| 2026-10-21 |
WPSEC-2026-1281 |
Advanced Custom Fields: Extended | Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Account Takeover via Update User Form Action |
High 8.1 |
0.9.2.8 |
| 2026-10-21 |
WPSEC-2026-1280 |
Advanced Custom Fields: Extended | Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary Attachment Deletion via Form Email Action |
Medium 4.8 |
0.9.2.8 |
| 2026-10-21 |
WPSEC-2026-1279 |
Advanced Custom Fields: Extended | Advanced Custom Fields: Extended <= 0.9.2.7 - Authenticated (Contributor+) Sensitive Information Exposure via acfe_form Shortcode Template Tags |
Medium 6.5 |
0.9.2.8 |
| 2026-10-21 |
WPSEC-2026-1278 |
Advanced Custom Fields: Extended | Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Template Tag Injection via Form Post and Term Actions |
Medium 5.9 |
0.9.2.8 |
| 2026-10-21 |
WPSEC-2026-1277 |
Strong Testimonials | Strong Testimonials <= 3.3.14 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Meta Modification |
Medium 4.3 |
3.3.15 |
| 2026-10-21 |
WPSEC-2026-1276 |
WooCommerce Menu Cart | WooCommerce Menu Cart <= 3.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Product Variation Attribute Values |
Medium 5.5 |
3.2.1 |
| 2026-10-21 |
WPSEC-2026-1275 |
RSS Aggregator by Feedzy | RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Item Excerpt |
Medium 5.4 |
5.2.13 |
| 2026-10-21 |
WPSEC-2026-1274 |
Dynamic Visibility for Elementor | Dynamic Visibility for Elementor <= 6.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Query Control |
Medium 6.4 |
6.0.7 |
| 2026-10-21 |
WPSEC-2026-1273 |
UpdraftPlus | UpdraftPlus <= 1.26.12 - Unauthenticated Continued Access via Unrevoked Compromised UpdraftCentral Keys |
High 8.1 |
1.26.13 |
| 2026-10-20 |
WPSEC-2026-1272 |
WP Mailster | WP Mailster <= 1.9.1.0 - Unauthenticated Stored Cross-Site Scripting via Email Subject and Body |
High 7.2 |
1.9.2.0 |
| 2026-10-20 |
WPSEC-2026-1271 |
WP Mailster | WP Mailster <= 1.9.1.0 - Unauthenticated Arbitrary File Upload via Email Attachment Filename |
Critical 9.8 |
1.9.2.0 |
| 2026-10-20 |
WPSEC-2026-1270 |
WP Mailster | WP Mailster <= 1.9.1.0 - Authenticated (Contributor+) Arbitrary File Read via CSV Import |
Medium 6.5 |
1.9.2.0 |
| 2026-10-20 |
WPSEC-2026-1269 |
Contest Gallery | Contest Gallery <= 34.0.1 - Unauthenticated Stored Cross-Site Scripting via Gallery Entry Attachment Title and Caption |
High 7.2 |
34.0.2 |
| 2026-10-20 |
WPSEC-2026-1268 |
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors | WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.2 - Missing Authorization to Unauthenticated Database Update Trigger |
Medium 5.3 |
2.7.3 |
| 2026-10-20 |
WPSEC-2026-1267 |
Better Messages | Better Messages <= 3.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery via Link Preview |
Medium 6.4 |
3.1.3 |
| 2026-10-20 |
WPSEC-2026-1266 |
Woo Swish e-commerce | Woo Swish e-commerce <= 3.7.8 - Unauthenticated Authentication Bypass to Payment Service Credential Injection via Legacy OAuth Callback |
Medium 6.5 |
3.7.9 |
| 2026-10-20 |
WPSEC-2026-1265 |
Woo Swish e-commerce | Woo Swish e-commerce <= 3.7.8 - Missing Authorization to Authenticated (Contributor+) Swish Service Connect and Disconnect |
Medium 5.4 |
3.7.9 |
| 2026-10-20 |
WPSEC-2026-1264 |
