| 2026-10-02 |
WPSEC-2026-0281 |
Real Cookie Banner: GDPR & ePrivacy Cookie Consent | Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content |
High 7.2 |
5.3.6 |
| 2026-10-02 |
WPSEC-2026-0280 |
Beaver Builder – WordPress Page Builder (Free & Pro) | Beaver Builder – WordPress Page Builder (Free & Pro) <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via Auto-Suggest Field Values |
Medium 6.5 |
2.11.0.6 |
| 2026-10-02 |
WPSEC-2026-0279 |
Beaver Builder – WordPress Page Builder (Free & Pro) | Beaver Builder – WordPress Page Builder (Free & Pro) <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module |
Medium 4.8 |
2.11.0.6 |
| 2026-10-02 |
WPSEC-2026-0278 |
Mixed Media Gallery Blocks | Mixed Media Gallery Blocks <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Global Presets |
Medium 6.4 |
3.4.3 |
| 2026-10-02 |
WPSEC-2026-0277 |
Mixed Media Gallery Blocks | Mixed Media Gallery Blocks <= 3.4.2 - Unauthenticated Sensitive Information Exposure via Gallery Block Video API Access Token |
Medium 5.3 |
3.4.3 |
| 2026-10-02 |
WPSEC-2026-0276 |
Speed Optimizer | Speed Optimizer <= 7.8.2 - Unauthenticated Sensitive Information Exposure via Forged Logged-In Cookie in File Cache |
Medium 5.9 |
7.8.3 |
| 2026-10-02 |
WPSEC-2026-0275 |
WPFront Notification Bar | WPFront Notification Bar <= 3.5.1 - Unauthenticated Reflected Cross-Site Scripting via Request URL in Debug Log Output |
Medium 4.7 |
3.5.2 |
| 2026-10-02 |
WPSEC-2026-0274 |
Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms | Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms <= 3.53.0 - Reflected Cross-Site Scripting via Terms Row-Action URLs |
Medium 6.1 |
3.54.0 |
| 2026-10-02 |
WPSEC-2026-0273 |
JetFormBuilder | JetFormBuilder <= 3.6.5.4 - Unauthenticated Arbitrary Attachment Deletion via Media Field |
Medium 4.8 |
3.6.6 |
| 2026-10-02 |
WPSEC-2026-0272 |
Simple Membership | Simple Membership <= 4.8.3 - Unauthenticated Email Verification Bypass via Activation Email Resend |
Medium 5.3 |
4.8.4 |
| 2026-10-02 |
WPSEC-2026-0271 |
The Plus Addons for Elementor | The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hover Card Widget Script Content |
Medium 5.4 |
6.5.2 |
| 2026-10-02 |
WPSEC-2026-0270 |
The Plus Addons for Elementor | The Plus Addons for Elementor <= 6.5.1 - Unauthenticated Information Exposure of Unapproved Comments via Post Comment Widget |
Medium 5.3 |
6.5.2 |
| 2026-10-02 |
WPSEC-2026-0269 |
The Plus Addons for Elementor | The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Listing Widget 'All Posts Loaded Text' Setting |
Medium 5.4 |
6.5.2 |
| 2026-10-02 |
WPSEC-2026-0268 |
The Plus Addons for Elementor | The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Missing Authorization in MCP Abilities to Sensitive Information Exposure and Template Publishing |
Medium 5.4 |
6.5.2 |
| 2026-10-02 |
WPSEC-2026-0267 |
The Plus Addons for Elementor | The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Local File Inclusion via Blog Widget 'post_category_style' Setting |
High 8.8 |
6.5.2 |
| 2026-10-02 |
WPSEC-2026-0266 |
The Plus Addons for Elementor | The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box and Flip Box Widget Button Text |
Medium 6.4 |
6.5.2 |
| 2026-10-02 |
WPSEC-2026-0265 |
Ditty – Responsive News Tickers, Sliders, and Lists | Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Display Settings |
Medium 6.4 |
3.1.71 |
| 2026-10-02 |
WPSEC-2026-0264 |
Breeze Cache | Breeze Cache <= 2.5.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Attributes |
Medium 4.9 |
2.5.18 |
| 2026-10-02 |
WPSEC-2026-0263 |
Tutor LMS | Tutor LMS <= 4.0.9 - Unauthenticated Insecure Direct Object Reference to Quiz Attempt Disclosure via 'attempt_id' Parameter |
Medium 5.3 |
4.1.0 |
| 2026-10-02 |
WPSEC-2026-0262 |
