| 2026-10-16 |
WPSEC-2026-1081 |
Nexter Extension | Nexter Extension <= 4.7.12 - Authenticated (Author+) Missing Authorization to Image Conversion and Overwrite via Image Optimisation |
Medium 4.3 |
4.7.13 |
| 2026-10-16 |
WPSEC-2026-1080 |
Nexter Extension | Nexter Extension <= 4.7.12 - Authenticated (Contributor+) Missing Authorization to Post Publication via Post Duplicator |
Low 3.1 |
4.7.13 |
| 2026-10-16 |
WPSEC-2026-1079 |
WPGraphQL | WPGraphQL <= 2.24.0 - Authenticated (Contributor+) Sensitive Information Exposure via Trashed Posts |
Medium 4.3 |
2.24.1 |
| 2026-10-16 |
WPSEC-2026-1078 |
WPGraphQL | WPGraphQL <= 2.24.0 - Authenticated (Author+) Server-Side Request Forgery via 'filePath' Parameter |
Medium 4.9 |
2.24.1 |
| 2026-10-16 |
WPSEC-2026-1077 |
WPGraphQL | WPGraphQL <= 2.24.0 - Unauthenticated Missing Authorization to Comment Creation on Restricted Posts |
Medium 5.3 |
2.24.1 |
| 2026-10-16 |
WPSEC-2026-1076 |
WPGraphQL | WPGraphQL <= 2.24.0 - Authenticated (Subscriber+) Missing Authorization to Comment Metadata Modification and Moderation Bypass via updateComment |
Medium 4.3 |
2.24.1 |
| 2026-10-16 |
WPSEC-2026-1075 |
PowerPack Lite for Beaver Builder | PowerPack Lite for Beaver Builder <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Facebook App ID Setting |
Medium 4.4 |
1.3.2 |
| 2026-10-16 |
WPSEC-2026-1074 |
PowerPack Lite for Beaver Builder | PowerPack Lite for Beaver Builder <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Facebook App ID Integration Setting |
Medium 6.1 |
1.3.2 |
| 2026-10-16 |
WPSEC-2026-1073 |
Simple 301 Redirects by BetterLinks | Simple 301 Redirects by BetterLinks <= 2.1.0 - Unauthenticated PHP Object Injection via Insecure Plugin Information Request |
High 7.5 |
2.1.1 |
| 2026-10-16 |
WPSEC-2026-1072 |
Simple 301 Redirects by BetterLinks | Simple 301 Redirects by BetterLinks <= 2.1.0 - Authenticated (Administrator+) Incorrect Authorization to Arbitrary Plugin Installation and Activation |
Medium 6.6 |
2.1.1 |
| 2026-10-16 |
WPSEC-2026-1071 |
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages | Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.6 - Unauthenticated Authorization Bypass via 'ck_subscriber_id' Parameter and Cookie |
Medium 5.3 |
3.4.7 |
| 2026-10-16 |
WPSEC-2026-1070 |
Easy Digital Downloads | Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Discount Validation Bypass via PayPal Fastlane and Card Checkout |
Medium 5.3 |
3.7.2 |
| 2026-10-16 |
WPSEC-2026-1069 |
Easy Digital Downloads | Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Race Condition to Discount Usage Limit Bypass via Checkout |
Low 3.7 |
3.7.2 |
| 2026-10-16 |
WPSEC-2026-1068 |
Easy Digital Downloads | Easy Digital Downloads <= 3.7.1.1 - Authenticated (Subscriber+) Missing Authorization to Test Email Summary Sending |
Medium 4.3 |
3.7.2 |
| 2026-10-16 |
WPSEC-2026-1067 |
Easy Digital Downloads | Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via 'payment-id' Parameter |
Medium 5.3 |
3.7.2 |
| 2026-10-16 |
WPSEC-2026-1066 |
Anti-Spam by CleanTalk | Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via User Email |
Medium 6.1 |
6.90 |
| 2026-10-16 |
WPSEC-2026-1065 |
Anti-Spam by CleanTalk | Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Reflected Cross-Site Scripting via 'item_meta' Parameter |
