| 2026-10-15 |
WPSEC-2026-0981 |
Nexter Extension – Site Enhancements Toolkit | Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Authenticated (Author+) Arbitrary File Upload via Custom Font Upload |
High 7.5 |
4.7.7 |
| 2026-10-15 |
WPSEC-2026-0980 |
Insights from Google PageSpeed | Insights from Google PageSpeed <= 4.0.8 - Missing Authorization to Unauthenticated Full Report Recheck Trigger |
Medium 5.3 |
5.0.0 |
| 2026-10-15 |
WPSEC-2026-0979 |
RegistrationMagic | RegistrationMagic <= 6.1.0.1 - Unauthenticated Payment Bypass via PayPal IPN Sandbox Verification |
Medium 5.3 |
6.1.0.2 |
| 2026-10-15 |
WPSEC-2026-0978 |
SureForms | SureForms <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embedded Post Title Smart Tag |
Medium 6.4 |
2.12.9 |
| 2026-10-15 |
WPSEC-2026-0977 |
SureForms | SureForms <= 2.12.8 - Authenticated (Contributor+) Sensitive Information Exposure via Smart Tags in Post Content |
High 7.7 |
2.12.9 |
| 2026-10-15 |
WPSEC-2026-0976 |
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO | SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.1 - Unauthenticated Denial of Service via 'max_page' Parameter |
Medium 5.3 |
3.1.2 |
| 2026-10-15 |
WPSEC-2026-0975 |
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.0 - Unauthenticated Price Manipulation via Booking Form Quantity Parameters |
Medium 5.3 |
2.8.1 |
| 2026-10-14 |
WPSEC-2026-0974 |
Site Reviews | Site Reviews <= 8.3.4 - Unauthenticated IP Address Spoofing via Proxy HTTP Header |
Low 3.7 |
8.3.5 |
| 2026-10-14 |
WPSEC-2026-0973 |
FileBird – WordPress Media Library Folders & File Manager | FileBird – WordPress Media Library Folders & File Manager <= 6.5.8 - Authenticated (Author+) CSV Injection via Folder Name |
Medium 4.4 |
6.5.9 |
| 2026-10-14 |
WPSEC-2026-0972 |
FileBird – WordPress Media Library Folders & File Manager | FileBird – WordPress Media Library Folders & File Manager <= 6.5.8 - Authenticated (Contributor+) Missing Authorization to Other Users' Folder Move, Duplication and Color Change |
Medium 4.3 |
6.5.9 |
| 2026-10-14 |
WPSEC-2026-0971 |
FileBird – WordPress Media Library Folders & File Manager | FileBird – WordPress Media Library Folders & File Manager <= 6.5.8 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Folder Assignment |
Medium 4.3 |
6.5.9 |
| 2026-10-14 |
WPSEC-2026-0970 |
The Events Calendar | The Events Calendar <= 6.18.0 - Unauthenticated Denial of Service via 'posts_per_page' Parameter |
Medium 5.3 |
6.18.1 |
| 2026-10-14 |
WPSEC-2026-0969 |
MDTF – Meta Data and Taxonomies Filter | MDTF – Meta Data and Taxonomies Filter <= 1.3.9 - Authenticated (Contributor+) Arbitrary Post Meta Update via Filter Data on Post Save |
Medium 4.3 |
1.4.0 |
| 2026-10-14 |
WPSEC-2026-0968 |
MDTF – Meta Data and Taxonomies Filter | MDTF – Meta Data and Taxonomies Filter <= 1.3.9 - Authenticated (Contributor+) Missing Authorization to Filter Meta Key Rename |
Medium 4.3 |
1.4.0 |
| 2026-10-14 |
WPSEC-2026-0967 |
MDTF – Meta Data and Taxonomies Filter | MDTF – Meta Data and Taxonomies Filter <= 1.3.9 - Authenticated (Contributor+) Sensitive Information Exposure via mdf_value Shortcode |
Medium 4.3 |
1.4.0 |
| 2026-10-14 |
WPSEC-2026-0966 |