Simple CAPTCHA with Cloudflare Turnstile | Simple CAPTCHA with Cloudflare Turnstile <= 1.43.2 - Unauthenticated CAPTCHA Bypass via FluentAuth Compatibility 'action' Parameter |
Low 3.7 |
1.44.0 |
| 2026-10-02 |
WPSEC-2026-0261 |
Social Icons Widget & Block | Social Icons Widget & Block <= 4.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure via AI Chat Identity Signature |
Medium 6.5 |
4.7.4 |
| 2026-10-02 |
WPSEC-2026-0260 |
Shortcodes Ultimate | Shortcodes Ultimate <= 7.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_feed Shortcode Error Message |
Medium 6.4 |
7.9.1 |
| 2026-10-02 |
WPSEC-2026-0259 |
Shortcodes Ultimate | Shortcodes Ultimate <= 7.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode 'type' Attribute |
Medium 5.4 |
7.9.1 |
| 2026-10-02 |
WPSEC-2026-0258 |
Shortcodes Ultimate | Shortcodes Ultimate <= 7.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode |
Medium 6.4 |
7.9.1 |
| 2026-10-02 |
WPSEC-2026-0257 |
MailPoet – Newsletters, Email Marketing, and Automation | MailPoet – Newsletters, Email Marketing, and Automation <= 5.39.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title in 'newsletter:post_title' Shortcode |
Medium 6.4 |
5.40.0 |
| 2026-10-02 |
WPSEC-2026-0256 |
MailPoet – Newsletters, Email Marketing, and Automation | MailPoet – Newsletters, Email Marketing, and Automation <= 5.39.0 - Unauthenticated Sensitive Information Exposure of Password-Protected Post Content via Newsletters |
Low 3.7 |
5.40.0 |
| 2026-10-02 |
WPSEC-2026-0255 |
Hostinger Reach | Hostinger Reach <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Subscription Form Widget 'formId' Setting |
Medium 6.4 |
1.8.3 |
| 2026-10-02 |
WPSEC-2026-0254 |
EmbedPress | EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Widget 'showTitle' Setting |
Medium 6.4 |
4.6.7 |
| 2026-10-02 |
WPSEC-2026-0253 |
Spectra Legacy – Gutenberg Blocks | Spectra Legacy – Gutenberg Blocks <= 2.20.3 - Unauthenticated Missing Authorization to Spectra Font Deletion and theme.json Modification |
Medium 6.5 |
2.20.4 |
| 2026-10-02 |
WPSEC-2026-0252 |
Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) | Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) <= 3.7.1 - Authenticated (Share-Link Viewer) Insufficient Session Expiration via Viewer Account Profile Update |
Medium 4.3 |
3.7.2 |
| 2026-10-02 |
WPSEC-2026-0251 |
Photo Gallery by 10Web | Photo Gallery by 10Web <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection via 'two_page_speed' Post Meta |
High 7.5 |
1.8.47 |
| 2026-10-02 |
WPSEC-2026-0250 |
Photo Gallery by 10Web | Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via Image Editor |
Medium 6.1 |
1.8.47 |
| 2026-10-02 |
WPSEC-2026-0249 |
Photo Gallery by 10Web | Photo Gallery by 10Web <= 1.8.46 - Cross-Site Request Forgery to Arbitrary File Overwrite via Image Editor |
High 8.1 |
1.8.47 |
| 2026-10-02 |
WPSEC-2026-0248 |
Download Manager | Download Manager <= 3.3.70 - Cross-Site Request Forgery to Privacy Settings Update |
Medium 4.3 |
3.3.71 |
| 2026-10-02 |
WPSEC-2026-0247 |
Download Manager | Download Manager <= 3.3.70 - Unauthenticated Missing Authorization to Protected File Download via CAPTCHA Validation |
High 7.5 |
3.3.71 |
| 2026-10-02 |
WPSEC-2026-0246 |
Download Manager | Download Manager <= 3.3.70 - Authenticated (Author+) Stored Cross-Site Scripting via Package Icon URL |
Medium 6.4 |
3.3.71 |
| 2026-10-02 |
WPSEC-2026-0245 |
Download Manager | Download Manager <= 3.3.70 - Authenticated (Author+) Stored Cross-Site Scripting via Package Title in Download History Filter |
Medium 5.4 |
3.3.71 |
| 2026-10-02 |
WPSEC-2026-0244 |
Download Manager | Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name |
Medium 5.4 |
3.3.71 |
| 2026-10-02 |
WPSEC-2026-0243 |
EWWW Image Optimizer | EWWW Image Optimizer <= 8.7.7 - Authenticated (Contributor+) PHP Object Injection via 'eio_page_settings' Post Meta |
High 7.5 |