Medium 6.1 |
6.90 |
| 2026-10-16 |
WPSEC-2026-1064 |
Download Manager | Download Manager <= 3.3.72 - Unauthenticated Missing Authorization to Restricted Package Download via Password Lock |
Low 3.7 |
3.3.73 |
| 2026-10-16 |
WPSEC-2026-1063 |
Download Manager | Download Manager <= 3.3.72 - Unauthenticated Missing Authorization to Protected File Download via Audio, Video and PDF Preview Links |
Medium 5.3 |
3.3.73 |
| 2026-10-16 |
WPSEC-2026-1062 |
Formidable Forms | Formidable Forms <= 6.35 - Authenticated (Custom-Access+) Missing Authorization to Arbitrary Plugin Installation via Account Connection Token |
High 7.5 |
7.0 |
| 2026-10-16 |
WPSEC-2026-1061 |
Tutor LMS | Tutor LMS <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name in Consent Logs |
Medium 6.4 |
4.1.3 |
| 2026-10-16 |
WPSEC-2026-1060 |
Joli FAQ SEO – WordPress FAQ Plugin | Joli FAQ SEO – WordPress FAQ Plugin <= 1.3.10 - Reflected Cross-Site Scripting via Pricing Page Query Parameters |
Medium 6.1 |
1.3.11 |
| 2026-10-16 |
WPSEC-2026-1059 |
Blockons | Blockons <= 1.2.19 - Unauthenticated Limited File Upload via Contact Form Submission REST Endpoint |
Medium 5.3 |
1.2.20 |
| 2026-10-16 |
WPSEC-2026-1058 |
Blockons | Blockons <= 1.2.19 - Unauthenticated Arbitrary Email Sending via Contact Form Submission REST Endpoint |
Medium 5.3 |
1.2.20 |
| 2026-10-16 |
WPSEC-2026-1057 |
Job Postings | Job Postings <= 2.8.2 - Authenticated (Contributor+) Missing Authorization to Arbitrary Job Post Duplication |
Medium 5.4 |
2.8.3 |
| 2026-10-16 |
WPSEC-2026-1056 |
WordLift | WordLift <= 3.54.15 - Authenticated (Subscriber+) Missing Authorization to Schema.org Taxonomy Sync |
Medium 4.3 |
3.54.17 |
| 2026-10-16 |
WPSEC-2026-1055 |
Animation Addons for Elementor | Animation Addons for Elementor <= 4.2.6 - Authenticated (Author+) Stored Cross-Site Scripting via Posts and Video Posts Tab Widgets Post Title |
Medium 6.4 |
4.2.7 |
| 2026-10-16 |
WPSEC-2026-1054 |
Animation Addons for Elementor | Animation Addons for Elementor <= 4.2.6 - Authenticated (Contributor+) Sensitive Information Exposure via Toggle Switcher Widget |
Medium 4.3 |
4.2.7 |
| 2026-10-16 |
WPSEC-2026-1053 |
OttoKit: All-in-One Automation Platform | OttoKit: All-in-One Automation Platform <= 1.1.41 - Unauthenticated Authentication Bypass via Denied Connection Token |
High 8.1 |
1.1.42 |
| 2026-10-16 |
WPSEC-2026-1052 |
Quiz Maker by AYS | Quiz Maker by AYS <= 6.7.1.91 - Unauthenticated Reflected Cross-Site Scripting via Request URI in Social Share Buttons |
Medium 6.1 |
6.7.1.92 |
| 2026-10-16 |
WPSEC-2026-1051 |
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart Tag Injection in Form Field Values |
Medium 5.3 |
3.6.3 |
| 2026-10-16 |
WPSEC-2026-1050 |
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting via Form Entry Values |
High 7.2 |
3.6.3 |
| 2026-10-16 |
WPSEC-2026-1049 |
Translate WordPress and go Multilingual – Weglot | Translate WordPress and go Multilingual – Weglot <= 6.4.2 - Unauthenticated Stored Cross-Site Scripting via Translated Link URLs |
High 7.2 |
6.4.3 |
| 2026-10-16 |
WPSEC-2026-1048 |
SAML Single Sign On | SAML Single Sign On <= 6.0.0 - Unauthenticated Authentication Bypass via SAML Assertion Replay |
High 8.1 |
