| 2026-10-14 |
WPSEC-2026-0881 |
WordPress Pinterest Plugin | WordPress Pinterest Plugin <= 1.9.2 - Authenticated (Contributor+) PHP Object Injection via Asset Cache Post Meta |
High 7.5 |
1.9.3 |
| 2026-10-14 |
WPSEC-2026-0880 |
GS Team Members | GS Team Members <= 2.8.2 - Authenticated (Contributor+) PHP Object Injection via Asset Cache Post Meta |
High 7.5 |
2.8.3 |
| 2026-10-14 |
WPSEC-2026-0879 |
GS Team Members | GS Team Members <= 2.8.2 - Authenticated (Subscriber+) Missing Authorization to Freemius Account Connection |
Medium 4.3 |
2.8.3 |
| 2026-10-14 |
WPSEC-2026-0878 |
Easy Property Listings | Easy Property Listings <= 3.5.26 - Authenticated (Subscriber+) Missing Authorization to Username Disclosure via epl_search_user AJAX Action |
Medium 4.3 |
3.5.27 |
| 2026-10-14 |
WPSEC-2026-0877 |
Mang Board | Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter |
Critical 9.8 |
2.4.5 |
| 2026-10-14 |
WPSEC-2026-0876 |
Mang Board | Mang Board <= 2.4.4 - Unauthenticated Stored Cross-Site Scripting via Board Post Content |
High 7.2 |
2.4.5 |
| 2026-10-14 |
WPSEC-2026-0875 |
Germanized for WooCommerce | Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Email Verification Bypass via Activation Token Reuse |
Medium 5.4 |
4.1.5 |
| 2026-10-14 |
WPSEC-2026-0874 |
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Front-End Component Attributes |
Medium 6.4 |
4.7.2 |
| 2026-10-14 |
WPSEC-2026-0873 |
Login using WordPress Users ( WP as SAML IDP ) | Login using WordPress Users ( WP as SAML IDP ) <= 2.0.1 - Unauthenticated Denial of Service via SAMLRequest Decompression |
Medium 5.3 |
2.0.2 |
| 2026-10-14 |
WPSEC-2026-0872 |
Login using WordPress Users ( WP as SAML IDP ) | Login using WordPress Users ( WP as SAML IDP ) <= 2.0.1 - Unauthenticated Denial of Service via SP Tracking Cookie |
High 7.5 |
2.0.2 |
| 2026-10-14 |
WPSEC-2026-0871 |
WP Simple Shopping Cart | WP Simple Shopping Cart <= 5.3.2 - Unauthenticated Payment Bypass via PayPal Standard IPN Receiver Email |
Medium 5.3 |
5.3.3 |
| 2026-10-14 |
WPSEC-2026-0870 |
WP Simple Shopping Cart | WP Simple Shopping Cart <= 5.3.2 - Authenticated (Contributor+) Product Price Manipulation via Dynamic Product Registration |
Medium 4.3 |
5.3.3 |
| 2026-10-14 |
WPSEC-2026-0869 |
Joli Table Of Contents | Joli Table Of Contents <= 3.0.3 - Reflected Cross-Site Scripting via Pricing Page Query Parameters |
Medium 6.1 |
3.0.4 |
| 2026-10-14 |
WPSEC-2026-0868 |
YayMail – WooCommerce Email Customizer | YayMail – WooCommerce Email Customizer <= 4.4.6 - Authenticated (Shop Manager+) PHP Object Injection via Backup State Import |
Medium 6.6 |
4.4.7 |
| 2026-10-14 |
WPSEC-2026-0867 |
Link Whisper Free | Link Whisper Free <= 0.9.7 - Authenticated (Contributor+) PHP Object Injection via Link Whisper Post Meta |
High 7.5 |
0.9.8 |
| 2026-10-14 |
WPSEC-2026-0866 |
Link Whisper Free | Link Whisper Free <= 0.9.7 - Unauthenticated CSV Injection via Click Tracking Anchor Text |
Medium 5.4 |
0.9.8 |
| 2026-10-14 |
WPSEC-2026-0865 |
Link Whisper Free | Link Whisper Free <= 0.9.7 - Authenticated (Editor+) SQL Injection via 'orderby' and 'post_id' Parameters |
Medium 4.9 |
0.9.8 |
| 2026-10-14 |
WPSEC-2026-0864 |
Link Whisper Free | Link Whisper Free <= 0.9.7 - Authenticated (Subscriber+) Missing Authorization to Broken Link Scan, Link Ignore List and Plugin Option Updates |
Medium 4.3 |
0.9.8 |
