| 2026-10-12 |
WPSEC-2026-0782 |
Persistent Login | Persistent Login <= 3.1.4 - Unauthenticated Content Injection via Freemius SDK 'purchase_completed' Admin Notice |
Low 3.7 |
3.1.5 |
| 2026-10-12 |
WPSEC-2026-0781 |
ThinkRank AI SEO | ThinkRank AI SEO <= 2.14.2 - Authenticated (Contributor+) Missing Authorization to Restricted ThinkRank REST Endpoints via Mixed-Case Route |
Medium 5.4 |
2.14.3 |
| 2026-10-12 |
WPSEC-2026-0780 |
ThinkRank AI SEO | ThinkRank AI SEO <= 2.14.2 - Unauthenticated Sensitive Information Exposure of Password-Protected Post Content via SEO Meta Tags |
Low 3.7 |
2.14.3 |
| 2026-10-12 |
WPSEC-2026-0779 |
Mang Board | Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '{mode}_type' Parameter |
Critical 9.8 |
2.4.4 |
| 2026-10-12 |
WPSEC-2026-0778 |
Advanced Form Integration | Advanced Form Integration <= 2.10.0 - Unauthenticated PHP Object Injection via Nex-Forms Submission Fields |
High 8.1 |
2.10.3 |
| 2026-10-11 |
WPSEC-2026-0777 |
Indieweb Post Kinds | Indieweb Post Kinds <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Response Properties |
Medium 6.4 |
4.0.0 |
| 2026-10-11 |
WPSEC-2026-0776 |
Ultra Addons for Contact Form 7 | Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated HTML Injection to Server-Side Request Forgery via PDF Generator Form Field Values |
Medium 5.4 |
3.5.55 |
| 2026-10-11 |
WPSEC-2026-0775 |
Ultra Addons for Contact Form 7 | Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via Form File Uploads |
High 7.2 |
3.5.55 |
| 2026-10-11 |
WPSEC-2026-0774 |
Opti-Behavior | Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored Cross-Site Scripting via Browser Name, Referrer and Page Title |
High 7.2 |
1.10.0 |
| 2026-10-11 |
WPSEC-2026-0773 |
JCH Optimize | JCH Optimize <= 6.0.2 - Unauthenticated Stored Cross-Site Scripting via Host Header |
Medium 5.4 |
6.1.0 |
| 2026-10-11 |
WPSEC-2026-0772 |
JCH Optimize | JCH Optimize <= 6.0.2 - Cross-Site Request Forgery to Cache Clearing, .htaccess Modification and Image Backup Deletion |
Medium 5.4 |
6.1.0 |
| 2026-10-11 |
WPSEC-2026-0771 |
JCH Optimize | JCH Optimize <= 6.0.2 - Open Redirect via 'return' Parameter |
Medium 6.1 |
6.1.0 |
| 2026-10-11 |
WPSEC-2026-0770 |
Groundhogg | Groundhogg <= 4.9.2 - Unauthenticated Insecure Direct Object Reference to Unsent and Private Broadcast Disclosure via Campaign Archive |
Medium 5.3 |
4.9.3 |
| 2026-10-11 |
WPSEC-2026-0769 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Author+) Stored Cross-Site Scripting via Question Hint and Explanation |
Medium 6.4 |
4.4.10 |
| 2026-10-11 |
WPSEC-2026-0768 |
Post Views Counter | Post Views Counter <= 1.7.15 - Authenticated (Contributor+) Missing Authorization to Post View Count Modification via REST API |
Medium 4.3 |
1.8.0 |
| 2026-10-11 |
WPSEC-2026-0767 |
Post Views Counter | Post Views Counter <= 1.7.15 - Authenticated (Contributor+) Missing Authorization to Sensitive Information Exposure via pvc_column_chart AJAX Action |
Medium 4.3 |
1.8.0 |
| 2026-10-11 |
WPSEC-2026-0766 |
WooCommerce Payments | WooCommerce Payments <= 11.1.0 - Unauthenticated Insecure Direct Object Reference to Order Update via 'order_id' Parameter |
Medium 5.3 |
11.2.0 |
| 2026-10-11 |
WPSEC-2026-0765 |
