If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation following an attack. Most security breaches we observe originate from automated attacks that exploit known software vulnerabilities, often the same ones that have been previously reported and disclosed.

To assist in maintaining your security posture, we have compiled this month’s summary of essential security updates and vulnerability patches pertinent to the WordPress ecosystem.

For those already utilizing the Sucuri Firewall, your website is protected, as these vulnerabilities are effectively addressed for all clients. If you do not currently have such protection, it is advisable to deploy a web application firewall to prevent attacks from reaching your environment.

Plugins

WooCommerce – Unauthenticated Denial of Service

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Denial of Service
CVE: CVE-2026-48888
Number of Installations: 7,000,000+
Affected Software: WooCommerce < 11.1.0
Patched Versions: 11.1.0

Mitigation steps: Update to WooCommerce version 11.1.0 or greater.

LiteSpeed Cache – Unauthenticated Server-Side Request Forgery

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Server-Side Request Forgery
CVE: CVE-2026-84761
Number of Installations: 7,000,000+
Affected Software: LiteSpeed Cache ≤ 7.9
Patched Versions: 7.9.1

Mitigation steps: Update to LiteSpeed Cache version 7.9.1 or greater.

WooCommerce – Authenticated (Shop Manager+) SQL Injection

Security Risk: High
Exploitation Level: Requires Shop Manager or higher level authentication.
Vulnerability: Authenticated (Shop Manager+) SQL Injection
CVE: CVE-2026-57777
Number of Installations: 7,000,000+
Affected Software: WooCommerce ≤ 10.9.4
Patched Versions: 11.0

Mitigation steps: Update to WooCommerce version 11.0 or greater.

LiteSpeed Cache – Reflected Cross-Site Scripting via ESI ‘esi’ Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via ESI 'esi' Parameter
CVE: CVE-2026-76579
Number of Installations: 7,000,000+
Affected Software: LiteSpeed Cache ≤ 7.9
Patched Versions: 7.9.1

Mitigation steps: Update to LiteSpeed Cache version 7.9.1 or greater.

WPForms – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-84744
Number of Installations: 5,000,000+
Affected Software: WPForms 1.5.0.1 - 2.0.2
Patched Versions: 2.0.2.1

Mitigation steps: Update to WPForms version 2.0.2.1 or greater.

WPForms – Reflected Cross-Site Scripting via ‘page_title’ POST Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 'page_title' POST Parameter
CVE: CVE-2026-88996
Number of Installations: 5,000,000+
Affected Software: WPForms ≤ 2.0.2
Patched Versions: 2.0.2.1

Mitigation steps: Update to WPForms version 2.0.2.1 or greater.

WPForms – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-74991
Number of Installations: 5,000,000+
Affected Software: WPForms 1.8.8.2 - 2.0.1.1
Patched Versions: 2.0.2

Mitigation steps: Update to WPForms version 2.0.2 or greater.

All-in-One WP Migration and Backup – Unauthenticated Insufficient Credential Protection via Authorization Basic Header

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insufficient Credential Protection via Authorization Basic Header
CVE: CVE-2026-89064
Number of Installations: 5,000,000+
Affected Software: All-in-One WP Migration and Backup ≤ 7.110
Patched Versions: 7.111

Mitigation steps: Update to All-in-One WP Migration and Backup version 7.111 or greater.

All-in-One WP Migration and Backup – Authenticated (Admin+) Privilege Escalation

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Authenticated (Admin+) Privilege Escalation
CVE: CVE-2026-81810
Number of Installations: 5,000,000+
Affected Software: All-in-One WP Migration and Backup ≤ 7.110
Patched Versions: 7.111

Mitigation steps: Update to All-in-One WP Migration and Backup version 7.111 or greater.

Rank Math SEO – Unauthenticated Information Exposure

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-77783
Number of Installations: 4,000,000+
Affected Software: Rank Math SEO < 1.0.277
Patched Versions: 1.0.277

Mitigation steps: Update to Rank Math SEO version 1.0.277 or greater.

UpdraftPlus: WP Backup & Migration Plugin – Authenticated (Subscriber+) Information Exposure

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Information Exposure
CVE: CVE-2026-82841
Number of Installations: 4,000,000+
Affected Software: UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.26.7
Patched Versions: 2.26.8.26

Mitigation steps: Update to UpdraftPlus: WP Backup & Migration Plugin version 2.26.8.26 or greater.

Rank Math SEO – Missing Authorization to Authenticated (Author+) SEO Object Updates

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Missing Authorization to Authenticated (Author+) SEO Object Updates
CVE: CVE-2026-77784
Number of Installations: 4,000,000+
Affected Software: Rank Math SEO < 1.0.277
Patched Versions: 1.0.277

Mitigation steps: Update to Rank Math SEO version 1.0.277 or greater.

Rank Math SEO – Authenticated (Author+) Information Exposure

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Information Exposure
CVE: CVE-2026-77785
Number of Installations: 4,000,000+
Affected Software: Rank Math SEO < 1.0.277
Patched Versions: 1.0.277

Mitigation steps: Update to Rank Math SEO version 1.0.277 or greater.

Really Simple Security – Unauthenticated Denial of Service

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Denial of Service
CVE: CVE-2026-84775
Number of Installations: 3,000,000+
Affected Software: Really Simple Security ≤ 9.8.0
Patched Versions: 9.8.1

Mitigation steps: Update to Really Simple Security version 9.8.1 or greater.

Jetpack – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: Not provided
Number of Installations: 3,000,000+
Affected Software: Jetpack 16.1 - 16.1.2
Patched Versions: 16.1.3

Mitigation steps: Update to Jetpack version 16.1.3 or greater.

Jetpack – Authenticated (Administrator+) PHP Object Injection

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) PHP Object Injection
CVE: Not provided
Number of Installations: 3,000,000+
Affected Software: Jetpack 12.0 - 12.0.2
Patched Versions: 16.1.3

Mitigation steps: Update to Jetpack version 16.1.3 or greater.

Jetpack – Authenticated (Administrator+) PHP Object Injection

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) PHP Object Injection
CVE: Not provided
Number of Installations: 3,000,000+
Affected Software: Jetpack 16.1 - 16.1.2
Patched Versions: 16.1.3

Mitigation steps: Update to Jetpack version 16.1.3 or greater.

