| 2026-10-01 |
WPSEC-2026-0181 |
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.6 - Authenticated (Contributor+) Missing Authorization to Template Data Request and CartFlows, Cart Abandonment Recovery and LatePoint Data Import |
Medium 5.4 |
4.7.7 |
| 2026-10-01 |
WPSEC-2026-0180 |
Cookie Notice & Compliance for GDPR / CCPA | Cookie Notice & Compliance for GDPR / CCPA <= 3.1.9 - Authenticated (Administrator+) Missing Authorization to Network-Wide Settings Modification |
Medium 5.8 |
3.1.10 |
| 2026-10-01 |
WPSEC-2026-0179 |
Cookie Notice & Compliance for GDPR / CCPA | Cookie Notice & Compliance for GDPR / CCPA <= 3.1.9 - Authenticated (Administrator+) Privilege Escalation via 'cn_network' Parameter |
Medium 6.8 |
3.1.10 |
| 2026-10-01 |
WPSEC-2026-0178 |
WooCommerce | WooCommerce <= 11.1.0 - Authenticated (Shop Manager+) Privilege Escalation via Mobile App QR Login Token Generation |
Low 3.8 |
11.1.1 |
| 2026-10-01 |
WPSEC-2026-0177 |
WooCommerce | WooCommerce <= 11.1.0 - REST API Key Scope Bypass via Non-REST Requests |
Medium 4.2 |
11.1.1 |
| 2026-10-01 |
WPSEC-2026-0176 |
GPTranslate | GPTranslate <= 2.34.11 - Unauthenticated Stored Cross-Site Scripting via Translated Image, Iframe and Video Attributes |
Medium 5.4 |
2.34.12 |
| 2026-10-01 |
WPSEC-2026-0175 |
PPWP – Password Protect Pages | PPWP – Password Protect Pages <= 1.9.25 - Unauthenticated Sensitive Information Exposure via Predictable Auto-Generated Page Password |
Low 3.7 |
1.9.26 |
| 2026-10-01 |
WPSEC-2026-0174 |
WPFunnels | WPFunnels <= 3.13.1 - Reflected Cross-Site Scripting via 'per_page' Parameter |
Medium 6.1 |
3.13.2 |
| 2026-10-01 |
WPSEC-2026-0173 |
WPFunnels | WPFunnels <= 3.13.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Bump Settings |
Medium 6.4 |
3.13.2 |
| 2026-10-01 |
WPSEC-2026-0172 |
Charitable | Charitable <= 1.8.12.3 - Unauthenticated Reflected Cross-Site Scripting via Donate Button Shortcode |
Medium 6.1 |
1.8.13 |
| 2026-10-01 |
WPSEC-2026-0171 |
Charitable | Charitable <= 1.8.12.3 - Authenticated (Subscriber+) Limited File Upload via 'charitable_plupload_image_upload' AJAX Action |
Medium 4.3 |
1.8.13 |
| 2026-10-01 |
WPSEC-2026-0170 |
Charitable | Charitable <= 1.8.12.3 - Authenticated (Contributor+) Sensitive Information Exposure via 'charitable_campaign_preview' Parameter |
Medium 4.3 |
1.8.13 |
| 2026-10-01 |
WPSEC-2026-0169 |
WP Visitor Statistics (Real Time Traffic) | WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated Second-Order SQL Injection via fullRef Parameter |
Medium 6.5 |
8.7.1 |
| 2026-10-01 |
WPSEC-2026-0168 |
Visitor Traffic Real Time Statistics | Visitor Traffic Real Time Statistics < 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' and Forwarded-IP HTTP Headers |
High 7.2 |
8.16 |
| 2026-10-01 |
WPSEC-2026-0167 |
Image Photo Gallery Final Tiles Grid | Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Configuration 'script' Field |
Medium 6.4 |
3.6.14 |
| 2026-10-01 |
WPSEC-2026-0166 |
Image Photo Gallery Final Tiles Grid | Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Insecure Direct Object Reference to Gallery, Image and Post Meta Modification |
Medium 4.3 |
3.6.14 |
| 2026-10-01 |
WPSEC-2026-0165 |
Image Photo Gallery Final Tiles Grid | Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
Medium 6.4 |
3.6.14 |
| 2026-10-01 |
WPSEC-2026-0164 |
Jeg Kit for Elementor | Jeg Kit for Elementor <= 3.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-item-indicator' Attribute |
Medium 6.4 |
3.2.20 |
| 2026-10-01 |
WPSEC-2026-0163 |
Jeg Kit for Elementor | Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comments |
High 7.2 |
3.2.20 |
| 2026-10-01 |
WPSEC-2026-0162 |
Salon booking system | Salon booking system <= 10.31.6 - Authenticated (Salon Staff+) Stored Cross-Site Scripting via Customer Notes |
Medium 5.5 |
10.31.7 |
| 2026-10-01 |
WPSEC-2026-0161 |