8.8.0 |
| 2026-10-02 |
WPSEC-2026-0242 |
EWWW Image Optimizer | EWWW Image Optimizer <= 8.7.7 - Authenticated (Administrator+) Limited File Deletion and Renaming via WebP Migration on Multisite |
Medium 4.4 |
8.8.0 |
| 2026-10-02 |
WPSEC-2026-0241 |
EWWW Image Optimizer | EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via Request URI in Support Debug Information |
Medium 6.1 |
8.8.0 |
| 2026-10-02 |
WPSEC-2026-0240 |
Autoptimize | Autoptimize <= 3.1.15.1 - Unauthenticated Open Redirect via 404 Fallback Handler |
Medium 4.7 |
3.1.16 |
| 2026-10-02 |
WPSEC-2026-0239 |
Click to Chat – HoliThemes | Click to Chat – HoliThemes <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via Greetings Dialog Placeholders |
Medium 4.8 |
4.45 |
| 2026-10-02 |
WPSEC-2026-0238 |
Newsletter | Newsletter <= 9.4.3 - Unauthenticated Open Redirect via 'redirect' Parameter |
Medium 4.7 |
9.4.4 |
| 2026-10-02 |
WPSEC-2026-0237 |
Smush – Lazy Load Images, Optimize & Compress Images | Smush – Lazy Load Images, Optimize & Compress Images <= 4.3.3 - Authenticated (Administrator+) Missing Authorization to Network-Wide Settings Modification on Multisite |
Low 3.3 |
4.3.4 |
| 2026-10-02 |
WPSEC-2026-0236 |
Smush – Lazy Load Images, Optimize & Compress Images | Smush – Lazy Load Images, Optimize & Compress Images <= 4.3.3 - Improper Certificate Validation to WPMU DEV API Key Exposure in Hub Connector |
Medium 6.5 |
4.3.4 |
| 2026-10-02 |
WPSEC-2026-0235 |
The Events Calendar | The Events Calendar <= 6.17.5 - Authenticated (Contributor+) Missing Authorization to Event, Venue and Organizer Author Assignment via REST API |
Medium 4.3 |
6.17.5.1 |
| 2026-10-02 |
WPSEC-2026-0234 |
The Events Calendar | The Events Calendar <= 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via Events QR Code Widget |
High 7.3 |
6.17.5.1 |
| 2026-10-02 |
WPSEC-2026-0233 |
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Builder Control Values |
Medium 6.4 |
4.0.7 |
| 2026-10-02 |
WPSEC-2026-0232 |
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title in Blog Posts Widget |
Medium 6.4 |
4.0.7 |
| 2026-10-02 |
WPSEC-2026-0231 |
Kadence Blocks | Kadence Blocks <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Link Block 'imageRatio' Attribute |
Medium 6.4 |
3.7.11.1 |
| 2026-10-02 |
WPSEC-2026-0230 |
WPML Multilingual & Multicurrency for WooCommerce | WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Currency Exchange Rate |
Medium 4.9 |
5.5.8 |
| 2026-10-02 |
WPSEC-2026-0229 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via Uploaded Filename |
Medium 6.1 |
4.17.5 |
| 2026-10-02 |
WPSEC-2026-0228 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Nickname and Biographical Info Profile Fields |
Medium 6.3 |
4.17.5 |
| 2026-10-02 |
WPSEC-2026-0227 |
Newsletter | Newsletter <= 9.3.9 - Unauthenticated Missing Authorization to Subscriber Data Overwrite via Re-Subscription |
Medium 5.3 |
9.4.0 |
| 2026-10-02 |
WPSEC-2026-0226 |
Newsletter | Newsletter <= 9.3.9 - Cross-Site Request Forgery to Subscriber Profile Update |
Medium 4.3 |
9.4.0 |
| 2026-10-02 |
WPSEC-2026-0225 |
Newsletter | Newsletter <= 9.3.9 - Unauthenticated Authentication Bypass via Predictable Subscriber Token |
Medium 4.8 |
9.4.0 |
| 2026-10-02 |
WPSEC-2026-0224 |
Premium Addons for Elementor | Premium Addons for Elementor <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Box Widget 'preload' Setting |
Medium 6.4 |
4.11.106 |
| 2026-10-02 |
WPSEC-2026-0223 |
Site Kit by Google | Site Kit by Google <= 1.187.0 - Unauthenticated Authentication Bypass via Sign in with Google |
High 7.5 |
1.188.0 |
| 2026-10-02 |
WPSEC-2026-0222 |
Site Kit by Google | Site Kit by Google <= 1.187.0 - Cross-Site Request Forgery via Sign in with Google Callback |
Medium 4.2 |
1.188.0 |
| 2026-10-02 |
WPSEC-2026-0221 |