Jetpack – Reflected to Stored Cross-Site Scripting via Reader Repost Parameters

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Reflected to Stored Cross-Site Scripting via Reader Repost Parameters
CVE: Not provided
Number of Installations: 3,000,000+
Affected Software: Jetpack 14.5
Patched Versions: 16.1.3

Mitigation steps: Update to Jetpack version 16.1.3 or greater.

Really Simple Security – Unauthenticated Unbounded Option Growth

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability:  Unauthenticated Unbounded Option Growth
CVE: CVE-2026-88798
Number of Installations: 3,000,000+
Affected Software: Really Simple Security ≤ 9.8.2
Patched Versions: 9.8.3

Mitigation steps: Update to Really Simple Security version 9.8.3 or greater.

Really Simple Security – Unauthenticated Two-Factor Authentication Bypass

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability:  Unauthenticated Two-Factor Authentication Bypass
CVE: CVE-2026-89080
Number of Installations: 3,000,000+
Affected Software: Really Simple Security ≤ 9.8.0
Patched Versions: 9.8.1

Mitigation steps: Update to Really Simple Security version 9.8.1 or greater.

Really Simple Security – Unauthenticated Two-Factor Authentication Bypass

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Two-Factor Authentication Bypass
CVE: CVE-2026-84777
Number of Installations: 3,000,000+
Affected Software: Really Simple Security ≤ 9.8.0
Patched Versions: 9.8.1

Mitigation steps: Update to Really Simple Security version 9.8.1 or greater.

Really Simple Security – Missing Authorization to 2FA Bypass

Security Risk: Medium
Exploitation Level: Requires custom role.
Vulnerability: Missing Authorization to 2FA Bypass
CVE: CVE-2026-82519
Number of Installations: 3,000,000+
Affected Software: Really Simple Security ≤ 9.8.1
Patched Versions: 9.8.2

Mitigation steps: Update to Really Simple Security version 9.8.2 or greater.

Jetpack – Missing Authorization on WPCOM Media API Attachment Parent

Security Risk: Medium
Exploitation Level: Requires custom role.
Vulnerability: Missing Authorization on WPCOM Media API Attachment Parent
CVE: CVE-2024-10858
Number of Installations: 3,000,000+
Affected Software: Jetpack 3.2 - 16.1.2
Patched Versions: 16.1.3

Mitigation steps: Update to Jetpack version 16.1.3 or greater.

All in One SEO – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-82884
Number of Installations: 2,000,000+
Affected Software: All in One SEO ≤ 5.0.0.0
Patched Versions: 5.0.0.1

Mitigation steps: Update to All in One SEO version 5.0.0.1 or greater.

Complianz GDPR/CCPA Cookie Consent Banner – Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex
CVE: CVE-2026-83561
Number of Installations: 1,000,000+
Affected Software: Complianz GDPR/CCPA Cookie Consent Banner ≤ 7.5.4
Patched Versions: 7.5.5

Mitigation steps: Update to Complianz GDPR/CCPA Cookie Consent Banner version 7.5.5 or greater.

EWWW Image Optimizer – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-84773
Number of Installations: 1,000,000+
Affected Software: EWWW Image Optimizer ≤ 8.7.6
Patched Versions: 8.7.7

Mitigation steps: Update to EWWW Image Optimizer version 8.7.7 or greater.

EWWW Image Optimizer – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-97067
Number of Installations: 1,000,000+
Affected Software: EWWW Image Optimizer ≤ 8.7.7
Patched Versions: 8.8.0

Mitigation steps: Update to EWWW Image Optimizer version 8.8.0 or greater.

ElementsKit Elementor Addons – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-94500
Number of Installations: 1,000,000+
Affected Software: ElementsKit Elementor Addons ≤ 4.0.5
Patched Versions: 4.0.6

Mitigation steps: Update to ElementsKit Elementor Addons version 4.0.6 or greater.

Safe SVG – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-94077
Number of Installations: 1,000,000+
Affected Software: Safe SVG ≤ 2.5.0
Patched Versions: 2.5.1

Mitigation steps: Update to Safe SVG version 2.5.1 or greater.

EWWW Image Optimizer – Authenticated (Author+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
CVE: CVE-2026-91011
Number of Installations: 1,000,000+
Affected Software: EWWW Image Optimizer ≤ 8.7.6
Patched Versions: 8.7.7

Mitigation steps: Update to EWWW Image Optimizer version 8.7.7 or greater.

All-In-One Security (AIOS) – Authenticated (Subscriber+) Security Control Bypass

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Security Control Bypass
CVE: CVE-2026-96825
Number of Installations: 1,000,000+
Affected Software: All-In-One Security (AIOS) ≤ 5.4.8
Patched Versions: 5.4.9

Mitigation steps: Update to All-In-One Security (AIOS) version 5.4.9 or greater.

MC4WP: Mailchimp for WordPress – Reflected Cross-Site Scripting via ‘data’ Dynamic Content Tag

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
CVE: CVE-2026-87917
Number of Installations: 1,000,000+
Affected Software: MC4WP: Mailchimp for WordPress ≤ 4.14.0
Patched Versions: 4.14.1

Mitigation steps: Update to MC4WP: Mailchimp for WordPress version 4.14.1 or greater.

Spectra Legacy – Authenticated (Contributor+) Sensitive Information Exposure

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Sensitive Information Exposure
CVE: CVE-2026-16302
Number of Installations: 1,000,000+
Affected Software: Spectra Legacy ≤ 2.20.0
Patched Versions: 2.20.1

Mitigation steps: Update to Spectra Legacy version 2.20.1 or greater.

Safe SVG – Authenticated (Contributor+) Insecure Direct Object Reference

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Insecure Direct Object Reference
CVE: CVE-2026-94672
Number of Installations: 1,000,000+
Affected Software: Safe SVG ≤ 2.5.0
Patched Versions: 2.5.1

Mitigation steps: Update to Safe SVG version 2.5.1 or greater.

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg – Authenticated (Contributor+) Insecure Direct Object Reference

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Insecure Direct Object Reference
CVE: CVE-2026-62134
Number of Installations: 1,000,000+
Affected Software: Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg ≤ 4.7.5
Patched Versions: 4.7.6

Mitigation steps: Update to Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg version 4.7.6 or greater.