Ecomail | Ecomail <= 2.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Email Newsletter Subscription Changes via 'ecmid' Parameter |
Medium 4.3 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0160 |
Ecomail | Ecomail <= 2.4.3 - Cross-Site Request Forgery to Bulk Data Synchronization and List Refresh |
Medium 4.3 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0159 |
Ecomail | Ecomail <= 2.4.3 - Authenticated (Contributor+) Missing Authorization to Bulk Data Synchronization and List Refresh |
Medium 4.3 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0158 |
Ecomail | Ecomail <= 2.4.3 - Unauthenticated Missing Authorization to Arbitrary Cart Tracking Events via 'email' Parameter |
Medium 5.3 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0157 |
Ecomail | Ecomail <= 2.4.3 - Missing Authorization to Subscription Status Modification via Webhook REST Endpoint |
Medium 6.5 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0156 |
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
Medium 6.4 |
4.2.16 |
| 2026-10-01 |
WPSEC-2026-0155 |
Video Conferencing with Zoom | Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Missing Authorization to Zoom Host and Meeting Disclosure via Block Editor AJAX Actions |
Medium 4.3 |
4.6.11 |
| 2026-10-01 |
WPSEC-2026-0154 |
Video Conferencing with Zoom | Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Missing Authorization to Sensitive Information Exposure via 'get_assign_host_id' AJAX Action |
Medium 4.3 |
4.6.11 |
| 2026-10-01 |
WPSEC-2026-0153 |
Web-Art Login Shield with reCAPTCHA | Web-Art Login Shield with reCAPTCHA <= 1.2.2 - Unauthenticated reCAPTCHA and Login Protect Bypass via 'action' Parameter |
Medium 5.3 |
1.2.3 |
| 2026-10-01 |
WPSEC-2026-0152 |
Web-Art Login Shield with reCAPTCHA | Web-Art Login Shield with reCAPTCHA <= 1.2.2 - Unauthenticated Login Protect Bypass via Race Condition |
Low 3.7 |
1.2.3 |
| 2026-10-01 |
WPSEC-2026-0151 |
Frontend File Manager & Sharing – User Private Files | Frontend File Manager & Sharing – User Private Files <= 2.1.9 - Unauthenticated Sensitive Information Exposure via Attachment Pages |
Medium 5.3 |
2.2.0 |
| 2026-10-01 |
WPSEC-2026-0150 |
Frontend File Manager & Sharing – User Private Files | Frontend File Manager & Sharing – User Private Files <= 2.1.9 - Unauthenticated Sensitive Information Exposure via Direct Access to Private Files |
Medium 5.9 |
2.2.0 |
| 2026-10-01 |
WPSEC-2026-0149 |
Document Engine | Document Engine <= 1.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via PDF Viewer Block |
Medium 4.3 |
2.0.0 |
| 2026-10-01 |
WPSEC-2026-0148 |
Document Engine | Document Engine <= 1.3 - Authenticated (Author+) Server-Side Request Forgery via Post to PDF Images |
Medium 5.0 |
2.0.0 |
| 2026-10-01 |
WPSEC-2026-0147 |
Document Engine | Document Engine <= 1.3 - Unauthenticated Sensitive Information Exposure via Post to PDF Export |
Medium 5.3 |
2.0.0 |
| 2026-10-01 |
WPSEC-2026-0146 |
CoCart – Headless REST API for WooCommerce | CoCart – Headless REST API for WooCommerce <= 4.9.6 - Cross-Site Request Forgery via REST API Nonce Verification Bypass |
High 8.8 |
4.9.7 |
| 2026-10-01 |
WPSEC-2026-0145 |
EazyDocs | EazyDocs <= 2.14.0 - Login Cross-Site Request Forgery via Google Login Callback |
Medium 4.3 |
2.14.1 |
| 2026-10-01 |
WPSEC-2026-0144 |
EazyDocs | EazyDocs <= 2.14.0 - Unauthenticated Authentication Bypass via Google Login |
High 8.1 |
2.14.1 |
| 2026-10-01 |
WPSEC-2026-0143 |
EazyDocs | EazyDocs <= 2.14.0 - Missing Authorization to Unauthenticated Analytics Table Schema Update |
Medium 5.3 |
2.14.1 |
| 2026-10-01 |
WPSEC-2026-0142 |
Directorist: AI-Powered Business Directory, Listings & Classified Ads | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.9.6 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via Listing Renewal |
Low 3.1 |
8.10 |
| 2026-10-01 |
WPSEC-2026-0141 |