Mapster WP Maps | Mapster WP Maps <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Loader Color |
Medium 6.4 |
2.0.6 |
| 2026-10-20 |
WPSEC-2026-1263 |
Mapster WP Maps | Mapster WP Maps <= 2.0.5 - Missing Authorization to Unauthenticated Map Modification and Stored Cross-Site Scripting via save-mapmaker REST Endpoint |
High 7.2 |
2.0.6 |
| 2026-10-20 |
WPSEC-2026-1262 |
Bootstrap Shortcodes | Bootstrap Shortcodes <= 3.4.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Bundled Bootstrap Library Data Attributes |
Medium 6.4 |
3.4.6 |
| 2026-10-20 |
WPSEC-2026-1261 |
Bootstrap Shortcodes | Bootstrap Shortcodes <= 3.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bs_tcontent' Shortcode 'id' Attribute |
Medium 6.4 |
3.4.6 |
| 2026-10-20 |
WPSEC-2026-1260 |
YMC Filter | YMC Filter <= 3.12.20 - Unauthenticated Sensitive Information Exposure via Posts Filter Search |
Medium 5.3 |
3.12.21 |
| 2026-10-20 |
WPSEC-2026-1259 |
WP STAGING WordPress Backup Plugin – Migration Backup Restore | WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.17.0 - Unauthenticated Staging Site Login Protection Bypass via 'rest_route' Parameter |
Medium 6.5 |
4.18.0 |
| 2026-10-20 |
WPSEC-2026-1258 |
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 45.0 - Unauthenticated Missing Authorization to Graph Mailer Authorization Reset |
Medium 5.3 |
45.1 |
| 2026-10-20 |
WPSEC-2026-1257 |
Hyyan WooCommerce Polylang Integration | Hyyan WooCommerce Polylang Integration <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Translated Variation Deletion |
Medium 5.4 |
1.6.0 |
| 2026-10-20 |
WPSEC-2026-1256 |
Hyyan WooCommerce Polylang Integration | Hyyan WooCommerce Polylang Integration <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Translated Product Featured Status Modification |
Medium 4.3 |
1.6.0 |
| 2026-10-20 |
WPSEC-2026-1255 |
My Calendar | My Calendar <= 3.8.8 - Unauthenticated Sensitive Information Exposure via iCal Export |
Medium 5.3 |
3.8.9 |
| 2026-10-20 |
WPSEC-2026-1254 |
WebP Express | WebP Express <= 0.25.15 - Unauthenticated Stored Cross-Site Scripting via Alter HTML |
Medium 5.4 |
0.25.16 |
| 2026-10-20 |
WPSEC-2026-1253 |
WebP Express | WebP Express <= 0.25.15 - Unauthenticated Authentication Bypass in Web Service |
Medium 4.8 |
0.25.16 |
| 2026-10-20 |
WPSEC-2026-1252 |
Advanced Access Manager – Access Governance for WordPress | Advanced Access Manager – Access Governance for WordPress <= 8.0.1 - Authenticated (Administrator+) Authorization Bypass to Privilege Escalation via JWT REST Endpoints |
High 7.2 |
8.0.2 |
| 2026-10-20 |
WPSEC-2026-1251 |
WP-Members Membership Plugin | WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Missing Authorization to Membership Self-Assignment and Restricted Profile Field Update |
Medium 5.4 |
3.5.8 |
| 2026-10-20 |
WPSEC-2026-1250 |
WP Accessibility | WP Accessibility <= 2.4.3 - Unauthenticated Sensitive Information Exposure via 'longdesc' Parameter |
Medium 5.3 |
2.4.4 |
| 2026-10-19 |
WPSEC-2026-1249 |
SchedulePress | SchedulePress <= 5.3.4 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Publishing and Status Change via Elementor Schedule Modal |
Medium 5.4 |
5.3.5 |
| 2026-10-19 |
WPSEC-2026-1248 |
SchedulePress | SchedulePress <= 5.3.4 - Authenticated (Contributor+) Missing Authorization to Post Publishing and Scheduling via Post Panel and Calendar REST Endpoints |