W3 Total Cache – Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
CVE: CVE-2026-78438
Number of Installations: 900,000+
Affected Software: W3 Total Cache ≤ 2.10.5
Patched Versions: 2.10.6

Mitigation steps: Update to W3 Total Cache version 2.10.6 or greater.

WPvivid – Authenticated (Administrator+) Arbitrary File Upload

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) Arbitrary File Upload
CVE: CVE-2026-82193
Number of Installations: 900,000+
Affected Software: WPvivid < 0.9.134
Patched Versions: 0.9.134

Mitigation steps: Update to WPvivid version 0.9.134 or greater.

Translate WordPress with GTranslate – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-86604
Number of Installations: 900,000+
Affected Software: Translate WordPress with GTranslate ≤ 5.0.0
Patched Versions: 5.0.1

Mitigation steps: Update to Translate WordPress with GTranslate version 5.0.1 or greater.

WPvivid – Authenticated (Administrator+) Arbitrary File Deletion

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) Arbitrary File Deletion
CVE: CVE-2026-82194
Number of Installations: 900,000+
Affected Software: WPvivid < 0.9.134
Patched Versions: 0.9.134

Mitigation steps: Update to WPvivid version 0.9.134 or greater.

Redux Framework – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘user-mediaurl’ Media Field

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
CVE: CVE-2026-90992
Number of Installations: 900,000+
Affected Software: Redux Framework ≤ 4.5.14
Patched Versions: 4.5.15

Mitigation steps: Update to Redux Framework version 4.5.15 or greater.

Redux Framework – Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
CVE: CVE-2026-5410
Number of Installations: 900,000+
Affected Software: Redux Framework ≤ 4.5.13
Patched Versions: 4.5.14

Mitigation steps: Update to Redux Framework version 4.5.14 or greater.

Redux Framework – Authenticated (Subscriber+) Cross-Site Scripting via User Input

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Cross-Site Scripting via User Input
CVE: CVE-2026-5400
Number of Installations: 900,000+
Affected Software: Redux Framework ≤ 4.5.13
Patched Versions: 4.5.14

Mitigation steps: Update to Redux Framework version 4.5.14 or greater.

Redux Framework – Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
CVE: CVE-2026-5399
Number of Installations: 900,000+
Affected Software: Redux Framework ≤ 4.5.13.1
Patched Versions: 4.5.14

Mitigation steps: Update to Redux Framework version 4.5.14 or greater.

WPvivid – Authenticated (Administrator+) SQL Injection

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) SQL Injection
CVE: CVE-2026-82182
Number of Installations: 900,000+
Affected Software: WPvivid < 0.9.133
Patched Versions: 0.9.133

Mitigation steps: Update to WPvivid version 0.9.133 or greater.

Translate WordPress with GTranslate – Authenticated (Administrator+) Stored Cross-Site Scripting

Security Risk: Minimal
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
CVE: CVE-2025-15695
Number of Installations: 900,000+
Affected Software: Translate WordPress with GTranslate < 3.0.10
Patched Versions: 3.0.10

Mitigation steps: Update to Translate WordPress with GTranslate version 3.0.10 or greater.

Redux Framework – Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via ‘attachment_id’ Parameter

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
CVE: CVE-2026-88999
Number of Installations: 900,000+
Affected Software: Redux Framework ≤ 4.5.14
Patched Versions: 4.5.15

Mitigation steps: Update to Redux Framework version 4.5.15 or greater.

Autoptimize – Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
CVE: CVE-2026-14995
Number of Installations: 800,000+
Affected Software: Autoptimize ≤ 3.1.15.1
Patched Versions: 3.1.16

Mitigation steps: Update to Autoptimize version 3.1.16 or greater.

Breadcrumb NavXT – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-84765
Number of Installations: 800,000+
Affected Software: Breadcrumb NavXT ≤ 7.5.1
Patched Versions: 7.5.2

Mitigation steps: Update to Breadcrumb NavXT version 7.5.2 or greater.

Polylang – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-97279
Number of Installations: 800,000+
Affected Software: Polylang ≤ 3.8.9
Patched Versions: 3.8.10

Mitigation steps: Update to Polylang version 3.8.10 or greater.

Smart Slider 3 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘data-href’ Attribute in Custom HTML Block

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
CVE: CVE-2026-14876
Number of Installations: 800,000+
Affected Software: Smart Slider 3 ≤ 3.5.1.38
Patched Versions: 3.5.1.39

Mitigation steps: Update to Smart Slider 3 version 3.5.1.39 or greater.

Flamingo – Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
CVE: CVE-2026-12853
Number of Installations: 800,000+
Affected Software: Flamingo ≤ 2.6.2
Patched Versions: 2.6.3

Mitigation steps: Update to Flamingo version 2.6.3 or greater.

Popup Maker – Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
CVE: CVE-2026-87915
Number of Installations: 700,000+
Affected Software: Popup Maker ≤ 1.24.0
Patched Versions: 1.25.0

Mitigation steps: Update to Popup Maker version 1.25.0 or greater.

Popup Maker – Authenticated (Contributor+) Stored Cross-Site Scripting via post_title

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
CVE: CVE-2026-15797
Number of Installations: 700,000+
Affected Software: Popup Maker ≤ 1.24.0
Patched Versions: 1.25.0

Mitigation steps: Update to Popup Maker version 1.25.0 or greater.

The Events Calendar – Unauthenticated Code Injection to Remote Code Execution via Widget ‘classes’ Map Callable Invocation

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
CVE: CVE-2026-78159
Number of Installations: 600,000+
Affected Software: The Events Calendar ≤ 6.17.3
Patched Versions: 6.17.3.1

Mitigation steps: Update to The Events Calendar version 6.17.3.1 or greater.

The Events Calendar – Unauthenticated PHP Object Injection to Remote Code Execution

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated PHP Object Injection to Remote Code Execution
CVE: CVE-2026-78006
Number of Installations: 600,000+
Affected Software: The Events Calendar ≤ 6.17.4
Patched Versions: 6.17.4.1

Mitigation steps: Update to The Events Calendar version 6.17.4.1 or greater.