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG and XML File Uploads |
Medium 6.4 |
4.7.8 |
| 2026-10-01 |
WPSEC-2026-0140 |
Coming Soon & Maintenance Mode by Colorlib | Coming Soon & Maintenance Mode by Colorlib <= 1.4.0 - Unauthenticated Sensitive Information Exposure via Comment Form Redirect |
Medium 5.3 |
1.4.1 |
| 2026-10-01 |
WPSEC-2026-0139 |
GPTranslate | GPTranslate <= 2.34.10 - Unauthenticated Stored Cross-Site Scripting via Translation Values |
High 7.2 |
2.34.11 |
| 2026-10-01 |
WPSEC-2026-0138 |
Bus Ticket Booking with Seat Reservation | Bus Ticket Booking with Seat Reservation < 5.9.5 - Missing Authorization to Booking Billing Details Modification via wbtm_standalone_checkout_pay AJAX Action |
Medium 6.5 |
5.9.5 |
| 2026-10-01 |
WPSEC-2026-0137 |
Bus Ticket Booking with Seat Reservation | Bus Ticket Booking with Seat Reservation < 5.9.5 - Unauthenticated Insecure Direct Object Reference to Booking Cancellation and Status Manipulation via Payment Return Handler |
Medium 6.5 |
5.9.5 |
| 2026-10-01 |
WPSEC-2026-0136 |
Scheduling Plugin – Online Booking for WordPress | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Authenticated (Subscriber+) Missing Authorization to Account Connection and Plugin Settings Modification |
Medium 5.4 |
3.5.18 |
| 2026-10-01 |
WPSEC-2026-0135 |
Scheduling Plugin – Online Booking for WordPress | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Missing Authorization to Account Disconnection |
Medium 6.5 |
3.5.18 |
| 2026-10-01 |
WPSEC-2026-0134 |
Scheduling Plugin – Online Booking for WordPress | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
Medium 6.4 |
3.5.18 |
| 2026-10-01 |
WPSEC-2026-0133 |
Scheduling Plugin – Online Booking for WordPress | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Unauthenticated Authorization Bypass to Admin-Scoped REST API Proxy |
High 8.2 |
3.5.18 |
| 2026-10-01 |
WPSEC-2026-0132 |
Simple Gallery with Filter | Simple Gallery with Filter < 2.4.1 - Cross-Site Request Forgery to Image Caption Modification |
Medium 4.3 |
2.4.1 |
| 2026-10-01 |
WPSEC-2026-0131 |
Video Conferencing with BigBlueButton (BBB) | Video Conferencing with BigBlueButton (BBB) <= 3.2.0 - Unauthenticated Open Redirect via 'current_page' Parameter |
Medium 6.1 |
3.2.15 |
| 2026-10-01 |
WPSEC-2026-0130 |
HT Easy GA4 ( Google Analytics 4 ) | HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Missing Authorization to Unauthenticated Secret Key Update and Cache Deletion |
Medium 6.5 |
1.9.5 |
| 2026-10-01 |
WPSEC-2026-0129 |
HT Easy GA4 ( Google Analytics 4 ) | HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Cross-Site Request Forgery to Google Account Connection and Logout |
Medium 5.4 |
1.9.5 |
| 2026-10-01 |
WPSEC-2026-0128 |
HT Easy GA4 ( Google Analytics 4 ) | HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Unauthenticated Insecure Direct Object Reference to Order Data Exposure via 'order' Parameter |
Medium 5.3 |
1.9.5 |
| 2026-10-01 |
WPSEC-2026-0127 |
UiChemy | UiChemy <= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Import |
Medium 6.4 |
5.2.3 |
| 2026-10-01 |
WPSEC-2026-0126 |
UiChemy | UiChemy <= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Composer Section Code |
Medium 6.4 |
5.2.3 |
| 2026-10-01 |
WPSEC-2026-0125 |
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.6 - Unauthenticated reCAPTCHA Bypass via Inline Payment Forms |
Medium 5.3 |
8.5.7 |
| 2026-10-01 |
WPSEC-2026-0124 |
Better Messages | Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure of Hidden Chat Room Participants via 'getChatRooms' REST Endpoint |
Medium 4.3 |
3.0.12 |
| 2026-10-01 |
WPSEC-2026-0123 |
Better Messages | Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure via Favorites Page |
Medium 4.3 |
3.0.12 |
| 2026-10-01 |
WPSEC-2026-0122 |
Better Messages | Better Messages <= 3.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting via End-to-End Encrypted Messages |