| 2026-10-14 |
WPSEC-2026-0863 |
Link Whisper Free | Link Whisper Free <= 0.9.7 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'wpil_admin_frontend_data' Parameter |
Medium 6.1 |
0.9.8 |
| 2026-10-14 |
WPSEC-2026-0862 |
PowerPack Addons for Elementor | PowerPack Addons for Elementor <= 3.1.0 - Authenticated (Contributor+) Missing Authorization to Enabled Widgets and Extensions Modification |
Medium 4.3 |
3.1.1 |
| 2026-10-14 |
WPSEC-2026-0861 |
PowerPack Addons for Elementor | PowerPack Addons for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Gradient Background Colors |
Medium 6.4 |
3.1.1 |
| 2026-10-14 |
WPSEC-2026-0860 |
MPG | MPG <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'base-url' Shortcode Attribute |
Medium 6.4 |
4.2.5 |
| 2026-10-13 |
WPSEC-2026-0859 |
Mixed Media Gallery Blocks | Mixed Media Gallery Blocks <= 3.4.4 - Authenticated (Contributor+) Missing Authorization to Shared Media Tag Deletion |
Medium 4.3 |
3.4.5 |
| 2026-10-13 |
WPSEC-2026-0858 |
Mixed Media Gallery Blocks | Mixed Media Gallery Blocks <= 3.4.4 - Authenticated (Author+) Missing Authorization to Media Folder Modification and Deletion |
Medium 4.3 |
3.4.5 |
| 2026-10-13 |
WPSEC-2026-0857 |
Books Gallery – Book Showcase, Library & Affiliate Plugin | Books Gallery – Book Showcase, Library & Affiliate Plugin <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Book Author Meta |
Medium 6.4 |
4.8.5 |
| 2026-10-13 |
WPSEC-2026-0856 |
TI WooCommerce Wishlist | TI WooCommerce Wishlist <= 2.12.1 - Unauthenticated Authorization Bypass to Guest Wishlist Takeover via 'tinv_wishlistkey' Cookie |
Medium 6.5 |
2.13.0 |
| 2026-10-13 |
WPSEC-2026-0855 |
TI WooCommerce Wishlist | TI WooCommerce Wishlist <= 2.12.1 - Unauthenticated Sensitive Information Exposure of Private Wishlists via 'tinvwl-sharekey' Parameter |
Low 3.7 |
2.13.0 |
| 2026-10-13 |
WPSEC-2026-0854 |
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.9 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Booking Calendar Files |
Medium 5.3 |
10.31.10 |
| 2026-10-13 |
WPSEC-2026-0853 |
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Fields |
High 7.2 |
10.31.10 |
| 2026-10-13 |
WPSEC-2026-0852 |
Sprout Invoices – Client Invoicing & Estimates | Sprout Invoices – Client Invoicing & Estimates <= 20.8.18 - Authenticated (Contributor+) Sensitive Information Exposure via Client Associated Users Selector |
Medium 4.3 |
20.8.19 |
| 2026-10-13 |
WPSEC-2026-0851 |
MultiVendorX | MultiVendorX <= 5.0.19 - Authenticated (Store Owner+) Missing Authorization to Global Settings Update via REST API |
Medium 4.3 |
5.0.20 |
| 2026-10-13 |
WPSEC-2026-0850 |
Appointment Booking Plugin & Scheduling System – Webba Booking Calendar | Appointment Booking Plugin & Scheduling System – Webba Booking Calendar <= 6.5.2 - Unauthenticated Insecure Direct Object Reference to Gift Card Code Disclosure via Gift Card Status REST Endpoint |
Medium 6.5 |
6.5.3 |
| 2026-10-13 |
WPSEC-2026-0849 |
Flutterwave Payments | Flutterwave Payments <= 1.0.7 - Unauthenticated Stored Cross-Site Scripting via Transactions List |
High 7.2 |
1.1.0 |
| 2026-10-13 |
WPSEC-2026-0848 |
Flutterwave Payments | Flutterwave Payments <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
Medium 6.4 |
1.1.0 |
| 2026-10-13 |
WPSEC-2026-0847 |
Easy Property Listings | Easy Property Listings <= 3.5.25 - Unauthenticated Reflected Cross-Site Scripting via 'epl_action' Parameter |