Forminator Forms – Unauthenticated Arbitrary Shortcode Execution via ‘current_url’ Parameter

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
CVE: CVE-2026-92229
Number of Installations: 600,000+
Affected Software: Forminator Forms ≤ 1.57.2
Patched Versions: 1.57.3

Mitigation steps: Update to Forminator Forms version 1.57.3 or greater.

Ninja Forms – Unauthenticated PHP Object Injection

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated PHP Object Injection
CVE: CVE-2026-91827
Number of Installations: 600,000+
Affected Software: Ninja Forms ≤ 3.15.3
Patched Versions: 3.15.4

Mitigation steps: Update to Ninja Forms version 3.15.4 or greater.

Forminator Forms – Unauthenticated Stored Cross-Site Scripting via ‘postdata-1[post-custom]’ Parameter

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
CVE: CVE-2026-92144
Number of Installations: 600,000+
Affected Software: Forminator Forms ≤ 1.57.2
Patched Versions: 1.57.2.1

Mitigation steps: Update to Forminator Forms version 1.57.2.1 or greater.

Forminator Forms – Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
CVE: CVE-2026-85235
Number of Installations: 600,000+
Affected Software: Forminator Forms ≤ 1.57.2
Patched Versions: 1.57.2.1

Mitigation steps: Update to Forminator Forms version 1.57.2.1 or greater.

WP Statistics – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-93770
Number of Installations: 600,000+
Affected Software: WP Statistics ≤ 14.16.13
Patched Versions: 14.16.14

Mitigation steps: Update to WP Statistics version 14.16.14 or greater.

Ninja Forms – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-95515
Number of Installations: 600,000+
Affected Software: Ninja Forms ≤ 3.15.3
Patched Versions: 3.15.4

Mitigation steps: Update to Ninja Forms version 3.15.4 or greater.

Ninja Forms – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-92438
Number of Installations: 600,000+
Affected Software: Ninja Forms ≤ 3.15.3
Patched Versions: 3.15.4

Mitigation steps: Update to Ninja Forms version 3.15.4 or greater.

Forminator Forms – Authenticated (Admin+) Privilege Escalation

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Authenticated (Admin+) Privilege Escalation
CVE: CVE-2026-87068
Number of Installations: 600,000+
Affected Software: Forminator Forms ≤ 1.57.2.0
Patched Versions: 1.57.2.1

Mitigation steps: Update to Forminator Forms version 1.57.2.1 or greater.

Royal Addons for Elementor – Unauthenticated Arbitrary HTML Injection in Notification Emails

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary HTML Injection in Notification Emails
CVE: CVE-2026-13407
Number of Installations: 600,000+
Affected Software: Royal Addons for Elementor ≤ 1.7.1066
Patched Versions: 1.7.1067

Mitigation steps: Update to Royal Addons for Elementor version 1.7.1067 or greater.

Ninja Forms – Unauthenticated Stored Cross-Site Scripting via Repeater Child ‘type’ Confusion via Unmatched Array Key

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
CVE: CVE-2026-19769
Number of Installations: 600,000+
Affected Software: Ninja Forms ≤ 3.15.1
Patched Versions: 3.15.2

Mitigation steps: Update to Ninja Forms version 3.15.2 or greater.

WP Statistics – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-84774
Number of Installations: 600,000+
Affected Software: WP Statistics ≤ 14.16.11
Patched Versions: 14.16.12

Mitigation steps: Update to WP Statistics version 14.16.12 or greater.

Under Construction – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-81295
Number of Installations: 600,000+
Affected Software: Under Construction ≤ 5.82
Patched Versions: 5.83

Mitigation steps: Update to Under Construction version 5.83 or greater.

Forminator Forms – Authenticated (Admin+) PHP Object Injection

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Authenticated (Admin+) PHP Object Injection
CVE: CVE-2026-87067
Number of Installations: 600,000+
Affected Software: Forminator Forms ≤ 1.57.2.0
Patched Versions: 1.57.2.1

Mitigation steps: Update to Forminator Forms version 1.57.2.1 or greater.

Ninja Forms – Authenticated (Administrator+) PHP Object Injection via Form Import

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) PHP Object Injection via Form Import
CVE: CVE-2026-11363
Number of Installations: 600,000+
Affected Software: Ninja Forms ≤ 3.14.6
Patched Versions: 3.14.7

Mitigation steps: Update to Ninja Forms version 3.14.7 or greater.

Ninja Forms – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-80437
Number of Installations: 600,000+
Affected Software: Ninja Forms 3.14.10 - 3.15.1
Patched Versions: 3.15.2

Mitigation steps: Update to Ninja Forms version 3.15.2 or greater.

Premium Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-94168
Number of Installations: 600,000+
Affected Software: Premium Addons for Elementor ≤ 4.11.105
Patched Versions: 4.11.106

Mitigation steps: Update to Premium Addons for Elementor version 4.11.106 or greater.

The Events Calendar – Unauthenticated Information Exposure

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-84741
Number of Installations: 600,000+
Affected Software: The Events Calendar 4.5 - 6.17.4.1
Patched Versions: 6.17.5

Mitigation steps: Update to The Events Calendar version 6.17.5 or greater.

Forminator Forms – Unauthenticated Poll Vote Limit Bypass

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Poll Vote Limit Bypass
CVE: CVE-2026-87070
Number of Installations: 600,000+
Affected Software: Forminator Forms ≤ 1.57.2.0
Patched Versions: 1.57.2.1

Mitigation steps: Update to Forminator Forms version 1.57.2.1 or greater.

Forminator Forms – Missing Authorization to Unauthenticated Arbitrary Post Meta Injection

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated Arbitrary Post Meta Injection
CVE: CVE-2026-87071
Number of Installations: 600,000+
Affected Software: Forminator Forms ≤ 1.57.2.0
Patched Versions: 1.57.2.1

Mitigation steps: Update to Forminator Forms version 1.57.2.1 or greater.

Royal Addons for Elementor – Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in ‘wpr_keyword’ Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
CVE: CVE-2026-17585
Number of Installations: 600,000+
Affected Software: Royal Addons for Elementor ≤ 1.7.1066
Patched Versions: 1.7.1067

Mitigation steps: Update to Royal Addons for Elementor version 1.7.1067 or greater.