Medium 4.3 |
5.3.5 |
| 2026-10-19 |
WPSEC-2026-1247 |
Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng | Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Missing Authorization to Unauthenticated Casso Account Disconnection |
Medium 6.5 |
4.2.0 |
| 2026-10-19 |
WPSEC-2026-1246 |
Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng | Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Missing Authorization to Casso Account Relinking via OAuth2 Callback |
High 8.2 |
4.2.0 |
| 2026-10-19 |
WPSEC-2026-1245 |
Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng | Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Unauthenticated Insecure Direct Object Reference to Order Status Disclosure |
Medium 5.3 |
4.2.0 |
| 2026-10-19 |
WPSEC-2026-1244 |
Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng | Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Unauthenticated Authentication Bypass to Order Payment Confirmation via Webhook |
Medium 5.9 |
4.2.0 |
| 2026-10-19 |
WPSEC-2026-1243 |
Classified Listing – AI-Powered Classified ads & Business Directory | Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description |
Medium 6.3 |
6.2.0 |
| 2026-10-19 |
WPSEC-2026-1242 |
Content Pilot | Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Imported Post Content |
Medium 5.4 |
2.2.5 |
| 2026-10-19 |
WPSEC-2026-1241 |
Content Pilot | Content Pilot <= 2.2.4 - Authenticated (Contributor+) Missing Authorization to Campaign Configuration and Campaign Data Deletion |
Medium 6.4 |
2.2.5 |
| 2026-10-19 |
WPSEC-2026-1240 |
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content |
High 7.2 |
4.7.3 |
| 2026-10-19 |
WPSEC-2026-1239 |
WP Ultimate Review | WP Ultimate Review <= 2.4.4 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email Field |
Medium 5.6 |
2.4.5 |
| 2026-10-19 |
WPSEC-2026-1238 |
Magical Addons For Elementor | Magical Addons For Elementor < 1.5.3 - Unauthenticated Sensitive Information Exposure via Mailchimp API Key |
Medium 5.3 |
1.5.3 |
| 2026-10-19 |
WPSEC-2026-1237 |
Display Post Types | Display Post Types <= 3.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Non-Public Post Types |
Medium 4.3 |
3.4.5 |
| 2026-10-18 |
WPSEC-2026-1236 |
WP AutoTerms | WP AutoTerms <= 3.0.7 - Unauthenticated DOM-Based Cross-Site Scripting via Cookie Consent Preview postMessage Handler |
Medium 6.1 |
3.0.8 |
| 2026-10-18 |
WPSEC-2026-1235 |
Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search | Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.311.0 - Unauthenticated Missing Authorization to AI Chat and AI Search REST Endpoints and Restricted Collections |
Medium 4.8 |
17.311.1 |
| 2026-10-18 |
WPSEC-2026-1234 |
Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search | Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.311.0 - Authenticated (Subscriber+) Sensitive Information Exposure via KB Search |
Medium 4.3 |
17.311.1 |
| 2026-10-18 |
WPSEC-2026-1233 |
Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search | Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.311.0 - Authenticated (Subscriber+) Missing Authorization to Arbitrary User Meta Update |
Medium 4.3 |
17.311.1 |
| 2026-10-18 |
WPSEC-2026-1232 |