Medium 6.1 |
3.5.26 |
| 2026-10-13 |
WPSEC-2026-0846 |
Easy Property Listings | Easy Property Listings <= 3.5.25 - Authenticated (Contributor+) SQL Injection via 'property_status' Shortcode Attribute |
Medium 6.5 |
3.5.26 |
| 2026-10-13 |
WPSEC-2026-0845 |
Sidebar Login | Sidebar Login <= 3.0.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Display Name |
Medium 5.4 |
3.1.0 |
| 2026-10-13 |
WPSEC-2026-0844 |
FluentCart A New Era of eCommerce | FluentCart A New Era of eCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure via Smartcode Injection in Checkout Fields |
High 7.5 |
1.8.0 |
| 2026-10-13 |
WPSEC-2026-0843 |
FunnelKit Payment Gateway for Stripe WooCommerce | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.5 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order Pay Page |
Medium 5.3 |
1.14.0.5.1 |
| 2026-10-13 |
WPSEC-2026-0842 |
FunnelKit Payment Gateway for Stripe WooCommerce | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.4 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page |
Medium 5.3 |
1.14.0.4.1 |
| 2026-10-13 |
WPSEC-2026-0841 |
FunnelKit Payment Gateway for Stripe WooCommerce | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page |
Medium 5.3 |
1.14.0.3.1 |
| 2026-10-13 |
WPSEC-2026-0840 |
FunnelKit Payment Gateway for Stripe WooCommerce | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.2 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page |
Medium 5.3 |
1.14.0.2.1 |
| 2026-10-13 |
WPSEC-2026-0839 |
FunnelKit Payment Gateway for Stripe WooCommerce | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page |
Medium 5.3 |
1.14.0.1.1 |
| 2026-10-13 |
WPSEC-2026-0838 |
FunnelKit Payment Gateway for Stripe WooCommerce | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order-Pay Page |
Medium 5.3 |
1.14.0.0.1 |
| 2026-10-13 |
WPSEC-2026-0837 |
Falang multilanguage for WordPress | Falang multilanguage for WordPress <= 1.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Term Translation |
Medium 6.4 |
1.4.6 |
| 2026-10-13 |
WPSEC-2026-0836 |
WP Booking System | WP Booking System <= 2.1.0.2 - Reflected Cross-Site Scripting via 'booking_id' Parameter |
Medium 6.1 |
2.1.0.3 |
| 2026-10-13 |
WPSEC-2026-0835 |
Blog2Social: Social Media Auto Post & Scheduler | Blog2Social: Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Private and Draft Post Disclosure via 'postId' Parameter |
Medium 4.3 |
9.1.5 |
| 2026-10-13 |
WPSEC-2026-0834 |
TrueBooker – Appointment Booking and Scheduler System | TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Unauthenticated Booking Price Manipulation |
Medium 5.3 |
1.3.0 |
| 2026-10-13 |
WPSEC-2026-0833 |
TrueBooker – Appointment Booking and Scheduler System | TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Unauthenticated Insecure Direct Object Reference to Booking Summary Disclosure |
Medium 5.3 |
1.3.0 |
| 2026-10-13 |
WPSEC-2026-0832 |
TrueBooker – Appointment Booking and Scheduler System | TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Category, Service, Customer and Appointment Deletion |
Medium 5.4 |
1.3.0 |
| 2026-10-13 |
WPSEC-2026-0831 |
TrueBooker – Appointment Booking and Scheduler System | TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Service, Category and Appointment Creation/Modification |
Medium 5.3 |
1.3.0 |
| 2026-10-13 |
WPSEC-2026-0830 |