6.1.0 |
| 2026-10-16 |
WPSEC-2026-1047 |
Pay For Post with WooCommerce | Pay For Post with WooCommerce <= 3.2.34 - Unauthenticated Reflected Cross-Site Scripting via Pricing Page URL Parameters |
Medium 6.1 |
3.2.35 |
| 2026-10-16 |
WPSEC-2026-1046 |
Premium Packages | Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes |
Medium 6.4 |
7.3.0 |
| 2026-10-16 |
WPSEC-2026-1045 |
WPeMatico RSS Feed Fetcher | WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via Campaign Log |
Medium 5.4 |
2.9.1 |
| 2026-10-16 |
WPSEC-2026-1044 |
WPeMatico RSS Feed Fetcher | WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Content |
Medium 5.4 |
2.9.1 |
| 2026-10-15 |
WPSEC-2026-1043 |
AI Engine | AI Engine <= 3.8.4 - Unauthenticated Insecure Direct Object Reference to File Deletion via File Upload Metadata |
Medium 4.8 |
3.8.5 |
| 2026-10-15 |
WPSEC-2026-1042 |
Gmedia Photo Gallery | Gmedia Photo Gallery <= 1.25.1 - Cross-Site Request Forgery to Arbitrary Gmedia Term Deletion via Module Preset Restore |
Medium 5.4 |
1.25.2 |
| 2026-10-15 |
WPSEC-2026-1041 |
Telegram Bot & Channel | Telegram Bot & Channel <= 4.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'telegram_m_send_content' Parameter |
Medium 6.4 |
4.2.1 |
| 2026-10-15 |
WPSEC-2026-1040 |
Top 10 | Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Popular Posts Block 'instance_id' Attribute |
Medium 6.4 |
4.5.3 |
| 2026-10-15 |
WPSEC-2026-1039 |
Product Layouts for WooCommerce | Product Layouts for WooCommerce <= 1.4.5 - Unauthenticated Sensitive Information Exposure via Quick View |
Medium 5.3 |
1.4.6 |
| 2026-10-15 |
WPSEC-2026-1038 |
ThirstyAffiliates Affiliate Link Manager | ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Unauthenticated Information Exposure of Unpublished Affiliate Links via 'ta_click_data_redirect' and 'ta_link_fixer' AJAX Actions |
Medium 6.5 |
3.12.1 |
| 2026-10-15 |
WPSEC-2026-1037 |
ThirstyAffiliates Affiliate Link Manager | ThirstyAffiliates Affiliate Link Manager <= 3.12.0 - Missing Authorization to Authenticated (Contributor+) Stripe API Key Exposure via Payments Settings Tab |
Medium 6.5 |
3.12.1 |
| 2026-10-15 |
WPSEC-2026-1036 |
GetPaid Stripe Payments | GetPaid Stripe Payments <= 2.3.28 - Unauthenticated Payment Bypass via Insufficient Payment Amount Verification |
Medium 5.3 |
2.3.29 |
| 2026-10-15 |
WPSEC-2026-1035 |
UpdraftPlus | UpdraftPlus <= 1.26.8 - Unauthenticated SQL Injection via Database Restore |
High 7.5 |
1.26.9 |
| 2026-10-15 |
WPSEC-2026-1034 |
Restricted Site Access | Restricted Site Access <= 7.6.3 - Unauthenticated Authentication Bypass via 'page_id' and 'pagename' Query Parameters |
Low 3.7 |
7.6.4 |
| 2026-10-15 |
WPSEC-2026-1033 |
Product Attachment for WooCommerce | Product Attachment for WooCommerce <= 2.3.4 - Unauthenticated Insecure Direct Object Reference to Order Attachment Download |
Medium 5.3 |
2.3.5 |
| 2026-10-15 |
WPSEC-2026-1032 |
Advanced Ads – Ad Manager & AdSense | Advanced Ads – Ad Manager & AdSense <= 2.0.26 - Authenticated (Editor+) Sensitive Information Exposure via Author Search |
Medium 4.9 |
2.0.27 |
| 2026-10-15 |
WPSEC-2026-1031 |
Depicter — Popup & Slider Builder | Depicter — Popup & Slider Builder <= 4.8.1 - Authenticated (Editor+) Arbitrary File Upload |
High 7.2 |