WooCommerce | WooCommerce <= 11.1.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via REST API v1/v2 Product Review Creation |
Medium 5.5 |
11.1.2 |
| 2026-10-01 |
WPSEC-2026-0220 |
Tutor LMS Elementor Addons | Tutor LMS Elementor Addons <= 4.0.1 - Cross-Site Request Forgery to Dependency Plugin Activation |
Medium 4.3 |
4.0.2 |
| 2026-10-01 |
WPSEC-2026-0219 |
s2Member | s2Member <= 260913 - Authenticated (Subscriber+) Remote Code Execution via Custom Profile Fields in Payment Notification Emails and Tracking Codes |
High 7.5 |
260917 |
| 2026-10-01 |
WPSEC-2026-0218 |
s2Member | s2Member <= 260913 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute |
High 7.5 |
260917 |
| 2026-10-01 |
WPSEC-2026-0217 |
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) | miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.9.0 - Unauthenticated Authentication Bypass via Social Login Account Linking |
High 8.1 |
7.9.1 |
| 2026-10-01 |
WPSEC-2026-0216 |
PageLayer | PageLayer <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Site Option Update via Global Styles and Homepage Settings |
Medium 4.3 |
2.2.1 |
| 2026-10-01 |
WPSEC-2026-0215 |
PageLayer | PageLayer <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Page/Post Modification and Deletion |
Medium 6.3 |
2.2.1 |
| 2026-10-01 |
WPSEC-2026-0214 |
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.3.1 - Unauthenticated Registration OTP Verification Bypass via Custom Registration Form |
Medium 5.3 |
6.3.2 |
| 2026-10-01 |
WPSEC-2026-0213 |
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.3.1 - Authenticated (Subscriber+) Two-Factor Authentication Bypass via Login Method Substitution and Grace-Period Skip |
High 8.1 |
6.3.2 |
| 2026-10-01 |
WPSEC-2026-0212 |
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.3.1 - Authenticated (Administrator+) Missing Authorization to Network-Wide 2FA Settings Modification on Multisite |
Low 3.3 |
6.3.2 |
| 2026-10-01 |
WPSEC-2026-0211 |
Social Share Icons & Social Share Buttons | Social Share Icons & Social Share Buttons <= 3.7.4 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via WeChat Share Icon |
Medium 6.1 |
3.7.5 |
| 2026-10-01 |
WPSEC-2026-0210 |
Directorist: AI-Powered Business Directory, Listings & Classified Ads | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.9.5 - Authenticated (Subscriber+) Missing Authorization to Review Moderation |
Medium 5.4 |
8.9.6 |
| 2026-10-01 |
WPSEC-2026-0209 |
Redirection | Redirection <= 5.10.0 - Unauthenticated Open Redirect via Regex Redirect Targets |
Medium 4.7 |
5.10.1 |
| 2026-10-01 |
WPSEC-2026-0208 |
Redirection | Redirection <= 5.10.0 - Unauthenticated CSV Injection via 404 and Redirect Log Exports |
Medium 4.7 |
5.10.1 |
| 2026-10-01 |
WPSEC-2026-0207 |
Top 10 | Top 10 <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Popular Posts Block thumb_size Attribute |
Medium 6.4 |
4.5.1 |
| 2026-10-01 |
WPSEC-2026-0206 |
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.83 - Authenticated (Contributor+) Missing Authorization to Database Table Access via wpdadiehard Shortcode |
Medium 5.4 |
5.5.84 |
| 2026-10-01 |
WPSEC-2026-0205 |
Getwid | Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Counter Block Separator and Decimal Settings |
Medium 6.4 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0204 |
Getwid | Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Hotspot Block |
Medium 6.4 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0203 |
Getwid | Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Block Marker Description |
Medium 6.4 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0202 |
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter |
Medium 6.1 |
3.6.2 |
| 2026-10-01 |
WPSEC-2026-0201 |
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Unauthenticated Sensitive Information Exposure via Smart Tags in Submitted Form Field Values |