MailChimp Forms by MailMunch | MailChimp Forms by MailMunch <= 3.2.9 - Cross-Site Request Forgery to MailMunch Account Unlinking |
Medium 4.3 |
3.3.0 |
| 2026-10-13 |
WPSEC-2026-0829 |
Klarna Payments for WooCommerce | Klarna Payments for WooCommerce <= 4.13.3 - Unauthenticated Insecure Direct Object Reference to Order Key and Customer Address Exposure via Order-Pay Page |
Medium 5.3 |
4.13.4 |
| 2026-10-13 |
WPSEC-2026-0828 |
Export and Import Users and Customers | Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Row Injection in Biographical Info |
High 7.1 |
2.7.6 |
| 2026-10-13 |
WPSEC-2026-0827 |
MailMunch – Grow your Email List | MailMunch – Grow your Email List <= 3.1.2 - Authenticated (Subscriber+) Missing Authorization to Account Linking and Widget/Email Management via AJAX Actions |
Medium 5.4 |
3.2.2 |
| 2026-10-13 |
WPSEC-2026-0826 |
Mollie Payments for WooCommerce | Mollie Payments for WooCommerce <= 8.1.10 - Unauthenticated Insufficient Verification of Data Authenticity to Order Payment Bypass via Webhook |
Medium 5.3 |
8.1.11 |
| 2026-10-13 |
WPSEC-2026-0825 |
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) | Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.13 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Shortcode Execution and Campaign Settings Disclosure via Builder Field Preview |
Medium 5.4 |
1.8.13.1 |
| 2026-10-13 |
WPSEC-2026-0824 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Member Name |
Medium 6.4 |
5.3.0 |
| 2026-10-13 |
WPSEC-2026-0823 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Checkbox Field Value |
Medium 6.4 |
5.3.0 |
| 2026-10-13 |
WPSEC-2026-0822 |
Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Unauthenticated Sensitive Information Exposure via Scheduled Entry Export Files |
Medium 5.9 |
1.58.1 |
| 2026-10-13 |
WPSEC-2026-0821 |
Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Unauthenticated Missing Authorization to AWeber Subscriber Modification |
Low 3.7 |
1.58.1 |
| 2026-10-13 |
WPSEC-2026-0820 |
Events Manager – Calendar, Bookings, Tickets, Appointments and more! | Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.7 - Authenticated (Subscriber+) Sensitive Information Exposure via REST API Tickets Endpoints |
Medium 4.3 |
7.4.8 |
| 2026-10-13 |
WPSEC-2026-0819 |
Events Manager – Calendar, Bookings, Tickets, Appointments and more! | Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.7 - Unauthenticated Clickjacking to OAuth Application Authorization |
Medium 6.8 |
7.4.8 |
| 2026-10-13 |
WPSEC-2026-0818 |
User Verification | User Verification <= 2.0.46 - Unauthenticated Insecure Direct Object Reference to Account Lockout via Resend Verification |
Medium 6.5 |
2.0.48 |
| 2026-10-13 |
WPSEC-2026-0817 |
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 - Unauthenticated Reflected Cross-Site Scripting via Script Blocker Placeholder Tokens |
Medium 6.1 |
4.4.7 |
| 2026-10-13 |
WPSEC-2026-0816 |
Zoho CRM Lead Magnet | Zoho CRM Lead Magnet <= 1.8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site-Wide Post HTML Allowlist Modification |
Medium 6.4 |
1.8.2.4 |
| 2026-10-13 |
WPSEC-2026-0815 |
Zoho CRM Lead Magnet | Zoho CRM Lead Magnet <= 1.8.2.3 - Improper Certificate Validation via Globally Disabled SSL Verification |
Medium 4.8 |
1.8.2.4 |
| 2026-10-13 |
WPSEC-2026-0814 |
