| 2026-10-21 |
WPSEC-2026-1381 |
Booking Package | Booking Package <= 1.7.32 - Unauthenticated Verification Code Bypass |
Medium 5.3 |
1.7.33 |
| 2026-10-21 |
WPSEC-2026-1380 |
Booking Package | Booking Package <= 1.7.32 - Unauthenticated Price Manipulation via Hotel Room Amounts and Cross-Calendar Services |
Medium 5.3 |
1.7.33 |
| 2026-10-21 |
WPSEC-2026-1379 |
Booking Package | Booking Package <= 1.7.32 - Unauthenticated Payment Bypass via Stripe Payment Amount Mismatch and Payment Reuse |
Medium 5.3 |
1.7.33 |
| 2026-10-21 |
WPSEC-2026-1378 |
WP Booking System | WP Booking System <= 2.1.0.4 - Authenticated (Subscriber+) Missing Authorization to Booking Modification via AJAX Actions |
Medium 5.4 |
2.1.0.5 |
| 2026-10-21 |
WPSEC-2026-1377 |
Seriously Simple Podcasting | Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via podcast_playlist Shortcode 'type' Attribute |
Medium 6.4 |
3.17.1 |
| 2026-10-21 |
WPSEC-2026-1376 |
Seriously Simple Podcasting | Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Sensitive Information Exposure of Private and Draft Posts via podcast_episode Shortcode |
Medium 4.3 |
3.17.1 |
| 2026-10-21 |
WPSEC-2026-1375 |
Seriously Simple Podcasting | Seriously Simple Podcasting <= 3.17.0 - Unauthenticated Missing Authorization to Edit-Context Episode Data via REST API |
Medium 5.3 |
3.17.1 |
| 2026-10-21 |
WPSEC-2026-1374 |
Seriously Simple Podcasting | Seriously Simple Podcasting <= 3.17.0 - Unauthenticated Sensitive Information Exposure of Password-Protected Episode Media via REST API and Playlist AJAX |
Medium 5.3 |
3.17.1 |
| 2026-10-21 |
WPSEC-2026-1373 |
Speed Optimizer | Speed Optimizer <= 7.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via DNS Prefetch and Font Preload URLs |
Medium 4.4 |
7.8.5 |
| 2026-10-21 |
WPSEC-2026-1372 |
Speed Optimizer | Speed Optimizer <= 7.8.4 - Authenticated (Administrator+) Missing Authorization to Network Option Update via Enable/Disable Option REST Routes |
Low 2.2 |
7.8.5 |
| 2026-10-21 |
WPSEC-2026-1371 |
Kadence Blocks | Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Typed Text |
Medium 6.4 |
3.8.0.1 |
| 2026-10-21 |
WPSEC-2026-1370 |
Kadence Blocks | Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up Block Prefix, Suffix and Separator |
Medium 6.4 |
3.8.0.1 |
| 2026-10-21 |
WPSEC-2026-1369 |
Kadence Blocks | Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar Block Number Prefix and Suffix |
Medium 6.4 |
3.8.0.1 |
| 2026-10-21 |
WPSEC-2026-1368 |
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing | Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing <= 1.70.0 - Unauthenticated Full Path Disclosure via Google Tag Gateway Proxy Configuration File |
Low 3.7 |
1.71.0 |
| 2026-10-21 |
WPSEC-2026-1367 |
We’re Open! | We’re Open! <= 2.6 - Unauthenticated Reflected Cross-Site Scripting via 'content' Parameter |
Medium 6.1 |
2.7 |
| 2026-10-21 |
WPSEC-2026-1366 |
Logo and Address Widget with Schema | Logo and Address Widget with Schema <= 2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget Title and Address Fields |
Medium 4.4 |
3.0 |
| 2026-10-21 |
WPSEC-2026-1365 |
Team Manager | Team Manager <= 2.6.8 - Unauthenticated Sensitive Information Exposure via Debug Log File |
Low 3.7 |
2.6.9 |