Medium 6.4 |
3.0.12 |
| 2026-10-01 |
WPSEC-2026-0121 |
Five Star Restaurant Reservations | Five Star Restaurant Reservations <= 2.7.24 - Unauthenticated Sensitive Information Exposure via View Bookings Form |
Medium 5.3 |
2.8.0 |
| 2026-10-01 |
WPSEC-2026-0120 |
WP User Avatars | WP User Avatars <= 1.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Assignment via assign_wp_user_avatars_media AJAX Action |
Medium 4.3 |
2.0.0 |
| 2026-10-01 |
WPSEC-2026-0119 |
Advanced Shipment Tracking for WooCommerce | Advanced Shipment Tracking for WooCommerce <= 4.0.3 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure via ast_email_preview AJAX Action |
Medium 4.3 |
4.0.4 |
| 2026-10-01 |
WPSEC-2026-0118 |
WP Ghost (Hide My WP Ghost) | WP Ghost (Hide My WP Ghost) <= 7.0.11 - Unauthenticated Login CAPTCHA Bypass via 'woocommerce-login-nonce' Parameter |
Medium 5.3 |
7.0.12 |
| 2026-10-01 |
WPSEC-2026-0117 |
CMB2 | CMB2 <= 2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Field Display Values |
Medium 6.4 |
2.13.2 |
| 2026-10-01 |
WPSEC-2026-0116 |
DoFollow Case by Case | DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Link Attributes |
High 7.2 |
3.6.1 |
| 2026-10-01 |
WPSEC-2026-0115 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Subscriber+) Missing Authorization to Marketplace-Wide WooCommerce REST API Access |
High 8.8 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0114 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Missing Authorization to Withdrawal Approval and Balance Bypass |
Medium 6.5 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0113 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Missing Authorization to Marketplace Module Activation and Deactivation |
Medium 5.4 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0112 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Customer+) Insecure Direct Object Reference to Refund Request on Arbitrary Orders |
Medium 4.3 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0111 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Subscriber+) Privilege Escalation via Store REST Endpoint Admin-Only Fields |
Medium 6.5 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0110 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Cross-Store Follower Information Disclosure via FollowStore REST Endpoint |
Medium 4.3 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0109 |
Mihdan: No External Links | Mihdan: No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Redirect Logs |
Medium 5.4 |
5.3.0 |
| 2026-10-01 |
WPSEC-2026-0108 |
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.20 - Unauthenticated Sensitive Information Exposure via Product REST API Endpoints |
Medium 5.3 |
3.0.21 |
| 2026-10-01 |
WPSEC-2026-0107 |
Export All Posts, Products, Orders, Refunds & Users | Export All Posts, Products, Orders, Refunds & Users <= 3.0 - Unauthenticated Sensitive Information Exposure via Debug Log File |
Medium 5.3 |
3.1 |
| 2026-10-01 |
WPSEC-2026-0106 |
WP Ultimate CSV Importer | WP Ultimate CSV Importer <= 9.1 - Unauthenticated Sensitive Information Exposure via Import Files and Logs |
Low 3.7 |
9.2 |
| 2026-10-01 |
WPSEC-2026-0105 |
WP Ultimate CSV Importer | WP Ultimate CSV Importer <= 9.1 - Unauthenticated Sensitive Information Exposure via Single Post CSV Export |
Medium 5.3 |
9.2 |
| 2026-10-01 |
WPSEC-2026-0104 |
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Contact Field Smartcodes in Fluent Forms |
Medium 5.4 |
3.2.5 |
| 2026-10-01 |
WPSEC-2026-0103 |
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.0 - Authenticated (Custom Contact-Read Access) Sensitive Information Exposure via Contact Email History |
Medium 4.3 |
3.2.5 |
| 2026-10-01 |
WPSEC-2026-0102 |
Forms | Forms <= 3.0.1 - Reflected Cross-Site Scripting via Form Field Parameters |