Zoho CRM Lead Magnet | Zoho CRM Lead Magnet <= 1.8.2.3 - Unauthenticated Reflected Cross-Site Scripting via Form Field Values |
Medium 6.1 |
1.8.2.4 |
| 2026-10-13 |
WPSEC-2026-0813 |
Zoho CRM Lead Magnet | Zoho CRM Lead Magnet <= 1.8.2.3 - Missing Authorization to Authenticated (Subscriber+) Contact Form Field Mapping and CRM User Disclosure |
Medium 4.3 |
1.8.2.4 |
| 2026-10-13 |
WPSEC-2026-0812 |
Advanced Order Export For WooCommerce | Advanced Order Export For WooCommerce <= 4.1.2 - Authenticated (Shop Manager+) SQL Injection via Multiple Export Filter Settings |
Medium 4.9 |
4.1.3 |
| 2026-10-13 |
WPSEC-2026-0811 |
URL Shortify – Simple and Easy URL Shortener | URL Shortify – Simple and Easy URL Shortener <= 2.7.1 - Reflected Cross-Site Scripting via Pricing Page Query Parameters |
Medium 6.1 |
2.7.2 |
| 2026-10-12 |
WPSEC-2026-0810 |
Shopping Cart & eCommerce Store | Shopping Cart & eCommerce Store <= 6.0.3 - Unauthenticated Payment Bypass via Stripe Payment Intent Return Handler |
High 7.5 |
6.0.4 |
| 2026-10-12 |
WPSEC-2026-0809 |
Jekyll Exporter | Jekyll Exporter <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Exported Markdown Content |
Medium 4.4 |
4.4.0 |
| 2026-10-12 |
WPSEC-2026-0808 |
Related Posts for WordPress | Related Posts for WordPress <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title |
Medium 6.4 |
3.0.0 |
| 2026-10-12 |
WPSEC-2026-0807 |
Booking Calendar | Booking Calendar <= 11.9 - Missing Authorization to Unauthenticated Block Times Availability Timeline Disclosure |
Medium 5.3 |
11.9.1 |
| 2026-10-12 |
WPSEC-2026-0806 |
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin | Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wishlist Shortcode 'type' Attribute |
Medium 6.4 |
3.0.2 |
| 2026-10-12 |
WPSEC-2026-0805 |
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin | Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 3.0.1 - Authenticated (Customer+) Stored Cross-Site Scripting via Improper unfiltered_html Capability Assignment |
Medium 6.4 |
3.0.2 |
| 2026-10-12 |
WPSEC-2026-0804 |
Hash Elements | Hash Elements <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel and Logo Carousel Widget 'data-params' Attribute |
Medium 6.4 |
1.5.7 |
| 2026-10-12 |
WPSEC-2026-0803 |
Hash Elements | Hash Elements <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Total Portfolio Masonry Widget 'active_cat' Setting |
Medium 6.4 |
1.5.7 |
| 2026-10-12 |
WPSEC-2026-0802 |
Frontend Admin by DynamiApps | Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Missing Authorization to ACF Options Update |
Medium 5.3 |
3.30.0 |
| 2026-10-12 |
WPSEC-2026-0801 |
Hippoo Mobile App for WooCommerce | Hippoo Mobile App for WooCommerce <= 1.12.0 - Unauthenticated Reflected Cross-Site Scripting via 'token_id' Parameter |
Medium 6.1 |
1.12.1 |
| 2026-10-12 |
WPSEC-2026-0800 |
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via UIkit Component Attributes |
Medium 6.4 |
4.7.1 |
| 2026-10-12 |
WPSEC-2026-0799 |
Real Accessibility | Real Accessibility < 1.1 - Unauthenticated Inclusion of Functionality from Untrusted Control Sphere via Page Reader |
Medium 4.7 |
1.1 |
| 2026-10-12 |
WPSEC-2026-0798 |
Academy LMS | Academy LMS <= 4.0.3 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Course Review Submission |
Medium 4.3 |
4.0.4 |
| 2026-10-12 |
WPSEC-2026-0797 |