MDTF – Meta Data and Taxonomies Filter | MDTF – Meta Data and Taxonomies Filter <= 1.3.9 - Authenticated (Subscriber+) Server-Side Request Forgery via Statistics Connection Check |
Medium 5.0 |
1.4.0 |
| 2026-10-14 |
WPSEC-2026-0965 |
TranslatePress – Translate Multilingual sites with AI Translation | TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via #TRPLINKPROCESSED Marker in URLs |
High 7.2 |
3.3.8 |
| 2026-10-14 |
WPSEC-2026-0964 |
EWWW Image Optimizer | EWWW Image Optimizer <= 8.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load 'data-script' and 'data-link' Attributes |
Medium 4.9 |
8.9.0 |
| 2026-10-14 |
WPSEC-2026-0963 |
Geo Controller | Geo Controller <= 9.0.2 - Authenticated (Subscriber+) Missing Authorization to Plugin Integration Support Actions |
Medium 4.3 |
9.0.3 |
| 2026-10-14 |
WPSEC-2026-0962 |
Geo Controller | Geo Controller <= 9.0.2 - Unauthenticated IP Address Spoofing via Forwarding Headers |
Medium 5.3 |
9.0.3 |
| 2026-10-14 |
WPSEC-2026-0961 |
CP Multi View Event Calendar | CP Multi View Event Calendar <= 1.4.41 - Missing Authorization to Authenticated (Contributor+) Calendar View Modification and Event Deletion |
Medium 5.4 |
1.4.42 |
| 2026-10-14 |
WPSEC-2026-0960 |
CP Multi View Event Calendar | CP Multi View Event Calendar <= 1.4.41 - Authenticated (Contributor+) SQL Injection via 'params' Parameter |
Medium 6.5 |
1.4.42 |
| 2026-10-14 |
WPSEC-2026-0959 |
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.4 - Unauthenticated Insecure Direct Object Reference to Restricted Gallery Image Exposure via Share, Add to Cart, and Product Options AJAX Actions |
Medium 5.3 |
3.7.5 |
| 2026-10-14 |
WPSEC-2026-0958 |
Ultimate Product Catalog | Ultimate Product Catalog <= 5.4.0 - Cross-Site Request Forgery to Custom Field Definitions Update |
Medium 4.3 |
5.5.0 |
| 2026-10-14 |
WPSEC-2026-0957 |
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.6 - Unauthenticated Privilege Escalation via Account Takeover through Optin Form Field Mapping Parameter |
High 8.1 |
1.2.78.7 |
| 2026-10-14 |
WPSEC-2026-0956 |
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.87 - Missing Authorization to Authenticated (Subscriber+) Remote Database Connection Test |
Medium 4.3 |
5.5.88 |
| 2026-10-14 |
WPSEC-2026-0955 |
Groundhogg | Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via Contact File Copying |
High 8.1 |
4.9.4 |
| 2026-10-14 |
WPSEC-2026-0954 |
YITH WooCommerce Compare | YITH WooCommerce Compare <= 3.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute |
Medium 6.4 |
3.15.1 |
| 2026-10-14 |
WPSEC-2026-0953 |
VikRentCar Car Rental Management System | VikRentCar Car Rental Management System <= 1.4.7 - Unauthenticated Reflected Cross-Site Scripting via 'cid', 'vrc_active_tab', 'goto', 'vrc_lang' and 'status' Parameters |
Medium 6.1 |
1.4.8 |
| 2026-10-14 |
WPSEC-2026-0952 |
VikRentCar Car Rental Management System | VikRentCar Car Rental Management System <= 1.4.7 - Unauthenticated Reflected Cross-Site Scripting via Booking Parameters |
Medium 6.1 |
1.4.8 |
| 2026-10-14 |
WPSEC-2026-0951 |
MailPoet – Newsletters, Email Marketing, and Automation | MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated Open Redirect via Tracked Link Shortcodes and Personalization Tags |
Medium 4.7 |
5.42.0 |
| 2026-10-14 |