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget Cluster Icon |
Medium 6.4 |
4.11.111 |
| 2026-10-11 |
WPSEC-2026-0764 |
WPKoi Templates for Elementor | WPKoi Templates for Elementor <= 3.7.3 - Cross-Site Request Forgery to Customizer Settings Reset |
Medium 4.3 |
3.7.4 |
| 2026-10-11 |
WPSEC-2026-0763 |
WPKoi Templates for Elementor | WPKoi Templates for Elementor <= 3.7.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via Template Import |
Medium 4.3 |
3.7.4 |
| 2026-10-11 |
WPSEC-2026-0762 |
WPKoi Templates for Elementor | WPKoi Templates for Elementor <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
Medium 6.4 |
3.7.4 |
| 2026-10-11 |
WPSEC-2026-0761 |
Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress | Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress <= 1.5.2 - Reflected Cross-Site Scripting via Pricing Page Query Parameters |
Medium 6.1 |
1.5.3 |
| 2026-10-11 |
WPSEC-2026-0760 |
All-in-One Video Gallery | All-in-One Video Gallery <= 4.9.5 - Authenticated (Subscriber+) Server-Side Request Forgery via Featured Image Download |
Medium 6.4 |
4.9.7 |
| 2026-10-11 |
WPSEC-2026-0759 |
All-in-One Video Gallery | All-in-One Video Gallery <= 4.9.5 - Unauthenticated Pricing Page Configuration Injection |
Medium 4.3 |
4.9.7 |
| 2026-10-11 |
WPSEC-2026-0758 |
BP Profile Search | BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion via 'bps_directory' Cookie and 'template' Shortcode Attribute |
Critical 9.8 |
6.0 |
| 2026-10-11 |
WPSEC-2026-0757 |
Meow Lightbox | Meow Lightbox <= 5.6.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content |
Medium 5.4 |
5.6.3 |
| 2026-10-10 |
WPSEC-2026-0756 |
Custom Query Blocks | Custom Query Blocks <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Types Block Attributes |
Medium 6.4 |
5.7.0 |
| 2026-10-10 |
WPSEC-2026-0755 |
Video Conferencing with BigBlueButton (BBB) | Video Conferencing with BigBlueButton (BBB) <= 3.2.16 - Unauthenticated Missing Authorization to Recording Exposure via Fluent Community Lesson Recordings Shortcode |
Low 3.7 |
3.2.17 |
| 2026-10-10 |
WPSEC-2026-0754 |
AM LottiePlayer | AM LottiePlayer <= 4.2.4 - Authenticated (Author+) Denial of Service via .lottie Archive Decompression Bomb |
Medium 6.5 |
4.2.5 |
| 2026-10-10 |
WPSEC-2026-0753 |
Business Places | Business Places <= 2.2.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints |
Medium 5.3 |
2.3.0 |
| 2026-10-10 |
WPSEC-2026-0752 |
Push Notification for Post and BuddyPress | Push Notification for Post and BuddyPress <= 3.23 - Unauthenticated Insecure Direct Object Reference to Push Subscription Registration for Arbitrary Users via User ID Parameters |
Medium 6.5 |
3.24 |
| 2026-10-10 |
WPSEC-2026-0751 |
BuddyPress Member Reviews | BuddyPress Member Reviews <= 3.8.0 - Authenticated (Subscriber+) Missing Authorization to Moderation Bypass via Review Update |
Medium 4.3 |
3.8.1 |
| 2026-10-10 |
WPSEC-2026-0750 |
BuddyPress Member Reviews | BuddyPress Member Reviews <= 3.8.0 - Unauthenticated Sensitive Information Exposure via Review Pages, Single Review View and Member Widgets |
Medium 5.3 |
3.8.1 |
| 2026-10-10 |
WPSEC-2026-0749 |
BuddyPress Member Reviews | BuddyPress Member Reviews <= 3.8.0 - Authenticated (Subscriber+) Missing Authorization to Review Submission Role Restriction Bypass |