Medium 6.1 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0101 |
Forms | Forms <= 3.0.1 - Authenticated (Contributor+) Missing Authorization to Forms and Submissions Access |
Medium 5.4 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0100 |
Forms | Forms <= 3.0.1 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values |
High 7.2 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0099 |
Forms | Forms <= 3.0.1 - Unauthenticated Information Exposure of Submitter IP Addresses via REST API |
Medium 5.3 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0098 |
SureDash | SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Name Fields |
Medium 6.4 |
1.12.1 |
| 2026-10-01 |
WPSEC-2026-0097 |
Five Star Restaurant Menu | Five Star Restaurant Menu <= 2.5.4 - Unauthenticated Price Manipulation via Cart Item Data |
Medium 5.3 |
2.6.0 |
| 2026-10-01 |
WPSEC-2026-0096 |
Five Star Restaurant Menu | Five Star Restaurant Menu <= 2.5.4 - Unauthenticated Payment Bypass via Order Submission and Payment Handlers |
Medium 5.3 |
2.6.0 |
| 2026-10-01 |
WPSEC-2026-0095 |
Five Star Restaurant Menu | Five Star Restaurant Menu <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_prostyle' Shortcode Attribute |
Medium 6.4 |
2.6.0 |
| 2026-10-01 |
WPSEC-2026-0094 |
Five Star Restaurant Menu | Five Star Restaurant Menu <= 2.5.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Overwrite via Menu Item Import |
Medium 5.4 |
2.6.0 |
| 2026-10-01 |
WPSEC-2026-0093 |
Product Feed PRO for WooCommerce | Product Feed PRO for WooCommerce <= 13.5.7 - Missing Authorization to Authenticated (Subscriber+) Shipping Zone Disclosure |
Medium 4.3 |
13.5.8 |
| 2026-10-01 |
WPSEC-2026-0092 |
Product Feed PRO for WooCommerce | Product Feed PRO for WooCommerce <= 13.5.7 - Authenticated (Shop Manager+) PHP Object Injection via Product Attribute Meta |
High 7.2 |
13.5.8 |
| 2026-10-01 |
WPSEC-2026-0091 |
Captivate Sync | Captivate Sync <= 3.3.2 - Authenticated (Editor+) SQL Injection via Episode Duplication |
Medium 4.9 |
3.3.3 |
| 2026-10-01 |
WPSEC-2026-0090 |
Five Star Business Profile and Schema | Five Star Business Profile and Schema <= 2.3.21 - Authenticated (Author+) Sensitive Information Exposure via Schema Rule Field Defaults |
Medium 6.5 |
2.4.0 |
| 2026-10-01 |
WPSEC-2026-0089 |
Pie Register | Pie Register <= 3.8.4.13 - Missing Authorization to Unauthenticated User Email Disclosure via 'invitaion_code' Parameter |
Medium 5.3 |
3.8.4.14 |
| 2026-10-01 |
WPSEC-2026-0088 |
BA Book Everything | BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via Service Quantity |
High 7.2 |
1.8.29 |
| 2026-10-01 |
WPSEC-2026-0087 |
LA-Studio Element Kit for Elementor | LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Subscriber+) Missing Authorization to Screenshot Creation and Deletion |
Medium 4.3 |
1.6.3 |
| 2026-10-01 |
WPSEC-2026-0086 |
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Authenticated (Author+) Insecure Direct Object Reference to Arbitrary Attachment File Rename |
Medium 4.3 |
3.2.2 |
| 2026-10-01 |
WPSEC-2026-0085 |
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Missing Authorization to Authenticated (Contributor+) Folder Assignment Modification of Arbitrary Posts |
Medium 4.3 |
3.2.2 |
| 2026-10-01 |
WPSEC-2026-0084 |
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Authenticated (Author+) Arbitrary File Upload via Media Replace |
High 8.8 |
3.2.2 |
| 2026-10-01 |
WPSEC-2026-0083 |
WP Document Revisions | WP Document Revisions <= 5.4.5 - Authenticated (Contributor+) Sensitive Information Exposure via Document List Shortcode, Blocks and get_documents() |
Medium 4.3 |
5.4.6 |
| 2026-10-01 |
WPSEC-2026-0082 |
WP Document Revisions | WP Document Revisions <= 5.4.5 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Attachment Rename and Deletion via Validate Structure Fix Endpoint |
Medium 5.4 |
5.4.6 |