WPSEC-2026-0950 |
MailPoet – Newsletters, Email Marketing, and Automation | MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated CAPTCHA Bypass via Answer Replay on Registration Forms |
Medium 5.3 |
5.42.0 |
| 2026-10-14 |
WPSEC-2026-0949 |
MailPoet – Newsletters, Email Marketing, and Automation | MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated Open Redirect via 'referrer_form_url' Parameter |
Medium 6.1 |
5.42.0 |
| 2026-10-14 |
WPSEC-2026-0948 |
RSS Aggregator by Feedzy | RSS Aggregator by Feedzy <= 5.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Import Error Messages |
Medium 6.4 |
5.2.12 |
| 2026-10-14 |
WPSEC-2026-0947 |
Cardinity Payment Gateway for WooCommerce | Cardinity Payment Gateway for WooCommerce <= 3.4.1 - Missing Authorization to Unauthenticated Transaction Log Download |
Medium 5.3 |
3.4.2 |
| 2026-10-14 |
WPSEC-2026-0946 |
Cardinity Payment Gateway for WooCommerce | Cardinity Payment Gateway for WooCommerce <= 3.4.1 - Unauthenticated Order Status Manipulation via Hosted Checkout Callbacks |
High 7.5 |
3.4.2 |
| 2026-10-14 |
WPSEC-2026-0945 |
Security Ninja – WordPress Security & Firewall | Security Ninja – WordPress Security & Firewall <= 5.303 - Unauthenticated Firewall Bypass via Empty Secret Access URL Token |
Medium 5.3 |
5.305 |
| 2026-10-14 |
WPSEC-2026-0944 |
Nexter Extension – Site Enhancements Toolkit | Nexter Extension – Site Enhancements Toolkit <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation via View Admin As Role Switcher |
High 7.5 |
4.7.12 |
| 2026-10-14 |
WPSEC-2026-0943 |
Quick PayPal Payments | Quick PayPal Payments <= 6.0.3 - Unauthenticated Payment Amount Manipulation via Payment Form Parameters |
Medium 5.3 |
6.0.4 |
| 2026-10-14 |
WPSEC-2026-0942 |
Booking Package | Booking Package <= 1.7.30 - Authenticated (Booking Package Editor+) Stored Cross-Site Scripting via Front-End JavaScript Setting |
Medium 4.9 |
1.7.31 |
| 2026-10-14 |
WPSEC-2026-0941 |
Booking Package | Booking Package <= 1.7.30 - Unauthenticated Sensitive Information Exposure via 'createCustomer' Action |
Medium 5.3 |
1.7.31 |
| 2026-10-14 |
WPSEC-2026-0940 |
Booking Package | Booking Package <= 1.7.30 - Missing Authorization to Unauthenticated Paid Subscription Deactivation |
Medium 5.3 |
1.7.31 |
| 2026-10-14 |
WPSEC-2026-0939 |
InstaWP Connect – 1-click WP Staging & Migration | InstaWP Connect – 1-click WP Staging & Migration <= 0.1.4.1 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Plugin/Theme Zip Copies |
Medium 5.3 |
0.1.4.2 |
| 2026-10-14 |
WPSEC-2026-0938 |
Sticky Ads Lightweight | Sticky Ads Lightweight <= 3.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Ad Code Setting |
Medium 4.4 |
3.4.0 |
| 2026-10-14 |
WPSEC-2026-0937 |
FunnelKit Payment Gateway for Stripe WooCommerce | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page |
Medium 5.3 |
1.15.0.0.1 |
| 2026-10-14 |
WPSEC-2026-0936 |
MainWP Dashboard | MainWP Dashboard <= 6.2.2 - Authenticated (REST API Key Holder) Authentication Scope Bypass via Crafted Request URI |
High 7.2 |
6.2.3 |
| 2026-10-14 |
WPSEC-2026-0935 |
MainWP Dashboard | MainWP Dashboard <= 6.2.2 - Insufficient Session Expiration via REST API Keys of Deleted or Removed Users |
Medium 5.9 |
6.2.3 |
| 2026-10-14 |