4.8.2 |
| 2026-10-15 |
WPSEC-2026-1030 |
Invoicing with InvoiceXpress for WooCommerce | Invoicing with InvoiceXpress for WooCommerce <= 9.1 - Unauthenticated Sensitive Information Exposure via Predictable Document PDF File Names |
Medium 5.9 |
10.0 |
| 2026-10-15 |
WPSEC-2026-1029 |
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons | Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget and UIkit Component HTML |
Medium 6.4 |
10.0.0 |
| 2026-10-15 |
WPSEC-2026-1028 |
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons | Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via UIkit Component Attributes (Content Guard Bypass) |
Medium 6.4 |
10.0.0 |
| 2026-10-15 |
WPSEC-2026-1027 |
Booktics – Appointment Booking Calendar for Service Businesses | Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated SQL Injection via 'customer_id' Parameter |
High 7.5 |
1.0.30 |
| 2026-10-15 |
WPSEC-2026-1026 |
Booktics – Appointment Booking Calendar for Service Businesses | Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated Missing Authorization via Notification Flow REST Routes |
High 7.3 |
1.0.30 |
| 2026-10-15 |
WPSEC-2026-1025 |
My Calendar | My Calendar <= 3.8.7 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes |
Critical 9.8 |
3.8.8 |
| 2026-10-15 |
WPSEC-2026-1024 |
My Calendar | My Calendar <= 3.8.7 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' and Query String Parameters |
High 7.3 |
3.8.8 |
| 2026-10-15 |
WPSEC-2026-1023 |
My Calendar | My Calendar <= 3.7.17 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' and Query String Parameters |
High 7.3 |
3.7.18 |
| 2026-10-15 |
WPSEC-2026-1022 |
My Calendar | My Calendar <= 3.7.17 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes |
Critical 9.8 |
3.7.18 |
| 2026-10-15 |
WPSEC-2026-1021 |
My Calendar | My Calendar <= 3.6.17 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes |
Critical 9.8 |
3.6.18 |
| 2026-10-15 |
WPSEC-2026-1020 |
LWS Optimize – All-in-One Speed Booster & Cache Tools | LWS Optimize – All-in-One Speed Booster & Cache Tools <= 4.1.6.5 - Unauthenticated Server-Side Request Forgery via Host Header |
Medium 5.4 |
4.1.7 |
| 2026-10-15 |
WPSEC-2026-1019 |
My Calendar | My Calendar <= 3.5.21 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes |
Critical 9.8 |
3.5.22 |
| 2026-10-15 |
WPSEC-2026-1018 |
My Calendar | My Calendar <= 3.4.24 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' and Query String Parameters |
High 7.3 |
3.4.25 |
| 2026-10-15 |
WPSEC-2026-1017 |
My Calendar | My Calendar <= 3.4.24 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes |
Critical 9.8 |
3.4.25 |
| 2026-10-15 |
WPSEC-2026-1016 |
Simply Schedule Appointments | Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Incorrect Authorization to Group Appointment Cancellation and Deletion |
Medium 6.5 |
1.6.12.37 |
| 2026-10-15 |
WPSEC-2026-1015 |
Simply Schedule Appointments | Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Sensitive Information Exposure via Appointment Types REST Endpoint |
Medium 5.3 |
1.6.12.37 |
| 2026-10-15 |
WPSEC-2026-1014 |
Simply Schedule Appointments | Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via Debug Log |
High 7.2 |
1.6.12.37 |
| 2026-10-15 |
WPSEC-2026-1013 |