| 2026-10-21 |
WPSEC-2026-1364 |
Team Manager | Team Manager <= 2.6.8 - Authenticated (Contributor+) CSS Injection via 'bg_color' and 'social_color' Shortcode Attributes |
Medium 5.0 |
2.6.9 |
| 2026-10-21 |
WPSEC-2026-1363 |
Business Directory Plugin – Easy Listing & Member Directories for WordPress | Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.28 - Authenticated (Administrator+) Arbitrary File Upload via Directory Theme Upload |
Medium 6.6 |
6.4.29 |
| 2026-10-21 |
WPSEC-2026-1362 |
Internal Links Manager | Internal Links Manager <= 3.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Link URL and Keywords |
Medium 4.4 |
3.2.0 |
| 2026-10-21 |
WPSEC-2026-1361 |
Super Progressive Web Apps | Super Progressive Web Apps <= 2.2.48.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Pre-Caching URLs Setting |
Medium 4.4 |
2.2.49 |
| 2026-10-21 |
WPSEC-2026-1360 |
Otter Blocks | Otter Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content Magic Tags |
Medium 6.4 |
3.2.8 |
| 2026-10-21 |
WPSEC-2026-1359 |
Otter Blocks | Otter Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Atomic Wind CSS |
Medium 6.4 |
3.2.8 |
| 2026-10-21 |
WPSEC-2026-1358 |
Otter Blocks | Otter Blocks <= 3.2.7 - Unauthenticated Sensitive Information Exposure via otter/v1/dynamic REST Endpoint |
Medium 5.3 |
3.2.8 |
| 2026-10-21 |
WPSEC-2026-1357 |
Otter Blocks | Otter Blocks <= 3.2.7 - Unauthenticated Block Visibility Conditions Bypass via REST API |
Medium 5.3 |
3.2.8 |
| 2026-10-21 |
WPSEC-2026-1356 |
User Profile Builder | User Profile Builder <= 4.0.4 - Authenticated (Administrator+) Privilege Escalation via Front-End Edit Profile Form on Multisite |
High 8.0 |
4.0.5 |
| 2026-10-21 |
WPSEC-2026-1355 |
User Profile Builder | User Profile Builder <= 4.0.4 - Authenticated (Editor+) Privilege Escalation via Registration Form 'role' Attribute |
Medium 5.9 |
4.0.5 |
| 2026-10-21 |
WPSEC-2026-1354 |
User Profile Builder | User Profile Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute |
Medium 5.4 |
4.0.5 |
| 2026-10-21 |
WPSEC-2026-1353 |
User Profile Builder | User Profile Builder <= 4.0.4 - Authenticated (Subscriber+) CAPTCHA Bypass via REST API and XML-RPC Comments |
Medium 4.3 |
4.0.5 |
| 2026-10-21 |
WPSEC-2026-1352 |
Popup Builder | Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Popup Trashing |
Medium 5.3 |
4.4.6 |
| 2026-10-21 |
WPSEC-2026-1351 |
Popup Builder | Popup Builder <= 4.4.5 - Unauthenticated Stored Cross-Site Scripting via Subscription Form Name Fields |
High 7.2 |
4.4.6 |
| 2026-10-21 |
WPSEC-2026-1350 |
Ajax Search Lite | Ajax Search Lite <= 4.14.6 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Images |
Medium 5.3 |
4.14.7 |
| 2026-10-21 |
WPSEC-2026-1349 |
Ajax Search Lite | Ajax Search Lite <= 4.14.6 - Unauthenticated SQL Injection via Search Phrase |
High 7.5 |
4.14.7 |
| 2026-10-21 |
WPSEC-2026-1348 |
Download Monitor | Download Monitor <= 5.3.4 - Authenticated (Administrator+) Incorrect Authorization to Approved Download Paths Modification via REST API |
Medium 5.8 |
5.3.5 |
| 2026-10-21 |
WPSEC-2026-1347 |
Burst Statistics | Burst Statistics <= 3.7.2 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via REST Data Type Override |
Medium 4.3 |
3.7.3 |
| 2026-10-21 |