VietQR | VietQR <= 3.6.0 - Unauthenticated Sensitive Information Exposure via vietqr/developer API Endpoint |
Medium 5.3 |
3.7.0 |
| 2026-10-18 |
WPSEC-2026-1231 |
Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates | Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Product Tabs Block Icon Attributes |
Medium 6.4 |
2.2.28 |
| 2026-10-18 |
WPSEC-2026-1230 |
Printus | Printus <= 2.0.6 - Authenticated (Shop Manager+) Path Traversal to Local File Inclusion via Template Name |
Medium 6.6 |
2.1.0 |
| 2026-10-18 |
WPSEC-2026-1229 |
GSheetConnector For Ninja Forms | GSheetConnector For Ninja Forms <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Google Sheets Access Code Update |
Medium 5.4 |
3.0.0 |
| 2026-10-18 |
WPSEC-2026-1228 |
MxChat | MxChat <= 3.2.25 - Cross-Site Request Forgery to Transcript Translation |
Medium 4.3 |
3.2.26 |
| 2026-10-18 |
WPSEC-2026-1227 |
MxChat | MxChat <= 3.2.25 - Unauthenticated Stored Cross-Site Scripting via Chat Messages |
High 7.2 |
3.2.26 |
| 2026-10-18 |
WPSEC-2026-1226 |
MxChat | MxChat <= 3.2.25 - Unauthenticated Stored Cross-Site Scripting via Rating Feedback |
High 7.2 |
3.2.26 |
| 2026-10-18 |
WPSEC-2026-1225 |
Events Made Easy | Events Made Easy <= 3.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event HTML Headers and Schema.org JSON-LD |
Medium 6.4 |
3.2.25 |
| 2026-10-18 |
WPSEC-2026-1224 |
Events Made Easy | Events Made Easy <= 3.2.24 - Authenticated (Editor+) Stored Cross-Site Scripting via Location Name and Address in Location Edit Map |
Medium 4.8 |
3.2.25 |
| 2026-10-18 |
WPSEC-2026-1223 |
Extensions for Leaflet Map | Extensions for Leaflet Map <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'choropleth' Shortcode |
Medium 6.4 |
6.0 |
| 2026-10-18 |
WPSEC-2026-1222 |
Simple History – Track, Log, and Audit WordPress Changes | Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Missing Authorization to Restricted Event Disclosure via 'occasionsID' Parameter |
Low 2.7 |
5.36.0 |
| 2026-10-18 |
WPSEC-2026-1221 |
Simple History – Track, Log, and Audit WordPress Changes | Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Authenticated (Editor+) Sensitive Information Exposure via REST API Stealth Mode Bypass |
Low 2.2 |
5.36.0 |
| 2026-10-18 |
WPSEC-2026-1220 |
Simple History – Track, Log, and Audit WordPress Changes | Simple History – Track, Log, and Audit WordPress Changes <= 5.35.0 - Unauthenticated Log Injection via Log Forwarding Local Files |
Low 3.7 |
5.36.0 |
| 2026-10-18 |
WPSEC-2026-1219 |
Academy LMS | Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attempt Details via 'attempt_id' Parameter |
Medium 4.3 |
4.0.7 |
| 2026-10-18 |
WPSEC-2026-1218 |
Academy LMS | Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Privilege Escalation via Student Role 'edit_posts' Capability |
Medium 4.3 |
4.0.7 |
| 2026-10-18 |
WPSEC-2026-1217 |
Academy LMS | Academy LMS <= 4.0.5 - Authenticated (Academy Instructor+) Missing Authorization to Course Publication via change_post_status |
Medium 4.3 |
4.0.7 |
| 2026-10-18 |
WPSEC-2026-1216 |
Podlove Podcast Publisher | Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Episode and Shownotes Modification |
Medium 5.4 |
4.5.4 |
| 2026-10-18 |
WPSEC-2026-1215 |
Podlove Podcast Publisher | Podlove Podcast Publisher <= 4.5.3 - Unauthenticated Sensitive Information Exposure of Unpublished Episodes |