Medium 4.3 |
3.8.1 |
| 2026-10-10 |
WPSEC-2026-0748 |
BuddyPress Member Reviews | BuddyPress Member Reviews <= 3.8.0 - Authenticated (Contributor+) Missing Authorization to Review Approval and Report Dismissal |
Medium 4.3 |
3.8.1 |
| 2026-10-10 |
WPSEC-2026-0747 |
Pay With MetaMask For WooCommerce | Pay With MetaMask For WooCommerce <= 1.7.2 - Unauthenticated Payment Verification Bypass via Forged ERC-20 Token Transfer |
High 7.5 |
1.7.3 |
| 2026-10-10 |
WPSEC-2026-0746 |
Action Network | Action Network <= 1.8.5 - Unauthenticated Reflected Cross-Site Scripting via Signup Widget Form Fields |
Medium 6.1 |
1.9.0 |
| 2026-10-10 |
WPSEC-2026-0745 |
Action Network | Action Network <= 1.8.5 - Cross-Site Request Forgery to Bulk Action Deletion and Hiding |
Medium 4.3 |
1.9.0 |
| 2026-10-10 |
WPSEC-2026-0744 |
Action Network | Action Network <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via actionnetwork_list and actionnetwork_calendar Shortcode Attributes |
Medium 6.4 |
1.9.0 |
| 2026-10-10 |
WPSEC-2026-0743 |
Bus Ticket Booking with Seat Reservation | Bus Ticket Booking with Seat Reservation <= 5.9.7 - Unauthenticated Price Manipulation via Ticket Type and Seat Selection |
Medium 5.3 |
5.9.8 |
| 2026-10-10 |
WPSEC-2026-0742 |
annasta Woocommerce Product Filters | annasta Woocommerce Product Filters <= 1.8.4 - Authenticated (Author+) Stored Cross-Site Scripting via Meta Data Filter Values |
Medium 4.9 |
1.8.5 |
| 2026-10-10 |
WPSEC-2026-0741 |
annasta Woocommerce Product Filters | annasta Woocommerce Product Filters <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Caller ID Attribute |
Medium 6.4 |
1.8.5 |
| 2026-10-10 |
WPSEC-2026-0740 |
PDF Invoices & Packing Slips for WooCommerce | PDF Invoices & Packing Slips for WooCommerce <= 5.16.3 - Authenticated (Subscriber+) Missing Authorization to Order Information Disclosure via Document Number Preview |
Medium 4.3 |
5.16.4 |
| 2026-10-10 |
WPSEC-2026-0739 |
Testimonial Customer Feedback | Testimonial Customer Feedback <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute |
Medium 6.4 |
1.2.9 |
| 2026-10-10 |
WPSEC-2026-0738 |
WP OAuth Server ( Login with WordPress ) | WP OAuth Server ( Login with WordPress ) <= 6.4.0 - Unauthenticated Missing Authorization to OAuth Client Registration via MCP Dynamic Client Registration Endpoint |
Medium 6.8 |
6.5.0 |
| 2026-10-10 |
WPSEC-2026-0737 |
Event Post | Event Post <= 6.1.1 - Authenticated (Subscriber+) Missing Authorization to Child Event Creation |
Medium 4.3 |
6.1.2 |
| 2026-10-10 |
WPSEC-2026-0736 |
Event Post | Event Post <= 6.1.1 - Unauthenticated Sensitive Information Exposure via Child Events of Non-Public Posts |
Low 3.7 |
6.1.2 |
| 2026-10-10 |
WPSEC-2026-0735 |
Event Post | Event Post <= 6.1.1 - Authenticated (Contributor+) Missing Authorization to Event Metadata Update |
Medium 4.3 |
6.1.2 |
| 2026-10-10 |
WPSEC-2026-0734 |
Event Post | Event Post <= 6.1.1 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Deletion |
Medium 6.5 |
6.1.2 |
| 2026-10-10 |
WPSEC-2026-0733 |
SuperFaktura WooCommerce | SuperFaktura WooCommerce <= 1.56.1 - Cross-Site Request Forgery to Invoice Creation and Regeneration |