WPSEC-2026-1346 |
Burst Statistics | Burst Statistics <= 3.7.2 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via Report Share Links |
Medium 4.3 |
3.7.3 |
| 2026-10-21 |
WPSEC-2026-1345 |
Page Builder by SiteOrigin | Page Builder by SiteOrigin <= 2.37.0 - Authenticated (Contributor+) Sensitive Information Exposure via Post Loop Widget |
Medium 4.3 |
2.38.0 |
| 2026-10-21 |
WPSEC-2026-1344 |
Page Builder by SiteOrigin | Page Builder by SiteOrigin <= 2.37.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Class Name |
Medium 6.4 |
2.38.0 |
| 2026-10-21 |
WPSEC-2026-1343 |
Essential Addons for Elementor – Popular Elementor Templates & Widgets | Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.6 - Unauthenticated Administrator Approval Bypass via Email OTP Registration |
Medium 5.3 |
6.8.7 |
| 2026-10-21 |
WPSEC-2026-1342 |
Essential Addons for Elementor – Popular Elementor Templates & Widgets | Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.6 - Unauthenticated Sensitive Information Exposure via load_more AJAX Action |
Medium 5.3 |
6.8.7 |
| 2026-10-21 |
WPSEC-2026-1341 |
PayPlug for WooCommerce (Official) | PayPlug for WooCommerce (Official) <= 3.1.0 - Cross-Site Request Forgery to Payment Settings Change and PayPlug Account Connection via payplug_api REST Routes |
Medium 6.5 |
3.1.1 |
| 2026-10-21 |
WPSEC-2026-1340 |
PayPlug for WooCommerce (Official) | PayPlug for WooCommerce (Official) <= 3.1.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Deletion and Modification via Apple Pay AJAX Actions |
High 7.5 |
3.1.1 |
| 2026-10-21 |
WPSEC-2026-1339 |
PayPlug for WooCommerce (Official) | PayPlug for WooCommerce (Official) <= 3.1.0 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via check_payment and create_payment_intent |
Medium 6.5 |
3.1.1 |
| 2026-10-21 |
WPSEC-2026-1338 |
Newsletters | Newsletters <= 4.18.1 - Unauthenticated PHP Object Injection via Database Update Notice Dismissal |
High 8.1 |
4.18.2 |
| 2026-10-21 |
WPSEC-2026-1337 |
Newsletters | Newsletters <= 4.18.1 - Unauthenticated SQL Injection via Subscriber Management 'id' Parameter |
High 7.5 |
4.18.2 |
| 2026-10-21 |
WPSEC-2026-1336 |
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.72 - Authenticated (Vendor+) Stored Cross-Site Scripting via Excessive Vendor Capabilities |
Medium 6.4 |
2.1.80 |
| 2026-10-21 |
WPSEC-2026-1335 |
Surfer | Surfer <= 1.8.0.744 - Authenticated (Contributor+) Sensitive Information Exposure of Surfer API Key via Post Editor Script Data |
High 7.1 |
1.8.1.759 |
| 2026-10-21 |
WPSEC-2026-1334 |
WordLift | WordLift <= 3.54.17 - Unauthenticated Sensitive Information Exposure via Geomap AJAX Action |
Medium 5.3 |
3.54.18 |
| 2026-10-21 |
WPSEC-2026-1333 |
WordLift | WordLift <= 3.54.17 - Authenticated (Contributor+) Missing Authorization to Recipe Main Ingredient Update |
Medium 4.3 |
3.54.18 |
| 2026-10-21 |
WPSEC-2026-1332 |
WordLift | WordLift <= 3.54.17 - Authenticated (Contributor+) Sensitive Information Exposure via Related Posts AJAX Action |
Medium 4.3 |
3.54.18 |
| 2026-10-21 |
WPSEC-2026-1331 |
WordLift | WordLift <= 3.54.17 - Unauthenticated Sensitive Information Exposure via Chord AJAX Action |
Medium 5.3 |
3.54.18 |
| 2026-10-21 |
WPSEC-2026-1330 |