WPSEC-2026-0934 |
FunnelKit Payment Gateway for Stripe WooCommerce | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page |
Medium 5.3 |
1.15.0.1.1 |
| 2026-10-14 |
WPSEC-2026-0933 |
Welcart e-Commerce | Welcart e-Commerce <= 2.12.4 - Cross-Site Request Forgery to Member Account Update and Login |
High 8.1 |
2.12.5 |
| 2026-10-14 |
WPSEC-2026-0932 |
Welcart e-Commerce | Welcart e-Commerce <= 2.12.4 - Unauthenticated Payment Bypass via Forged Digitalcheck Card Payment Notification |
Medium 5.3 |
2.12.5 |
| 2026-10-14 |
WPSEC-2026-0931 |
Welcart e-Commerce | Welcart e-Commerce <= 2.12.4 - Unauthenticated Payment Amount Manipulation via 'money' Parameter |
Medium 5.3 |
2.12.5 |
| 2026-10-14 |
WPSEC-2026-0930 |
Welcart e-Commerce | Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via Order List Search Condition Cookie |
Medium 4.9 |
2.12.5 |
| 2026-10-14 |
WPSEC-2026-0929 |
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Unauthenticated Sensitive Information Exposure via Line Items and Checkouts REST Endpoints |
Medium 5.3 |
4.9.5 |
| 2026-10-14 |
WPSEC-2026-0928 |
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-icon Web Component |
Medium 5.4 |
4.9.5 |
| 2026-10-14 |
WPSEC-2026-0927 |
WP VR | WP VR <= 9.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via Scene Image URL |
Medium 5.4 |
9.3.0 |
| 2026-10-14 |
WPSEC-2026-0926 |
rtMedia for WordPress, BuddyPress and bbPress | rtMedia for WordPress, BuddyPress and bbPress <= 4.7.14 - Unauthenticated Insecure Direct Object Reference to Activity Overwrite via 'activity_id' Parameter |
Medium 5.3 |
4.7.15 |
| 2026-10-14 |
WPSEC-2026-0925 |
rtMedia for WordPress, BuddyPress and bbPress | rtMedia for WordPress, BuddyPress and bbPress <= 4.7.14 - Unauthenticated Insecure Direct Object Reference via 'rtMedia_attached_files' Parameter |
Medium 5.3 |
4.7.15 |
| 2026-10-14 |
WPSEC-2026-0924 |
s2Member | s2Member <= 261001 - Unauthenticated Missing Authorization to Protected Content via REST API |
Medium 5.3 |
261011 |
| 2026-10-14 |
WPSEC-2026-0923 |
Broken Link Checker | Broken Link Checker <= 2.4.14.1 - Unauthenticated Authentication Bypass to Scan Report Recipient Removal |
Medium 5.3 |
2.4.15 |
| 2026-10-14 |
WPSEC-2026-0922 |
Broken Link Checker | Broken Link Checker <= 2.4.14.1 - Unauthenticated Sensitive Information Exposure via REST API User Roles Field |
Medium 5.3 |
2.4.15 |
| 2026-10-14 |
WPSEC-2026-0921 |
Broken Link Checker | Broken Link Checker <= 2.4.14.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Truncation and .htaccess Overwrite via Custom Log File Path |
Medium 5.9 |
2.4.15 |
| 2026-10-14 |
WPSEC-2026-0920 |
Broken Link Checker | Broken Link Checker <= 2.4.14.1 - Authenticated (Editor+) Missing Authorization to Broken Link Edit, Unlink and Deredirect |
Low 2.7 |
2.4.15 |
| 2026-10-14 |
WPSEC-2026-0919 |
Broken Link Checker | Broken Link Checker <= 2.4.14.1 - Cross-Site Request Forgery to Scan Data Deletion via Recheck |
Medium 4.3 |
2.4.15 |
| 2026-10-14 |
WPSEC-2026-0918 |
Broken Link Checker | Broken Link Checker <= 2.4.14.1 - Authenticated (Contributor+) PHP Object Injection via SiteOrigin panels_data Post Meta |
High 7.1 |
2.4.15 |
| 2026-10-14 |
WPSEC-2026-0917 |