Medium 4.3 |
1.57.0 |
| 2026-10-10 |
WPSEC-2026-0732 |
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management | Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management <= 4.6.27 - Unauthenticated Stored Cross-Site Scripting via Stripe Billing Details |
High 7.2 |
4.6.28 |
| 2026-10-10 |
WPSEC-2026-0731 |
Better Messages | Better Messages <= 3.0.13 - Unauthenticated Missing Authorization to User Listing via getUsers REST API Endpoint |
Medium 5.3 |
3.0.14 |
| 2026-10-10 |
WPSEC-2026-0730 |
Docket Cache | Docket Cache <= 26.04.07 - Unauthenticated Sensitive Information Exposure via Predictable Cache Log File |
Medium 5.9 |
26.04.08 |
| 2026-10-10 |
WPSEC-2026-0729 |
CMB2 | CMB2 <= 2.13.3 - Reflected Cross-Site Scripting via Object ID Request Parameters |
Medium 6.1 |
2.13.4 |
| 2026-10-10 |
WPSEC-2026-0728 |
CMB2 | CMB2 <= 2.13.3 - Unauthenticated Sensitive Information Exposure via REST API Field Endpoints |
Medium 5.3 |
2.13.4 |
| 2026-10-10 |
WPSEC-2026-0727 |
Record of Consent Extension for Complianz | Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter |
Medium 6.1 |
2.6 |
| 2026-10-10 |
WPSEC-2026-0726 |
VikRentCar Car Rental Management System | VikRentCar Car Rental Management System <= 1.4.6 - Reflected Cross-Site Scripting via Pagination Links |
Medium 6.1 |
1.4.7 |
| 2026-10-10 |
WPSEC-2026-0725 |
VikRentCar Car Rental Management System | VikRentCar Car Rental Management System <= 1.4.6 - Reflected Cross-Site Scripting via Trackings Active Tab Parameter |
Medium 6.1 |
1.4.7 |
| 2026-10-10 |
WPSEC-2026-0724 |
VikRentCar Car Rental Management System | VikRentCar Car Rental Management System <= 1.4.6 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter |
Medium 6.1 |
1.4.7 |
| 2026-10-10 |
WPSEC-2026-0723 |
OTP Login With Phone Number, OTP Verification | OTP Login With Phone Number, OTP Verification <= 1.8.74 - Unauthenticated Authentication Bypass via OTP Brute Force |
High 8.1 |
1.8.76 |
| 2026-10-10 |
WPSEC-2026-0722 |
Ads + Pixel for Meta | Ads + Pixel for Meta <= 1.2.2 - Unauthenticated Insecure Direct Object Reference to Order Information Disclosure via 'order-received' Parameter |
Medium 5.3 |
1.2.3 |
| 2026-10-10 |
WPSEC-2026-0721 |
WP Encryption | WP Encryption <= 7.8.8.1 - Cross-Site Request Forgery to SSL Validation and HTTPS Enforcement |
Medium 4.3 |
7.8.8.2 |
| 2026-10-10 |
WPSEC-2026-0720 |
WP Encryption | WP Encryption <= 7.8.8.1 - Missing Authorization to Unauthenticated SSL Domain Verification Continuation |
Medium 5.3 |
7.8.8.2 |
| 2026-10-10 |
WPSEC-2026-0719 |
miniOrange OTP Login, Verification and SMS Notifications | miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 - Unauthenticated Authentication Bypass via Login OTP Phone Number |
Critical 9.8 |
5.5.8 |
| 2026-10-10 |
WPSEC-2026-0718 |
miniOrange OTP Login, Verification and SMS Notifications | miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 - Unauthenticated Two-Factor Authentication Bypass via Delay OTP Verification Setting |
High 7.4 |
5.5.8 |
| 2026-10-10 |
WPSEC-2026-0717 |
FluentCart A New Era of eCommerce | FluentCart A New Era of eCommerce <= 1.7.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via 'order_id' Parameter |
Medium 5.3 |
1.7.1 |