Fluent Support – Helpdesk & Customer Support Ticket System | Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.0 - Authenticated (Support Agent+) Missing Authorization to Ticket Closure via Draft Response |
Medium 4.3 |
2.4.5 |
| 2026-10-12 |
WPSEC-2026-0796 |
Fluent Support – Helpdesk & Customer Support Ticket System | Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.0 - Authenticated (Support Agent+) Insecure Direct Object Reference to Restricted Mailbox Tickets via 'on_behalf' Customer Portal Parameter |
Low 3.8 |
2.4.5 |
| 2026-10-12 |
WPSEC-2026-0795 |
Fluent Support – Helpdesk & Customer Support Ticket System | Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.0 - Unauthenticated Sensitive Information Exposure of Agent Details via Customer Portal Ticket Responses |
Medium 5.3 |
2.4.5 |
| 2026-10-12 |
WPSEC-2026-0794 |
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.3 - Unauthenticated Missing Authorization to Image Comment Submission in Restricted Galleries |
Medium 5.3 |
3.7.4 |
| 2026-10-12 |
WPSEC-2026-0793 |
Yotpo: Product & Photo Reviews for WooCommerce | Yotpo: Product & Photo Reviews for WooCommerce < 1.8.3 - Improper Certificate Validation in Yotpo API Requests |
Medium 6.5 |
1.8.3 |
| 2026-10-12 |
WPSEC-2026-0792 |
Yotpo: Product & Photo Reviews for WooCommerce | Yotpo: Product & Photo Reviews for WooCommerce < 1.8.3 - Cross-Site Request Forgery via Sync Widget IDs, Submit Past Orders and Export Reviews Actions |
Medium 4.3 |
1.8.3 |
| 2026-10-12 |
WPSEC-2026-0791 |
Yotpo: Product & Photo Reviews for WooCommerce | Yotpo: Product & Photo Reviews for WooCommerce < 1.8.3 - Unauthenticated Sensitive Information Exposure via Debug Log File |
Low 3.7 |
1.8.3 |
| 2026-10-12 |
WPSEC-2026-0790 |
Frontend Admin by DynamiApps | Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Privilege Escalation via Form Field Keys |
High 8.1 |
3.30.0 |
| 2026-10-12 |
WPSEC-2026-0789 |
Frontend Admin by DynamiApps | Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Arbitrary Post Type Creation and Status Change via Post Type and Post Status Fields |
Low 3.7 |
3.30.0 |
| 2026-10-12 |
WPSEC-2026-0788 |
GeoDirectory | GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Custom Field Values in Dynamic Content Variables |
Medium 4.9 |
2.8.191 |
| 2026-10-12 |
WPSEC-2026-0787 |
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Authenticated (Vendor+) Customer Account Takeover via Customers REST Endpoint |
High 8.1 |
5.3.0 |
| 2026-10-12 |
WPSEC-2026-0786 |
Booktics – Appointment Booking Calendar for Service Businesses | Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Unauthenticated Missing Authorization to Google Calendar Token Overwrite via OAuth Callback |
Medium 4.8 |
1.0.29 |
| 2026-10-12 |
WPSEC-2026-0785 |
Booktics – Appointment Booking Calendar for Service Businesses | Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Unauthenticated Payment Amount Manipulation via Order Currency |
Medium 5.3 |
1.0.29 |
| 2026-10-12 |
WPSEC-2026-0784 |
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Image Accordion Widget Settings |
Medium 6.4 |
8.8.8 |
| 2026-10-12 |
WPSEC-2026-0783 |
Contest Gallery | Contest Gallery <= 34.0.0 - Unauthenticated Voting Restriction Bypass via IP Address Spoofing |
Medium 5.3 |
34.0.1 |
| 2026-10-12 |
WPSEC-2026-0782 |
Persistent Login | Persistent Login <= 3.1.4 - Unauthenticated Content Injection via Freemius SDK 'purchase_completed' Admin Notice |
Low 3.7 |
3.1.5 |