Low 3.7 |
3.6.2 |
| 2026-10-01 |
WPSEC-2026-0200 |
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Authenticated (Delegated+) Insecure Direct Object Reference via MCP Form and Entry Abilities |
Medium 6.3 |
3.6.2 |
| 2026-10-01 |
WPSEC-2026-0199 |
LearnPress | LearnPress <= 4.4.7 - Reflected Cross-Site Scripting via 'orderby' Parameter |
Medium 6.1 |
4.4.8 |
| 2026-10-01 |
WPSEC-2026-0198 |
All-In-One Security (AIOS) – Security and Firewall | All-In-One Security (AIOS) – Security and Firewall <= 5.4.9 - Unauthenticated Login Lockout Bypass via Unlock Request |
Low 3.7 |
5.4.10 |
| 2026-10-01 |
WPSEC-2026-0197 |
Events Manager | Events Manager <= 7.4.3 - Unauthenticated User Interface Misrepresentation via 'client_name' Parameter on OAuth Consent Screen |
Medium 4.3 |
7.4.4 |
| 2026-10-01 |
WPSEC-2026-0196 |
Events Manager | Events Manager <= 7.4.3 - Unauthenticated Insecure Direct Object Reference to Booking Timeslot Capacity Bypass |
Medium 5.3 |
7.4.4 |
| 2026-10-01 |
WPSEC-2026-0195 |
Events Manager | Events Manager <= 7.4.3 - Unauthenticated Sensitive Information Exposure via Password-Protected Events in REST API and iCal Feed |
Medium 5.3 |
7.4.4 |
| 2026-10-01 |
WPSEC-2026-0194 |
Events Manager | Events Manager <= 7.4.3 - Authenticated (Author+) Insecure Direct Object Reference via REST API Media Endpoint |
Medium 4.3 |
7.4.4 |
| 2026-10-01 |
WPSEC-2026-0193 |
Kadence Blocks | Kadence Blocks <= 3.7.10 - Unauthenticated HTML Injection in Form Notification Emails via Uploaded File Name |
Medium 4.3 |
3.7.11 |
| 2026-10-01 |
WPSEC-2026-0192 |
Plugin for Google Reviews | Plugin for Google Reviews <= 7.1 - Unauthenticated Sensitive Information Exposure via Business Photo URL |
Low 3.7 |
7.1.1 |
| 2026-10-01 |
WPSEC-2026-0191 |
Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) | Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) <= 3.7.0 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via AJAX REST Fallback |
Medium 4.3 |
3.7.1 |
| 2026-10-01 |
WPSEC-2026-0190 |
Essential Blocks | Essential Blocks <= 6.4.3 - Unauthenticated Denial of Service via Post Grid Pagination |
Medium 5.3 |
6.4.4 |
| 2026-10-01 |
WPSEC-2026-0189 |
Essential Blocks | Essential Blocks <= 6.4.3 - Authenticated (Contributor+) Sensitive Information Exposure via Post Grid Block 'featuredPostId' Attribute |
Medium 4.3 |
6.4.4 |
| 2026-10-01 |
WPSEC-2026-0188 |
Spam protection, Honeypot, Anti-Spam by CleanTalk | Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.87 - Unauthenticated Stored Cross-Site Scripting via Contact Encoder Shortcode Placeholders |
Medium 5.4 |
6.88 |
| 2026-10-01 |
WPSEC-2026-0187 |
Fluent Forms | Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Global Settings Endpoint |
Medium 4.9 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0186 |
Fluent Forms | Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Stored Cross-Site Scripting via Form Field Attributes and Payment Option Labels |
Medium 6.4 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0185 |
Fluent Forms | Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Cross-Form Entry Modification, Deletion and Disclosure via 'entry_id' Parameter |
Medium 4.7 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0184 |
Fluent Forms | Fluent Forms <= 6.2.13 - Unauthenticated Payment Amount Manipulation via Omitted Payment Inputs and Negative Custom Subscription Amounts |
Medium 5.3 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0183 |
Fluent Forms | Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Embedded Post Author Smartcodes |
Medium 4.9 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0182 |
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.6 - Authenticated (Author+) Limited Server-Side Request Forgery via Image Sideload Endpoints |
Low 3.5 |
4.7.7 |