MetForm – Unauthenticated Email Header Injection

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Email Header Injection
CVE: CVE-2026-86813
Number of Installations: 600,000+
Affected Software: MetForm < 4.1.9
Patched Versions: 4.1.9

Mitigation steps: Update to MetForm version 4.1.9 or greater.

The Events Calendar – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Missing Authorization
CVE: CVE-2026-97285
Number of Installations: 600,000+
Affected Software: The Events Calendar ≤ 6.17.5
Patched Versions: 6.17.5.1

Mitigation steps: Update to The Events Calendar version 6.17.5.1 or greater.

Forminator Forms – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Missing Authorization
CVE: CVE-2026-87069
Number of Installations: 600,000+
Affected Software: Forminator Forms ≤ 1.57.2.0
Patched Versions: 1.57.2.1

Mitigation steps: Update to Forminator Forms version 1.57.2.1 or greater.

The Events Calendar – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Missing Authorization
CVE: CVE-2026-84742
Number of Installations: 600,000+
Affected Software: The Events Calendar 6.15.0 - 6.17.4.1
Patched Versions: 6.17.5

Mitigation steps: Update to The Events Calendar version 6.17.5 or greater.

The Events Calendar – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Missing Authorization
CVE: CVE-2026-84743
Number of Installations: 600,000+
Affected Software: The Events Calendar 6.15.16.1 - 6.17.4.1
Patched Versions: 6.17.5

Mitigation steps: Update to The Events Calendar version 6.17.5 or greater.

The Events Calendar – Authenticated (Contributor+) Information Exposure

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Information Exposure
CVE: CVE-2026-84745
Number of Installations: 600,000+
Affected Software: The Events Calendar < 6.17.3.1
Patched Versions: 6.17.3.1

Mitigation steps: Update to The Events Calendar version 6.17.3.1 or greater.

Ninja Forms – Authenticated (Custom Role+) Information Exposure

Security Risk: High
Exploitation Level: Requires Custom Role or higher level authentication.
Vulnerability: Authenticated (Custom Role+) Information Exposure
CVE: CVE-2026-80438
Number of Installations: 600,000+
Affected Software: Ninja Forms 3.14.0 - 3.15.1
Patched Versions: 3.15.2

Mitigation steps: Update to Ninja Forms version 3.15.2 or greater.

Extendify – Unauthenticated Stored Cross-Site Scripting via ‘styles.blocks’ Block Type Key

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
CVE: CVE-2026-85679
Number of Installations: 500,000+
Affected Software: Extendify ≤ 3.1.6
Patched Versions: 3.2.0

Mitigation steps: Update to Extendify version 3.2.0 or greater.

Ninja Forms – Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Stored Cross-Site Scripting
CVE: CVE-2026-94504
Number of Installations: 500,000+
Affected Software: Ninja Forms ≤ 3.15.3
Patched Versions: 3.15.4

Mitigation steps: Update to Ninja Forms version 3.15.4 or greater.

Kirki – Unauthenticated Stored Cross-Site Scripting via ‘comment’ Parameter

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
CVE: CVE-2026-17037
Number of Installations: 500,000+
Affected Software: Kirki ≤ 6.2.0
Patched Versions: 6.2.1

Mitigation steps: Update to Kirki version 6.2.1 or greater.

Kirki – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-84219
Number of Installations: 500,000+
Affected Software: Kirki 6.2.1 - 6.2.5
Patched Versions: 6.3.0

Mitigation steps: Update to Kirki version 6.3.0 or greater.

SureForms – Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
CVE: CVE-2026-18406
Number of Installations: 500,000+
Affected Software: SureForms ≤ 2.12.2
Patched Versions: 2.12.3

Mitigation steps: Update to SureForms version 2.12.3 or greater.

Broken Link Checker – Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
CVE: CVE-2026-75528
Number of Installations: 500,000+
Affected Software: Broken Link Checker ≤ 2.4.13
Patched Versions: 2.4.13.1

Mitigation steps: Update to Broken Link Checker version 2.4.13.1 or greater.

Ocean Extra – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-94684
Number of Installations: 500,000+
Affected Software: Ocean Extra ≤ 2.6.1
Patched Versions: 2.6.2

Mitigation steps: Update to Ocean Extra version 2.6.2 or greater.

Kirki – Authenticated (Author+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
CVE: CVE-2026-84223
Number of Installations: 500,000+
Affected Software: Kirki 6.0.0 - 6.3.0
Patched Versions: 6.3.1

Mitigation steps: Update to Kirki version 6.3.1 or greater.

Broken Link Checker – Authenticated (Editor+) Server-Side Request Forgery

Security Risk: Low
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: Authenticated (Editor+) Server-Side Request Forgery
CVE: CVE-2026-84772
Number of Installations: 500,000+
Affected Software: Broken Link Checker ≤ 2.4.14
Patched Versions: 2.4.14.1

Mitigation steps: Update to Broken Link Checker version 2.4.14.1 or greater.

Kirki – Unauthenticated Blind Server-Side Request Forgery via ‘kirki_data’ Parameter

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
CVE: CVE-2026-18335
Number of Installations: 500,000+
Affected Software: Kirki ≤ 6.2.0
Patched Versions: 6.2.1

Mitigation steps: Update to Kirki version 6.2.1 or greater.

Kirki – Unauthenticated Information Exposure

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-84222
Number of Installations: 500,000+
Affected Software: Kirki 6.2.1 - 6.2.5
Patched Versions: 6.3.0

Mitigation steps: Update to Kirki version 6.3.0 or greater.

SureForms – Unauthenticated Insecure Direct Object Reference

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference
CVE: CVE-2026-85308
Number of Installations: 500,000+
Affected Software: SureForms ≤ 2.12.5
Patched Versions: 2.12.6

Mitigation steps: Update to SureForms version 2.12.6 or greater.

Kirki – Authenticated (Editor+) SQL Injection

Security Risk: Medium
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: Authenticated (Editor+) SQL Injection
CVE: CVE-2026-84221
Number of Installations: 500,000+
Affected Software: Kirki 6.0.0 - 6.2.5
Patched Versions: 6.3.0

Mitigation steps: Update to Kirki version 6.3.0 or greater.