Simply Schedule Appointments | Simply Schedule Appointments <= 1.6.12.35 - Authenticated (Contributor+) Insecure Direct Object Reference via 'edit' Shortcode Attribute |
Medium 6.3 |
1.6.12.37 |
| 2026-10-15 |
WPSEC-2026-1012 |
WPZOOM Portfolio Lite – Filterable Portfolio Plugin | WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.33 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Modification via Re-order AJAX Actions |
Medium 4.3 |
1.4.34 |
| 2026-10-15 |
WPSEC-2026-1011 |
SmartCrawl SEO checker, analyzer & optimizer | SmartCrawl SEO checker, analyzer & optimizer <= 3.16.4 - Authenticated (Contributor+) Missing Authorization to Post SEO Analysis Modification and Disclosure |
Medium 5.4 |
3.17.1 |
| 2026-10-15 |
WPSEC-2026-1010 |
NotificationX | NotificationX <= 3.3.3 - Unauthenticated Missing Authorization to Notification Entry Injection via popup-submit REST Endpoint |
Medium 5.3 |
3.3.4 |
| 2026-10-15 |
WPSEC-2026-1009 |
Better Payment | Better Payment <= 2.4.1 - Unauthenticated Open Redirect via PayPal 'return' and 'cancel_return' Parameters |
Medium 4.7 |
2.4.2 |
| 2026-10-15 |
WPSEC-2026-1008 |
Security & Malware scan by CleanTalk | Security & Malware scan by CleanTalk <= 2.189 - Unauthenticated Rate Limit Bypass via User-Agent Header |
Medium 5.3 |
2.190 |
| 2026-10-15 |
WPSEC-2026-1007 |
EasyJobs | EasyJobs <= 2.8.2 - Missing Authorization to Unauthenticated Usage-Tracking Opt-In Change |
Medium 5.3 |
2.8.3 |
| 2026-10-15 |
WPSEC-2026-1006 |
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.24 - Unauthenticated Site Access Restriction Bypass via Password Reset Page URL Prefix |
Low 3.7 |
2.9.25 |
| 2026-10-15 |
WPSEC-2026-1005 |
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.24 - Unauthenticated Site Access Restriction Bypass via REST API Prefix in Request URI |
Medium 5.3 |
2.9.25 |
| 2026-10-15 |
WPSEC-2026-1004 |
Download Monitor | Download Monitor <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via XHR Download Link Handling |
Medium 6.1 |
5.3.4 |
| 2026-10-15 |
WPSEC-2026-1003 |
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Unauthenticated Sensitive Information Exposure via Search Form 'post_type' Parameter |
Medium 5.3 |
4.11.112 |
| 2026-10-15 |
WPSEC-2026-1002 |
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Authenticated (Subscriber+) Missing Authorization to Post Title Disclosure via 'premium_update_filter' AJAX Action |
Medium 4.3 |
4.11.112 |
| 2026-10-15 |
WPSEC-2026-1001 |
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Wheel and Media Grid Lightbox URLs |
Medium 6.4 |
4.11.112 |
| 2026-10-15 |
WPSEC-2026-1000 |
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Authenticated (Contributor+) Missing Authorization to Post Publishing via Change Post Status Ability |
Low 3.1 |
4.11.112 |
| 2026-10-15 |
WPSEC-2026-0999 |
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Unauthenticated Sensitive Information Exposure of Password-Protected Products via Woo Products Quick View |
Medium 5.3 |
4.11.112 |
| 2026-10-15 |
WPSEC-2026-0998 |
Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via Rendered Block Content |
Medium 6.5 |
1.58.2 |
| 2026-10-15 |
WPSEC-2026-0997 |
Gwolle Guestbook | Gwolle Guestbook <= 5.1.1 - Unauthenticated Reflected Cross-Site Scripting via 'permalink' Parameter |