GamiPress | GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Rank Modification via gamipress_profile_update_user_rank AJAX Action |
Medium 4.3 |
8.0.6 |
| 2026-10-14 |
WPSEC-2026-0916 |
GamiPress | GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Sensitive Information Exposure via Log Extra Data AJAX Action |
Medium 4.3 |
8.0.6 |
| 2026-10-14 |
WPSEC-2026-0915 |
GamiPress | GamiPress <= 8.0.5 - Unauthenticated Sensitive Information Exposure via 'user_id' Parameter of gamipress_get_logs AJAX Action |
Medium 5.3 |
8.0.6 |
| 2026-10-14 |
WPSEC-2026-0914 |
GamiPress | GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Points and Rank Modification via REST API User Meta |
Medium 4.3 |
8.0.6 |
| 2026-10-14 |
WPSEC-2026-0913 |
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder | Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Authenticated (Author+) Arbitrary File Deletion via 'lightboxThumbnailUrl' |
High 8.1 |
5.7 |
| 2026-10-14 |
WPSEC-2026-0912 |
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder | Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Unauthenticated DOM-Based Cross-Site Scripting via 'r3d-' URL Parameters |
Medium 6.1 |
5.7 |
| 2026-10-14 |
WPSEC-2026-0911 |
Redux Framework | Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Profile Page Localized Options |
Medium 4.3 |
4.5.16 |
| 2026-10-14 |
WPSEC-2026-0910 |
Redux Framework | Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field File URL |
Medium 6.4 |
4.5.16 |
| 2026-10-14 |
WPSEC-2026-0909 |
Redux Framework | Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Missing Authorization to Restricted Profile Field Update via 'checkuser_id' Parameter |
Medium 4.3 |
4.5.16 |
| 2026-10-14 |
WPSEC-2026-0908 |
Theme My Login | Theme My Login <= 7.3.0 - Cross-Site Request Forgery to Multisite Site Creation via Signup Form |
Medium 4.3 |
7.3.1 |
| 2026-10-14 |
WPSEC-2026-0907 |
Strong Testimonials | Strong Testimonials <= 3.3.12 - Unauthenticated HTML Injection via Comments |
Medium 4.3 |
3.3.13 |
| 2026-10-14 |
WPSEC-2026-0906 |
Strong Testimonials | Strong Testimonials <= 3.3.12 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Form Preview |
Medium 6.3 |
3.3.13 |
| 2026-10-14 |
WPSEC-2026-0905 |
PWA for WP & AMP | PWA for WP & AMP <= 1.7.88.1 - Unauthenticated Sensitive Information Exposure via Publicly Accessible FCM Service-Account JSON File |
Medium 5.9 |
1.7.88.2 |
| 2026-10-14 |
WPSEC-2026-0904 |
Recipe Maker | Recipe Maker <= 10.8.5 - Unauthenticated Sensitive Information Exposure via Private and Trashed Recipes |
Medium 5.3 |
10.9.0 |
| 2026-10-14 |
WPSEC-2026-0903 |
Elementor Website Builder | Elementor Website Builder <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CDATA Sections |
Medium 4.9 |
4.3.5 |
| 2026-10-14 |
WPSEC-2026-0902 |
Elementor Website Builder | Elementor Website Builder <= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline Post CSS |
Medium 4.9 |
4.3.5 |
| 2026-10-14 |
WPSEC-2026-0901 |
Elementor Website Builder | Elementor Website Builder <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload Validation Bypass |
Medium 4.9 |
4.3.5 |
| 2026-10-14 |
WPSEC-2026-0900 |
Personio Integration Light | Personio Integration Light <= 5.7.1 - Authenticated (Position Manager+) SQL Injection via Backend Position Search |