Medium 5.3 |
4.5.4 |
| 2026-10-18 |
WPSEC-2026-1214 |
Podlove Podcast Publisher | Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contributor Name |
Medium 6.4 |
4.5.4 |
| 2026-10-18 |
WPSEC-2026-1213 |
Podlove Podcast Publisher | Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) Missing Authorization to Podcast Settings Modification |
Medium 4.3 |
4.5.4 |
| 2026-10-18 |
WPSEC-2026-1212 |
Before After Image Comparison – Visual Comparison for Two Images | Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Authenticated (Contributor+) Sensitive Information Exposure via 'baicb' Shortcode |
Medium 4.3 |
1.1.22 |
| 2026-10-18 |
WPSEC-2026-1211 |
Document Embedder – let visitors read files without downloading | Document Embedder – let visitors read files without downloading <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Document Library File URLs |
Medium 6.4 |
2.4.1 |
| 2026-10-18 |
WPSEC-2026-1210 |
Document Embedder – let visitors read files without downloading | Document Embedder – let visitors read files without downloading <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Document Embed Block 'doc' Attribute |
Medium 6.4 |
2.4.1 |
| 2026-10-18 |
WPSEC-2026-1209 |
s2Member | s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via s2Get Shortcode |
Medium 6.4 |
261017 |
| 2026-10-18 |
WPSEC-2026-1208 |
s2Member | s2Member <= 261011 - Unauthenticated Denial of Service via REST API Collection Requests |
Medium 5.3 |
261017 |
| 2026-10-18 |
WPSEC-2026-1207 |
AI Engine | AI Engine <= 3.8.5 - Authenticated (Editor+) Insecure Direct Object Reference to Arbitrary Post Title and Excerpt Modification |
Low 2.7 |
3.8.6 |
| 2026-10-17 |
WPSEC-2026-1206 |
Seraphinite Post .DOCX Source | Seraphinite Post .DOCX Source <= 2.16.15 - Authenticated (Subscriber+) Missing Authorization to Plugin State Modification |
Medium 5.4 |
2.16.16 |
| 2026-10-17 |
WPSEC-2026-1205 |
UpdraftPlus | UpdraftPlus <= 1.26.10 - Unauthenticated SQL Injection via Database Restore |
High 7.5 |
1.26.11 |
| 2026-10-17 |
WPSEC-2026-1204 |
Rich Showcase for Google Reviews | Rich Showcase for Google Reviews <= 7.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Widget Builder Page |
Medium 4.3 |
7.1.7 |
| 2026-10-17 |
WPSEC-2026-1203 |
WeForms | WeForms <= 1.6.28 - Unauthenticated Insecure Direct Object Reference to Arbitrary Attachment Deletion via Upload Field Values |
Medium 5.4 |
1.6.29 |
| 2026-10-17 |
WPSEC-2026-1202 |
YMC Filter | YMC Filter <= 3.12.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Autocomplete Search Results |
Medium 6.4 |
3.12.20 |
| 2026-10-17 |
WPSEC-2026-1201 |
YMC Filter | YMC Filter <= 3.12.19 - Unauthenticated Sensitive Information Exposure via Search Autocomplete REST Endpoint |
Medium 5.3 |
3.12.20 |
| 2026-10-17 |
WPSEC-2026-1200 |
If-So Dynamic Content – Elementor & All Page Builders Personalization | If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
Medium 6.4 |
1.10.3 |
| 2026-10-17 |
WPSEC-2026-1199 |
Uncanny Toolkit for LearnDash | Uncanny Toolkit for LearnDash <= 3.8.1 - Authenticated (Administrator+) Missing Authorization to User Verification Status Modification on Multisite |
Low 3.3 |
3.8.2 |
| 2026-10-17 |
WPSEC-2026-1198 |