| 2026-10-10 |
WPSEC-2026-0716 |
FluentCart A New Era of eCommerce | FluentCart A New Era of eCommerce <= 1.7.0 - Unauthenticated Integer Overflow to Order Total Manipulation via Cart Quantity |
Medium 5.3 |
1.7.1 |
| 2026-10-10 |
WPSEC-2026-0715 |
LifterLMS | LifterLMS <= 10.3.0 - Unauthenticated Deleted Access Plan Purchase via Checkout |
Medium 5.3 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0714 |
LifterLMS | LifterLMS <= 10.3.0 - Authenticated (Contributor+) Sensitive Information Exposure via select2_query_posts |
Medium 4.3 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0713 |
LifterLMS | LifterLMS <= 10.3.0 - Unauthenticated Insecure Direct Object Reference to Pending Order Takeover via Checkout |
Medium 6.5 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0712 |
LifterLMS | LifterLMS <= 10.3.0 - Authenticated (Subscriber+) CSV Injection via Reporting Exports |
Medium 4.6 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0711 |
LifterLMS | LifterLMS <= 10.3.0 - Unauthenticated Sensitive Information Exposure via Certificate oEmbed and Canonical Redirects |
Medium 5.3 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0710 |
LifterLMS | LifterLMS <= 10.3.0 - Authentication Bypass via REST API Key Route Restriction |
Medium 5.4 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0709 |
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Authenticated (Shop Worker+) PHP Object Injection via Integrations REST API |
Medium 6.6 |
4.9.4 |
| 2026-10-10 |
WPSEC-2026-0708 |
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Reflected Cross-Site Scripting via 'live_mode' Parameter |
Medium 6.1 |
4.9.4 |
| 2026-10-10 |
WPSEC-2026-0707 |
Product Feed Manager for WooCommerce | Product Feed Manager for WooCommerce <= 8.0.32 - Unauthenticated Sensitive Information Exposure via Log Files |
Low 3.7 |
8.0.33 |
| 2026-10-10 |
WPSEC-2026-0706 |
LifterLMS | LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via lifterlms_checkout Shortcode |
High 8.8 |
10.3.2 |
| 2026-10-10 |
WPSEC-2026-0705 |
Braintree for WooCommerce Payment Gateway | Braintree for WooCommerce Payment Gateway <= 3.12.0 - Unauthenticated 3D Secure and Card Security Code Verification Bypass via Client-Controlled Checkout Fields |
Low 3.7 |
3.12.1 |
| 2026-10-10 |
WPSEC-2026-0704 |
Braintree for WooCommerce Payment Gateway | Braintree for WooCommerce Payment Gateway <= 3.12.0 - Unauthenticated Payment Verification Bypass via Unvalidated Payment Method Nonce Type |
Low 3.7 |
3.12.1 |
| 2026-10-10 |
WPSEC-2026-0703 |
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.22 - Authenticated (Subscriber+) Payment Bypass via Stripe Checkout Plan Selection |
Medium 4.3 |
2.9.23 |
| 2026-10-10 |
WPSEC-2026-0702 |
Patreon WordPress | Patreon WordPress <= 1.10.0 - Cross-Site Request Forgery to Image Lock Level Update |
Medium 4.3 |
1.11.0 |
| 2026-10-10 |
WPSEC-2026-0701 |
WP STAGING WordPress Backup Plugin – Migration Backup Restore | WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.16.0 - Unauthenticated Sensitive Information Exposure via Corrupted Staging Site Report File |
Medium 5.9 |
4.17.0 |
| 2026-10-10 |
WPSEC-2026-0700 |
AI Powered Marketing | AI Powered Marketing <= 1.5.4 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Order Received Page |