Kirki – Authenticated (Custom Role+) Insecure Direct Object Reference

Security Risk: High
Exploitation Level: Requires Custom Role or higher level authentication.
Vulnerability: Authenticated (Custom Role+) Insecure Direct Object Reference
CVE: CVE-2026-84225
Number of Installations: 500,000+
Affected Software: Kirki 6.0.0 - 6.2.5
Patched Versions: 6.3.0

Mitigation steps: Update to Kirki version 6.3.0 or greater.

TranslatePress – Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
CVE: CVE-2026-89412
Number of Installations: 400,000+
Affected Software: TranslatePress ≤ 3.3.5
Patched Versions: 3.3.6

Mitigation steps: Update to TranslatePress version 3.3.6 or greater.

Template Kit – Authenticated (Editor+) Arbitrary File Deletion

Security Risk: Medium
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: Authenticated (Editor+) Arbitrary File Deletion
CVE: CVE-2026-96824
Number of Installations: 400,000+
Affected Software: Template Kit ≤ 1.0.16
Patched Versions: 1.0.17

Mitigation steps: Update to Template Kit version 1.0.17 or greater.

HappyAddons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-62080
Number of Installations: 400,000+
Affected Software: HappyAddons for Elementor ≤ 3.23.1
Patched Versions: 3.50.0

Mitigation steps: Update to HappyAddons for Elementor version 3.50.0 or greater.

PixelYourSite – Authenticated (Subscriber+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting
CVE: CVE-2026-95530
Number of Installations: 400,000+
Affected Software: PixelYourSite ≤ 11.4.1
Patched Versions: 11.4.2

Mitigation steps: Update to PixelYourSite version 11.4.2 or greater.

HappyAddons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-85006
Number of Installations: 400,000+
Affected Software: HappyAddons for Elementor ≤ 3.49.0
Patched Versions: 3.50.0

Mitigation steps: Update to HappyAddons for Elementor version 3.50.0 or greater.

SureRank SEO – Unauthenticated Information Exposure

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-78152
Number of Installations: 400,000+
Affected Software: SureRank SEO 1.6.2 - 1.10.0
Patched Versions: 1.10.1

Mitigation steps: Update to SureRank SEO version 1.10.1 or greater.

YITH WooCommerce Wishlist – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-82305
Number of Installations: 400,000+
Affected Software: YITH WooCommerce Wishlist < 4.18.1
Patched Versions: 4.18.1

Mitigation steps: Update to YITH WooCommerce Wishlist version 4.18.1 or greater.

BackWPup – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires custom role.
Vulnerability: Missing Authorization
CVE: CVE-2026-86815
Number of Installations: 400,000+
Affected Software: BackWPup 5.2.2 - 5.7.4
Patched Versions: 5.7.5

Mitigation steps: Update to BackWPup version 5.7.5 or greater.

ShortPixel Image Optimizer – Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

Security Risk: High
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
CVE: CVE-2026-17086
Number of Installations: 300,000+
Affected Software: ShortPixel Image Optimizer ≤ 6.5.5
Patched Versions: 6.5.6

Mitigation steps: Update to ShortPixel Image Optimizer version 6.5.6 or greater.

Photo Gallery, Sliders, Proofing and Themes – Unauthenticated Arbitrary File Read

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary File Read
CVE: CVE-2026-94123
Number of Installations: 300,000+
Affected Software: Photo Gallery, Sliders, Proofing and Themes ≤ 4.5.0
Patched Versions: 4.5.1

Mitigation steps: Update to Photo Gallery, Sliders, Proofing and Themes version 4.5.1 or greater.

ShortPixel Image Optimizer – Authenticated (Subscriber+) PHP Object Injection

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) PHP Object Injection
CVE: CVE-2026-97246
Number of Installations: 300,000+
Affected Software: ShortPixel Image Optimizer ≤ 6.5.5
Patched Versions: 6.5.6

Mitigation steps: Update to ShortPixel Image Optimizer version 6.5.6 or greater.

Unlimited Elements For Elementor – Authenticated (Subscriber+) PHP Object Injection

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) PHP Object Injection
CVE: CVE-2026-85017
Number of Installations: 300,000+
Affected Software: Unlimited Elements For Elementor ≤ 2.0.19
Patched Versions: 2.0.20

Mitigation steps: Update to Unlimited Elements For Elementor version 2.0.20 or greater.

Unlimited Elements For Elementor – Unauthenticated SQL Injection

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated SQL Injection
CVE: CVE-2026-18561
Number of Installations: 300,000+
Affected Software: Unlimited Elements For Elementor ≤ 2.0.16
Patched Versions: 2.0.17

Mitigation steps: Update to Unlimited Elements For Elementor version 2.0.17 or greater.

WP Go Maps – Unauthenticated Denial of Service

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Denial of Service
CVE: CVE-2026-84780
Number of Installations: 300,000+
Affected Software: WP Go Maps ≤ 10.1.08
Patched Versions: 10.1.09

Mitigation steps: Update to WP Go Maps version 10.1.09 or greater.

PDF Invoices & Packing Slips for WooCommerce – Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
CVE: CVE-2026-92244
Number of Installations: 300,000+
Affected Software: PDF Invoices & Packing Slips for WooCommerce ≤ 5.16.1
Patched Versions: 5.16.2

Mitigation steps: Update to PDF Invoices & Packing Slips for WooCommerce version 5.16.2 or greater.

Ad Inserter – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-97077
Number of Installations: 300,000+
Affected Software: Ad Inserter ≤ 2.8.18
Patched Versions: 2.8.19

Mitigation steps: Update to Ad Inserter version 2.8.19 or greater.

Photo Gallery, Sliders, Proofing and Themes – Authenticated (Admin+) Arbitrary File Upload

Security Risk: High
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Authenticated (Admin+) Arbitrary File Upload
CVE: CVE-2026-81650
Number of Installations: 300,000+
Affected Software: Photo Gallery, Sliders, Proofing and Themes ≤ 4.4.0
Patched Versions: 4.5.0

Mitigation steps: Update to Photo Gallery, Sliders, Proofing and Themes version 4.5.0 or greater.