Medium 6.1 |
5.1.2 |
| 2026-10-15 |
WPSEC-2026-0996 |
Ajax Search Lite | Ajax Search Lite <= 4.14.5 - Unauthenticated CSV Injection via Search Statistics Export |
Medium 4.2 |
4.14.6 |
| 2026-10-15 |
WPSEC-2026-0995 |
Ajax Search Lite | Ajax Search Lite <= 4.14.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Forged Search Instance Settings |
Medium 5.4 |
4.14.6 |
| 2026-10-15 |
WPSEC-2026-0994 |
Ajax Search Lite | Ajax Search Lite <= 4.14.5 - Unauthenticated Sensitive Information Exposure via 'customset' Post Type Selection |
Medium 5.3 |
4.14.6 |
| 2026-10-15 |
WPSEC-2026-0993 |
Ajax Search Lite | Ajax Search Lite <= 4.14.5 - Unauthenticated Sensitive Information Exposure of Password Protected Post Content via Search Results |
Low 3.7 |
4.14.6 |
| 2026-10-15 |
WPSEC-2026-0992 |
Categories Images | Categories Images <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode |
Medium 6.4 |
3.3.4 |
| 2026-10-15 |
WPSEC-2026-0991 |
Security Optimizer – The All-In-One Protection Plugin | Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Valid Pre-2FA Session |
High 8.1 |
1.6.9 |
| 2026-10-15 |
WPSEC-2026-0990 |
Security Optimizer – The All-In-One Protection Plugin | Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass for Multisite Super Administrators |
High 8.1 |
1.6.9 |
| 2026-10-15 |
WPSEC-2026-0989 |
Security Optimizer – The All-In-One Protection Plugin | Security Optimizer – The All-In-One Protection Plugin <= 1.6.8 - Unauthenticated Two-Factor Authentication Bypass via Brute Force |
High 8.1 |
1.6.9 |
| 2026-10-15 |
WPSEC-2026-0988 |
OTP Login With Phone Number, OTP Verification | OTP Login With Phone Number, OTP Verification <= 1.8.77 - Unauthenticated Authentication Bypass via Firebase Phone Number Verification |
High 8.1 |
1.8.78 |
| 2026-10-15 |
WPSEC-2026-0987 |
OTP Login With Phone Number, OTP Verification | OTP Login With Phone Number, OTP Verification <= 1.8.77 - Authenticated (Subscriber+) Insecure Direct Object Reference to Email Address Takeover via Email Change |
Medium 6.5 |
1.8.78 |
| 2026-10-15 |
WPSEC-2026-0986 |
Bulk Page Generator | Bulk Page Generator <= 3.1.0 - Authenticated (Subscriber+) Missing Authorization to App Connection Token Generation |
Medium 5.4 |
3.1.1 |
| 2026-10-15 |
WPSEC-2026-0985 |
Restrict Usernames Emails Characters Plugin | Restrict Usernames Emails Characters Plugin <= 5.0.3 - Unauthenticated Missing Authorization to Site-Wide Maintenance Mode (DoS) and Nicename Data Deletion via Bulk Nicename Update Actions |
High 8.2 |
5.1 |
| 2026-10-15 |
WPSEC-2026-0984 |
Nexter Extension – Site Enhancements Toolkit | Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Authenticated (Subscriber+) Missing Authorization to Post and Term Enumeration via Builder Condition AJAX Actions |
Medium 4.3 |
4.7.7 |
| 2026-10-15 |
WPSEC-2026-0983 |
Nexter Extension – Site Enhancements Toolkit | Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Missing Authorization to Unauthenticated User Role Modification via View Admin Role |
Medium 5.3 |
4.7.7 |
| 2026-10-15 |
WPSEC-2026-0982 |
Nexter Extension – Site Enhancements Toolkit | Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Unauthenticated Login Attempt Limit Bypass via IP Spoofing |
Medium 6.5 |
4.7.7 |