Medium 5.3 |
1.5.5 |
| 2026-10-10 |
WPSEC-2026-0699 |
AI Engine | AI Engine <= 3.8.3 - Authenticated (Contributor+) Missing Authorization to Chatbot Configuration Override via 'mwai_chatbot' Shortcode |
Medium 5.4 |
3.8.4 |
| 2026-10-10 |
WPSEC-2026-0698 |
AI Engine | AI Engine <= 3.8.3 - Missing Authorization to Unauthenticated AI Search and Limited Information Exposure via 'search' REST Endpoint |
Medium 6.5 |
3.8.4 |
| 2026-10-10 |
WPSEC-2026-0697 |
WP Compress | WP Compress <= 7.25.00 - Authenticated (Subscriber+) Privilege Escalation via Plugin Role Permissions |
Medium 5.0 |
7.26.00 |
| 2026-10-10 |
WPSEC-2026-0696 |
FunnelKit – Funnel Builder for WooCommerce Checkout | FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Received Page Tracking Data |
Medium 4.7 |
3.16.0.6 |
| 2026-10-10 |
WPSEC-2026-0695 |
WPCode | WPCode <= 2.3.9 - Unauthenticated Snippet Execution Bypass via 'wpcode-safe-mode' Parameter |
Medium 5.3 |
2.4.0 |
| 2026-10-10 |
WPSEC-2026-0694 |
HUSKY | HUSKY <= 1.4.2 - Unauthenticated Reflected Cross-Site Scripting via 'woof_text' Parameter |
Medium 6.1 |
1.4.5 |
| 2026-10-10 |
WPSEC-2026-0693 |
HUSKY | HUSKY <= 1.4.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'JavaScript code after AJAX is done' Setting |
Medium 5.5 |
1.4.5 |
| 2026-10-10 |
WPSEC-2026-0692 |
Wallet for WooCommerce | Wallet for WooCommerce <= 1.7.2 - Authenticated (Subscriber+) Business Logic Flaw to Unpaid Wallet Credit via Cash on Delivery Top-Up |
Medium 5.3 |
1.7.3 |
| 2026-10-10 |
WPSEC-2026-0691 |
Contact Form 7 Multi-Step Forms | Contact Form 7 Multi-Step Forms <= 4.7 - Unauthenticated Reflected Cross-Site Scripting via 'l10n_print_after' Form Field |
Medium 6.1 |
4.7.1 |
| 2026-10-10 |
WPSEC-2026-0690 |
JetFormBuilder | JetFormBuilder <= 3.6.6 - Unauthenticated Missing Authorization to Media Field Value Modification |
Low 3.7 |
3.6.6.1 |
| 2026-10-10 |
WPSEC-2026-0689 |
JetFormBuilder | JetFormBuilder <= 3.6.6 - Unauthenticated Insecure Direct Object Reference to Anonymous Post Update and Trash |
Medium 5.3 |
3.6.6.1 |
| 2026-10-10 |
WPSEC-2026-0688 |
BetterDocs | BetterDocs <= 4.9.3 - Unauthenticated Sensitive Information Exposure via Private and Draft Doc Titles |
Medium 5.3 |
4.9.4 |
| 2026-10-10 |
WPSEC-2026-0687 |
WPConsent | WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comments |
Medium 5.4 |
1.2.0 |
| 2026-10-10 |
WPSEC-2026-0686 |
Blocksy Companion | Blocksy Companion <= 2.1.58 - Authenticated (Contributor+) Sensitive Information Exposure via blocksy_posts Shortcode |
Medium 4.3 |
2.1.59 |
| 2026-10-10 |
WPSEC-2026-0685 |
Jeg Kit for Elementor | Jeg Kit for Elementor <= 3.2.20 - Authenticated (Subscriber+) Missing Authorization to User Enumeration via Element Option and Author Search AJAX Actions |
Medium 4.3 |
3.2.21 |
| 2026-10-09 |
WPSEC-2026-0684 |
WP Rollback | WP Rollback <= 3.1.2 - Unauthenticated Sensitive Information Exposure via Predictable Backup Archive Paths |
Low 3.7 |
3.2.0 |
| 2026-10-09 |
WPSEC-2026-0683 |
Wallet for WooCommerce | Wallet for WooCommerce <= 1.7.1 - Unauthenticated Business Logic Flaw to Unlimited Wallet Credit via Visit Referral Rewards |
Medium 5.3 |
1.7.2 |