Optimole | Optimole <= 4.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes |
Medium 6.4 |
4.2.17 |
| 2026-10-21 |
WPSEC-2026-1329 |
CoDesigner WooCommerce Builder for Elementor | CoDesigner WooCommerce Builder for Elementor <= 4.41 - Unauthenticated Order Currency Manipulation via Currency Switcher |
Low 3.7 |
4.42 |
| 2026-10-21 |
WPSEC-2026-1328 |
CoDesigner WooCommerce Builder for Elementor | CoDesigner WooCommerce Builder for Elementor <= 4.41 - Missing Authorization to Unauthenticated Limited Plugin Installation via Setup Wizard |
Medium 5.3 |
4.42 |
| 2026-10-21 |
WPSEC-2026-1327 |
Interactive Content – H5P | Interactive Content – H5P <= 1.17.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Tags |
Medium 6.4 |
1.17.10 |
| 2026-10-21 |
WPSEC-2026-1326 |
ThumbPress | ThumbPress <= 6.9.1 - Authenticated (Contributor+) PHP Object Injection via Post Content and Post Meta |
High 7.1 |
6.10.0 |
| 2026-10-21 |
WPSEC-2026-1325 |
Better Messages | Better Messages <= 3.1.3 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'bmErrors' Parameter |
Medium 6.1 |
3.1.4 |
| 2026-10-21 |
WPSEC-2026-1324 |
2Way VideoCalls and Random Chat – HTML5 Webcam Videochat | 2Way VideoCalls and Random Chat – HTML5 Webcam Videochat <= 5.2.8 - Cross-Site Request Forgery to Call Room Deletion and Creation |
Medium 4.3 |
6.1.8 |
| 2026-10-21 |
WPSEC-2026-1323 |
On Page SEO + Whatsapp Chat Button | On Page SEO + Whatsapp Chat Button <= 2.0.3 - Cross-Site Request Forgery to robots.txt Modification |
Medium 4.3 |
2.0.4 |
| 2026-10-21 |
WPSEC-2026-1322 |
Easy Testimonial Slider and Form | Easy Testimonial Slider and Form <= 1.0.31 - Unauthenticated Path Traversal to Arbitrary File Deletion via 'oldcaptcha' Parameter |
High 8.2 |
1.0.32 |
| 2026-10-21 |
WPSEC-2026-1321 |
YITH WooCommerce Product Bundles | YITH WooCommerce Product Bundles <= 2.30.0 - Unauthenticated Price Manipulation via Bundled Item Cart Quantity Update |
Medium 5.3 |
2.30.1 |
| 2026-10-21 |
WPSEC-2026-1320 |
UiChemy | UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Composer Widget Slot Link Settings |
Medium 6.4 |
5.4.0 |
| 2026-10-21 |
WPSEC-2026-1319 |
Analytics Insights for Google Analytics 4 | Analytics Insights for Google Analytics 4 <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via Google Analytics Real-Time Report Data |
High 7.2 |
6.4 |
| 2026-10-21 |
WPSEC-2026-1318 |
Shipping for Nova Poshta | Shipping for Nova Poshta <= 1.19.8 - Reflected Cross-Site Scripting via 'invoice' Parameter |
Medium 6.1 |
1.19.9 |
| 2026-10-21 |
WPSEC-2026-1317 |
Mintpay | Mintpay <= 2.2.3 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation and Order Data Exposure |
Medium 6.5 |
3.0.0 |
| 2026-10-21 |
WPSEC-2026-1316 |
Bus Ticket Booking with Seat Reservation | Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Missing Authorization to Pending Booking Deletion and Modification via 'wbtm_prev_outbound_group_id' and 'wbtm_return_group_id' Parameters |
Medium 6.5 |
5.9.9 |
| 2026-10-21 |
WPSEC-2026-1315 |
Bus Ticket Booking with Seat Reservation | Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Insecure Direct Object Reference to Booking Details Disclosure via 'booking_id' Parameter |
Medium 5.3 |
5.9.9 |
| 2026-10-21 |
WPSEC-2026-1314 |