Jeg Kit for Elementor – Unauthenticated Stored Cross-Site Scripting via Comment Content

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content
CVE: CVE-2026-18405
Number of Installations: 300,000+
Affected Software: Jeg Kit for Elementor ≤ 3.2.16
Patched Versions: 3.2.17

Mitigation steps: Update to Jeg Kit for Elementor version 3.2.17 or greater.

Unlimited Elements For Elementor – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-84820
Number of Installations: 300,000+
Affected Software: Unlimited Elements For Elementor ≤ 2.0.17
Patched Versions: 2.0.18

Mitigation steps: Update to Unlimited Elements For Elementor version 2.0.18 or greater.

Formidable Forms – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-19857
Number of Installations: 300,000+
Affected Software: Formidable Forms ≤ 6.34
Patched Versions: 6.35

Mitigation steps: Update to Formidable Forms version 6.35 or greater.

Duplicate Post – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘noti_token’ Parameter

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter
CVE: CVE-2026-89424
Number of Installations: 300,000+
Affected Software: Duplicate Post ≤ 1.5.6
Patched Versions: 1.5.7

Mitigation steps: Update to Duplicate Post version 1.5.7 or greater.

Ad Inserter – Authenticated (Subscriber+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting
CVE: CVE-2026-81655
Number of Installations: 300,000+
Affected Software: Ad Inserter 2.8.12 - 2.8.18
Patched Versions: 2.8.19

Mitigation steps: Update to Ad Inserter version 2.8.19 or greater.

Unlimited Elements For Elementor – Authenticated (Contributor+) Server-Side Request Forgery

Security Risk: Low
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Server-Side Request Forgery
CVE: CVE-2026-66608
Number of Installations: 300,000+
Affected Software: Unlimited Elements For Elementor ≤ 2.0.19
Patched Versions: 2.0.20

Mitigation steps: Update to Unlimited Elements For Elementor version 2.0.20 or greater.

SEOPress – Authenticated (Contributor+) Server-Side Request Forgery

Security Risk: Low
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Server-Side Request Forgery
CVE: CVE-2026-85305
Number of Installations: 300,000+
Affected Software: SEOPress ≤ 10.1
Patched Versions: 10.2

Mitigation steps: Update to SEOPress version 10.2 or greater.

Ad Inserter – Reflected Cross-Site Scripting via ‘s’ Search Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 's' Search Parameter
CVE: CVE-2026-89427
Number of Installations: 300,000+
Affected Software: Ad Inserter ≤ 2.8.18
Patched Versions: 2.8.19

Mitigation steps: Update to Ad Inserter version 2.8.19 or greater.

Ad Inserter – Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
CVE: CVE-2026-19902
Number of Installations: 300,000+
Affected Software: Ad Inserter ≤ 2.8.18
Patched Versions: 2.8.19

Mitigation steps: Update to Ad Inserter version 2.8.19 or greater.

Unlimited Elements For Elementor – Reflected Cross-Site Scripting

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting
CVE: CVE-2026-77150
Number of Installations: 300,000+
Affected Software: Unlimited Elements For Elementor ≤ 2.0.16
Patched Versions: 2.0.17

Mitigation steps: Update to Unlimited Elements For Elementor version 2.0.17 or greater.

Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Reflected Cross-Site Scripting

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting
CVE: CVE-2026-18964
Number of Installations: 300,000+
Affected Software: Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button ≤ 3.5.9
Patched Versions: 3.6.0

Mitigation steps: Update to Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button version 3.6.0 or greater.

Unlimited Elements For Elementor – Reflected Cross-Site Scripting via ‘formData[id]’ Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 'formData[id]' Parameter
CVE: CVE-2026-75586
Number of Installations: 300,000+
Affected Software: Unlimited Elements For Elementor ≤ 2.0.17
Patched Versions: 2.0.18

Mitigation steps: Update to Unlimited Elements For Elementor version 2.0.18 or greater.

Blocksy Companion – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-97247
Number of Installations: 300,000+
Affected Software: Blocksy Companion ≤ 2.1.55
Patched Versions: 2.1.56

Mitigation steps: Update to Blocksy Companion version 2.1.56 or greater.

Breeze Cache – Unauthenticated Cache Poisoning

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Cache Poisoning
CVE: CVE-2026-79713
Number of Installations: 300,000+
Affected Software: Breeze Cache ≤ 2.5.14
Patched Versions: 2.5.15

Mitigation steps: Update to Breeze Cache version 2.5.15 or greater.

Ad Inserter – Missing Authorization to Unauthenticated Header/Footer Code Disclosure via ‘ai-debug-code’ Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
CVE: CVE-2026-11984
Number of Installations: 300,000+
Affected Software: Ad Inserter ≤ 2.8.16
Patched Versions: 2.8.17

Mitigation steps: Update to Ad Inserter version 2.8.17 or greater.

Formidable Forms – Unauthenticated Content Injection

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Content Injection
CVE: CVE-2026-85641
Number of Installations: 300,000+
Affected Software: Formidable Forms ≤ 6.34
Patched Versions: 6.35

Mitigation steps: Update to Formidable Forms version 6.35 or greater.

Otter Blocks – Missing Authorization to Unauthenticated Purchase Verification Bypass

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated Purchase Verification Bypass
CVE: CVE-2026-4945
Number of Installations: 300,000+
Affected Software: Otter Blocks ≤ 3.1.7
Patched Versions: 3.1.8

Mitigation steps: Update to Otter Blocks version 3.1.8 or greater.

Unlimited Elements For Elementor – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-85304
Number of Installations: 300,000+
Affected Software: Unlimited Elements For Elementor ≤ 2.0.17
Patched Versions: 2.0.18

Mitigation steps: Update to Unlimited Elements For Elementor version 2.0.18 or greater.

WP Activity Log – Authenticated (Administrator+) SQL Injection

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) SQL Injection
CVE: CVE-2026-62085
Number of Installations: 300,000+
Affected Software: WP Activity Log ≤ 5.6.6
Patched Versions: 5.6.7

Mitigation steps: Update to WP Activity Log version 5.6.7 or greater.

CMB2 – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Missing Authorization
CVE: CVE-2026-80338
Number of Installations: 300,000+
Affected Software: CMB2 ≤ 2.12.0
Patched Versions: 2.13.0

Mitigation steps: Update to CMB2 version 2.13.0 or greater.