Uncanny Toolkit for LearnDash | Uncanny Toolkit for LearnDash <= 3.8.1 - Cross-Site Request Forgery to Password Change via Front End Login Password Reset |
High 7.5 |
3.8.2 |
| 2026-10-17 |
WPSEC-2026-1197 |
WP Photo Album Plus | WP Photo Album Plus <= 9.3.04.001 - Cross-Site Request Forgery to Photo and Comment Deletion |
Medium 4.3 |
9.3.04.002 |
| 2026-10-17 |
WPSEC-2026-1196 |
FluentCart A New Era of eCommerce | FluentCart A New Era of eCommerce <= 2.1.0 - Unauthenticated Sensitive Information Exposure of Draft and Private Products via Product Modal |
Medium 5.3 |
2.2.0 |
| 2026-10-17 |
WPSEC-2026-1195 |
Bulk Page Generator | Bulk Page Generator <= 3.1.1 - Authenticated (Contributor+) Missing Authorization to Sensitive Information Exposure via Multiple AJAX Actions |
Medium 4.3 |
3.1.2 |
| 2026-10-17 |
WPSEC-2026-1194 |
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses | FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.11.0 - Unauthenticated Sensitive Information Exposure via Activity Feed |
Low 3.7 |
2.12.0 |
| 2026-10-17 |
WPSEC-2026-1193 |
Fluent Forms | Fluent Forms <= 6.2.15 - Unauthenticated Payment Bypass via Oversized Payment Amounts, Quantities and Checkbox Values |
Medium 5.3 |
6.2.16 |
| 2026-10-17 |
WPSEC-2026-1192 |
Fluent Forms | Fluent Forms <= 6.2.15 - Unauthenticated Insecure Direct Object Reference via Guest Order Payer Email |
Medium 6.5 |
6.2.16 |
| 2026-10-17 |
WPSEC-2026-1191 |
Fluent Forms | Fluent Forms <= 6.2.15 - Authenticated (Contributor+) Sensitive Information Exposure via 'theme' Shortcode Attribute |
Medium 4.3 |
6.2.16 |
| 2026-10-17 |
WPSEC-2026-1190 |
Fluent Forms | Fluent Forms <= 6.2.15 - Authenticated (Fluent Forms Manager+) Cross-Form Authorization Bypass via Malformed 'form_id' Route Parameter |
Medium 6.3 |
6.2.16 |
| 2026-10-17 |
WPSEC-2026-1189 |
Gravatar Enhanced | Gravatar Enhanced <= 0.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gravatar Profile Block Attributes |
Medium 6.4 |
0.14.0 |
| 2026-10-17 |
WPSEC-2026-1188 |
Payment forms, Buy now buttons, and Invoicing System | GetPaid | Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via Payment Form Custom Field Data |
High 7.2 |
2.8.62 |
| 2026-10-17 |
WPSEC-2026-1187 |
RewardsWP | RewardsWP <= 1.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Guest Order Takeover via Order Linking Verification |
Medium 5.4 |
1.6.1 |
| 2026-10-17 |
WPSEC-2026-1186 |
RewardsWP | RewardsWP <= 1.6.0 - Missing Authorization to Unauthenticated Settings Overwrite via Setup Completion Handler |
Medium 5.3 |
1.6.1 |
| 2026-10-17 |
WPSEC-2026-1185 |
E2Pdf – Export Pdf Tool for WordPress | E2Pdf – Export Pdf Tool for WordPress <= 1.32.57 - Unauthenticated Stored Cross-Site Scripting via Export Dataset Labels |
Medium 5.4 |
1.32.58 |
| 2026-10-17 |
WPSEC-2026-1184 |
Contact Form by Supsystic | Contact Form by Supsystic <= 1.10.5 - Unauthenticated Sensitive Information Exposure via Front-End Form Settings |
Medium 5.3 |
1.10.7 |
| 2026-10-17 |
WPSEC-2026-1183 |
WP Booking System | WP Booking System <= 2.1.0.3 - Unauthenticated Missing Authorization to Booking Email Log Disclosure and Resend |
Medium 6.5 |
2.1.0.4 |
| 2026-10-17 |
WPSEC-2026-1182 |
WP Booking System | WP Booking System <= 2.1.0.3 - Authenticated (Subscriber+) Missing Authorization to Form Settings Update |
Medium 4.3 |
2.1.0.4 |