YITH PayPal Express Checkout for WooCommerce | YITH PayPal Express Checkout for WooCommerce <= 1.62.0 - Unauthenticated Insecure Direct Object Reference via PayPal Express Checkout Return 'order_id' and 'order_key' Parameters |
Medium 5.3 |
1.62.1 |
| 2026-10-21 |
WPSEC-2026-1313 |
WPCafe | WPCafe <= 3.0.22 - Unauthenticated Sensitive Information Exposure via Localized Plugin Settings |
Medium 5.3 |
3.0.23 |
| 2026-10-21 |
WPSEC-2026-1312 |
Open Graphite | Open Graphite <= 1.7.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Image Field |
Medium 6.4 |
2.0.0 |
| 2026-10-21 |
WPSEC-2026-1311 |
Knit Pay | Knit Pay <= 9.6.3.0 - Unauthenticated Insecure Direct Object Reference via PayPal Order Creation and Capture |
Medium 5.3 |
9.6.3.1 |
| 2026-10-21 |
WPSEC-2026-1310 |
VikRentCar Car Rental Management System | VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Email |
High 7.2 |
1.4.9 |
| 2026-10-21 |
WPSEC-2026-1309 |
VikRentCar Car Rental Management System | VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Path Traversal via Customer Details |
Low 3.7 |
1.4.9 |
| 2026-10-21 |
WPSEC-2026-1308 |
VikRentCar Car Rental Management System | VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Arbitrary File Deletion via Customer Document Deletion |
Medium 6.8 |
1.4.9 |
| 2026-10-21 |
WPSEC-2026-1307 |
VikRentCar Car Rental Management System | VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Multiple Administrative Actions |
Medium 4.3 |
1.4.9 |
| 2026-10-21 |
WPSEC-2026-1306 |
NEX-Forms – Ultimate Forms Plugin for WordPress | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data |
High 7.2 |
9.3.3 |
| 2026-10-21 |
WPSEC-2026-1305 |
Prime Mover – Backup and Migration | Prime Mover – Backup and Migration <= 2.2.1 - Unauthenticated PHP Object Injection via Stored Content Processed During Migration Search-Replace |
High 7.5 |
2.2.2 |
| 2026-10-21 |
WPSEC-2026-1304 |
Advanced Order Export For WooCommerce | Advanced Order Export For WooCommerce <= 4.1.3 - Authenticated (Shop Manager+) SQL Injection via 'limit' Parameter |
Medium 4.9 |
4.1.4 |
| 2026-10-21 |
WPSEC-2026-1303 |
PDF Invoices & Packing Slips for WooCommerce | PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Insecure Direct Object Reference to Order Document Disclosure via Document Shortcode |
Medium 5.9 |
5.16.5 |
| 2026-10-21 |
WPSEC-2026-1302 |
PDF Invoices & Packing Slips for WooCommerce | PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Order Address, Custom Field, and Note Values |
Medium 5.4 |
5.16.5 |
| 2026-10-21 |
WPSEC-2026-1301 |
Meta Box - WordPress Custom Fields Framework | Meta Box - WordPress Custom Fields Framework <= 5.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Editor Field |
Medium 6.4 |
5.15.3 |
| 2026-10-21 |
WPSEC-2026-1300 |
Meta Box - WordPress Custom Fields Framework | Meta Box - WordPress Custom Fields Framework <= 5.15.2 - Authenticated (Contributor+) Sensitive Information Exposure via Block Bindings |
Medium 6.5 |
5.15.3 |
| 2026-10-21 |
WPSEC-2026-1299 |
Meta Box - WordPress Custom Fields Framework | Meta Box - WordPress Custom Fields Framework <= 5.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Background Field |
Medium 6.4 |
5.15.3 |
| 2026-10-21 |
WPSEC-2026-1298 |