Medium 4.9 |
6.0.0 |
| 2026-10-14 |
WPSEC-2026-0899 |
Kirki – Freeform Page Builder, Website Builder & Customizer | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.2 - Authenticated (Editor+) PHP Object Injection via Template Import |
Medium 6.6 |
6.4.0 |
| 2026-10-14 |
WPSEC-2026-0898 |
Kirki – Freeform Page Builder, Website Builder & Customizer | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.2 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Collection Rendering 'context' Parameter |
Medium 5.3 |
6.4.0 |
| 2026-10-14 |
WPSEC-2026-0897 |
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Sensitive Information Exposure via AJAX Render Endpoint |
Low 3.7 |
3.9.2 |
| 2026-10-14 |
WPSEC-2026-0896 |
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Server-Side Request Forgery via Image Proxy |
Medium 5.4 |
3.9.2 |
| 2026-10-14 |
WPSEC-2026-0895 |
AMP for WP | AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info |
Medium 6.3 |
1.1.19 |
| 2026-10-14 |
WPSEC-2026-0894 |
Debloat | Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via Google Fonts Inline Minify |
Medium 5.9 |
1.4.0 |
| 2026-10-14 |
WPSEC-2026-0893 |
Polylang | Polylang <= 3.8.10 - Authenticated (Editor+) PHP Object Injection via Term Description |
Medium 6.6 |
3.8.11 |
| 2026-10-14 |
WPSEC-2026-0892 |
User Profile Builder | User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via Signup Details on Unconfirmed Emails List |
Medium 4.7 |
4.0.4 |
| 2026-10-14 |
WPSEC-2026-0891 |
User Profile Builder | User Profile Builder <= 4.0.3 - Authenticated (Author+) Privilege Escalation via Register Block and Elementor Widget |
High 8.8 |
4.0.4 |
| 2026-10-14 |
WPSEC-2026-0890 |
User Profile Builder | User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via 'role' Custom Field on Registration with Email Confirmation |
High 8.1 |
4.0.4 |
| 2026-10-14 |
WPSEC-2026-0889 |
User Profile Builder | User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name in Avatar Image |
Medium 6.4 |
4.0.4 |
| 2026-10-14 |
WPSEC-2026-0888 |
User Profile Builder | User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via Select (User Role) Field |
High 8.1 |
4.0.4 |
| 2026-10-14 |
WPSEC-2026-0887 |
Schema & Structured Data for WP & AMP | Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via Review Form |
High 7.2 |
1.68 |
| 2026-10-14 |
WPSEC-2026-0886 |
Joinchat | Joinchat <= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Joinchat Button Block 'message' Attribute |
Medium 6.4 |
6.4.2 |
| 2026-10-14 |
WPSEC-2026-0885 |
GTM4WP | GTM4WP <= 2.0.5 - Unauthenticated Sensitive Information Exposure via Cached Custom Order Received Page |
Low 3.7 |
2.0.6 |
| 2026-10-14 |
WPSEC-2026-0884 |
Complianz GDPR/CCPA Cookie Consent Banner | Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Sensitive Information Exposure via Data Request REST Endpoint |
Medium 5.3 |
7.5.6 |
| 2026-10-14 |
WPSEC-2026-0883 |
Complianz GDPR/CCPA Cookie Consent Banner | Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via YotuWP Cookie Blocker |
Medium 5.4 |
7.5.6 |
| 2026-10-14 |
WPSEC-2026-0882 |
Culture Object | Culture Object <= 4.3 - Unauthenticated Missing Authorization to Imported Object Deletion via Debug Purge |
Medium 6.5 |
4.4 |
