| 2026-10-02 |
WPSEC-2026-0298 |
wpForo Forum | wpForo Forum <= 3.1.7 - Unauthenticated SQL Injection via Custom Field Search Values |
Medium 5.9 |
3.2.0 |
| 2026-10-02 |
WPSEC-2026-0297 |
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.6 - Unauthenticated Stored Cross-Site Scripting via 'qsm_hidden_questions' Parameter |
Medium 6.1 |
11.2.7 |
| 2026-10-02 |
WPSEC-2026-0296 |
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Attachment Replacement |
Medium 6.4 |
4.2.15 |
| 2026-10-02 |
WPSEC-2026-0295 |
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Unauthenticated CSS Injection via Background Lazyload Selectors |
Medium 5.8 |
4.2.15 |
| 2026-10-02 |
WPSEC-2026-0294 |
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Authenticated (Subscriber+) Sensitive Information Exposure via Dashboard Widget |
Medium 6.5 |
4.2.15 |
| 2026-10-02 |
WPSEC-2026-0293 |
Multiline files upload for contact form 7 | Multiline files upload for contact form 7 <= 3.1.0 - Cross-Site Request Forgery to Plugin Deactivation |
Medium 4.3 |
3.1.1 |
| 2026-10-02 |
WPSEC-2026-0292 |
Admin and Site Enhancements (ASE) | Admin and Site Enhancements (ASE) <= 9.1.2 - Unauthenticated Custom Login URL Disclosure and Login Protection Bypass |
Medium 5.3 |
9.1.3 |
| 2026-10-02 |
WPSEC-2026-0291 |
The Ultimate Video Player For WordPress – by Presto Player | The Ultimate Video Player For WordPress – by Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via presto-player Tag |
High 7.2 |
4.5.2 |
| 2026-10-02 |
WPSEC-2026-0290 |
If-So Dynamic Content – Elementor & All Page Builders Personalization | If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Condition Type |
Medium 6.4 |
1.10.2 |
| 2026-10-02 |
WPSEC-2026-0289 |
If-So Dynamic Content – Elementor & All Page Builders Personalization | If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.1 - Authenticated (Author+) Stored Cross-Site Scripting via Trigger Version Name |
Medium 6.4 |
1.10.2 |
| 2026-10-02 |
WPSEC-2026-0288 |
User Role Editor | User Role Editor <= 4.66.1 - Authenticated (Custom-level+) Privilege Escalation via Add Role/Grant Roles AJAX Actions |
High 7.2 |
4.66.2 |
| 2026-10-02 |
WPSEC-2026-0287 |
Twenty20 Image Before-After | Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute |
Medium 6.4 |
2.0.6 |
| 2026-10-02 |
WPSEC-2026-0286 |
LatePoint | LatePoint <= 5.7.2 - Unauthenticated Insecure Direct Object Reference to Payment Bypass and Customer Information Disclosure via 'order_item_id' Parameter |
Medium 6.5 |
5.7.3 |
| 2026-10-02 |
WPSEC-2026-0285 |
LatePoint | LatePoint <= 5.7.2 - Unauthenticated Account Takeover of Subscriber-Level Users via Customer Email to Username Matching |
Medium 4.8 |
5.7.3 |
| 2026-10-02 |
WPSEC-2026-0284 |
LatePoint | LatePoint <= 5.7.2 - Unauthenticated SQL Injection via Booking Parameters |
High 7.5 |
5.7.3 |
| 2026-10-02 |
WPSEC-2026-0283 |
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Ticket Attachment Disclosure via Attachment ID |
Medium 5.4 |
3.5.4 |
| 2026-10-02 |
WPSEC-2026-0282 |
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.0 - Unauthenticated Missing Authorization to Payment and Subscription Processing via Stripe Return URL |
Low 3.7 |
3.1.1 |