Leaky Paywall | Leaky Paywall <= 5.2.1 - Unauthenticated Sensitive Information Exposure via RSS Feeds |
Medium 5.3 |
5.3.0 |
| 2026-10-21 |
WPSEC-2026-1297 |
SureCookie | SureCookie <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-surecookie-restore' Attribute |
Medium 6.4 |
1.7.0 |
| 2026-10-21 |
WPSEC-2026-1296 |
Advanced Flat rate shipping Woocommerce | Advanced Flat rate shipping Woocommerce <= 1.6.6.17 - Cross-Site Request Forgery to Shipping Package Status Update |
Medium 4.3 |
1.6.6.19 |
| 2026-10-21 |
WPSEC-2026-1295 |
Gantry 5 Framework | Gantry 5 Framework <= 5.6.4 - Unauthenticated Sensitive Information Exposure via Detailed Debug Error Page |
Medium 5.3 |
5.6.5 |
| 2026-10-21 |
WPSEC-2026-1294 |
Link Library | Link Library <= 7.9.7 - Unauthenticated SQL Injection via Category Name |
Medium 5.9 |
7.10.0 |
| 2026-10-21 |
WPSEC-2026-1293 |
Link Library | Link Library <= 7.9.7 - Missing Authorization to Unauthenticated Link Submission Login Requirement Bypass |
Low 3.7 |
7.10.0 |
| 2026-10-21 |
WPSEC-2026-1292 |
WP Photo Album Plus | WP Photo Album Plus <= 9.3.04.002 - Cross-Site Request Forgery to Comment Management Actions |
Medium 4.3 |
9.3.04.003 |
| 2026-10-21 |
WPSEC-2026-1291 |
Debug Log Manager | Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via JavaScript Error Log Details |
High 7.2 |
2.5.3 |
| 2026-10-21 |
WPSEC-2026-1290 |
Disable payment method / COD fees for Order for WooCommerce | Disable payment method / COD fees for Order for WooCommerce <= 1.1.10.9 - Authenticated (Subscriber+) Missing Authorization to Usage Tracking Opt-In |
Medium 4.3 |
1.1.10.10 |
| 2026-10-21 |
WPSEC-2026-1289 |
SecuPress Free | SecuPress Free <= 2.7.1 - Unauthenticated Login Attempt Limit Bypass via Email Address Login |
Medium 5.3 |
2.7.2 |
| 2026-10-21 |
WPSEC-2026-1288 |
Event Manager and Tickets Selling Plugin for WooCommerce | Event Manager and Tickets Selling Plugin for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation via Shop Manager Capability Elevation |
High 7.2 |
5.7.9 |
| 2026-10-21 |
WPSEC-2026-1287 |
MasterStudy LMS WordPress Plugin – for Online Courses and Education | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.54 - Authenticated (Instructor+) Insecure Direct Object Reference to User Profile Name Modification via Manage Students |
Medium 4.3 |
3.7.55 |
| 2026-10-21 |
WPSEC-2026-1286 |
Brizy – Page Builder | Brizy – Page Builder <= 2.8.23 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
Medium 6.4 |
2.8.24 |
| 2026-10-21 |
WPSEC-2026-1285 |
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.7 - Authenticated (Subscriber+) Missing Authorization to Private Post Title Disclosure via Rank and Achievement Options AJAX Actions |
Medium 4.3 |
8.0.8 |
| 2026-10-21 |
WPSEC-2026-1284 |
Greenshift | Greenshift <= 13.2.1 - Unauthenticated Stored Cross-Site Scripting via Split Text Animations |
Medium 5.4 |
13.2.2 |
| 2026-10-21 |
WPSEC-2026-1283 |
Greenshift | Greenshift <= 13.2.1 - Unauthenticated Stored Cross-Site Scripting via Text Animated Element |
Medium 5.4 |
13.2.2 |
| 2026-10-21 |
WPSEC-2026-1282 |
Modula Image Gallery | Modula Image Gallery <= 3.0.13 - Authenticated (Contributor+) Missing Authorization to Gallery Duplication |
Medium 4.3 |
3.0.14 |