Photo Gallery, Sliders, Proofing and Themes – Authenticated (Admin+) Insecure Direct Object Reference

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Authenticated (Admin+) Insecure Direct Object Reference
CVE: CVE-2026-81654
Number of Installations: 300,000+
Affected Software: Photo Gallery, Sliders, Proofing and Themes ≤ 4.4.0
Patched Versions: 4.5.0

Mitigation steps: Update to Photo Gallery, Sliders, Proofing and Themes version 4.5.0 or greater.

Photo Gallery, Sliders, Proofing and Themes – Authenticated (Contributor+) Insecure Direct Object Reference

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Insecure Direct Object Reference
CVE: CVE-2026-81652
Number of Installations: 300,000+
Affected Software: Photo Gallery, Sliders, Proofing and Themes ≤ 4.4.0
Patched Versions: 4.5.0

Mitigation steps: Update to Photo Gallery, Sliders, Proofing and Themes version 4.5.0 or greater.

CartFlows – Authenticated (Contributor+) Remote Code Execution

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Remote Code Execution
CVE: CVE-2026-96837
Number of Installations: 200,000+
Affected Software: CartFlows ≤ 3.2.0
Patched Versions: 3.2.1

Mitigation steps: Update to CartFlows version 3.2.1 or greater.

Migrate Guru – Unauthenticated Denial of Service

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Denial of Service
CVE: CVE-2026-84778
Number of Installations: 200,000+
Affected Software: Migrate Guru ≤ 6.65
Patched Versions: 6.72

Mitigation steps: Update to Migrate Guru version 6.72 or greater.

MalCare WordPress Security Plugin – Unauthenticated Denial of Service

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Denial of Service
CVE: CVE-2026-84776
Number of Installations: 200,000+
Affected Software: MalCare WordPress Security Plugin ≤ 6.69
Patched Versions: 6.72

Mitigation steps: Update to MalCare WordPress Security Plugin version 6.72 or greater.

CMP – Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action

Security Risk: High
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
CVE: CVE-2026-12470
Number of Installations: 200,000+
Affected Software: CMP ≤ 4.1.17
Patched Versions: 4.1.18

Mitigation steps: Update to CMP version 4.1.18 or greater.

Ultimate Member – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-85680
Number of Installations: 200,000+
Affected Software: Ultimate Member ≤ 2.13.0
Patched Versions: 2.13.1

Mitigation steps: Update to Ultimate Member version 2.13.1 or greater.

Optimole – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-84829
Number of Installations: 200,000+
Affected Software: Optimole ≤ 4.2.11
Patched Versions: 4.2.12

Mitigation steps: Update to Optimole version 4.2.12 or greater.

Spam protection, Honeypot, Anti-Spam by CleanTalk – Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder
CVE: CVE-2026-77830
Number of Installations: 200,000+
Affected Software: Spam protection, Honeypot, Anti-Spam by CleanTalk ≤ 6.86
Patched Versions: 6.87

Mitigation steps: Update to Spam protection, Honeypot, Anti-Spam by CleanTalk version 6.87 or greater.

iubenda – Unauthenticated Stored Cross-Site Scripting via Comment Content

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content
CVE: CVE-2026-77263
Number of Installations: 200,000+
Affected Software: iubenda ≤ 3.13.4
Patched Versions: 3.13.5

Mitigation steps: Update to iubenda version 3.13.5 or greater.

iubenda – Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite
CVE: CVE-2026-77233
Number of Installations: 200,000+
Affected Software: iubenda ≤ 3.13.4
Patched Versions: 3.13.5

Mitigation steps: Update to iubenda version 3.13.5 or greater.

InfiniteWP Client – Authenticated (Admin+) SQL Injection via ‘iwp_get_comments_*’ Array Key

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
CVE: CVE-2026-17576
Number of Installations: 200,000+
Affected Software: InfiniteWP Client ≤ 1.13.9
Patched Versions: 1.13.10

Mitigation steps: Update to InfiniteWP Client version 1.13.10 or greater.

Spam protection, Honeypot, Anti-Spam by CleanTalk – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-19855
Number of Installations: 200,000+
Affected Software: Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87
Patched Versions: 6.87

Mitigation steps: Update to Spam protection, Honeypot, Anti-Spam by CleanTalk version 6.87 or greater.

Redirection for Contact Form 7 – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-80439
Number of Installations: 200,000+
Affected Software: Redirection for Contact Form 7 2.2.7 - 3.2.10
Patched Versions: 3.2.11

Mitigation steps: Update to Redirection for Contact Form 7 version 3.2.11 or greater.

Gutenberg Essential Blocks – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘marker’ Attribute

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
CVE: CVE-2026-96256
Number of Installations: 200,000+
Affected Software: Gutenberg Essential Blocks ≤ 6.4.5
Patched Versions: 6.4.6

Mitigation steps: Update to Gutenberg Essential Blocks version 6.4.6 or greater.

Qi Addons For Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-62079
Number of Installations: 200,000+
Affected Software: Qi Addons For Elementor ≤ 1.11
Patched Versions: 1.11.1

Mitigation steps: Update to Qi Addons For Elementor version 1.11.1 or greater.

Supreme Modules Lite – Authenticated (Author+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
CVE: CVE-2026-102384
Number of Installations: 200,000+
Affected Software: Supreme Modules Lite ≤ 2.5.63
Patched Versions: 2.5.64

Mitigation steps: Update to Supreme Modules Lite version 2.5.64 or greater.

Optimole – Authenticated (Author+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
CVE: CVE-2026-96531
Number of Installations: 200,000+
Affected Software: Optimole 4.0.0 - 4.2.12
Patched Versions: 4.2.13

Mitigation steps: Update to Optimole version 4.2.13 or greater.

DearFlip – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘.dvcss’ Element Class Attribute

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
CVE: CVE-2026-8623
Number of Installations: 200,000+
Affected Software: DearFlip ≤ 2.4.30
Patched Versions: 2.4.37

Mitigation steps: Update to DearFlip version 2.4.37 or greater.

Social Chat – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘consent_message’ JSON Attribute in .qlwapp data-box

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box
CVE: CVE-2026-18404
Number of Installations: 200,000+
Affected Software: Social Chat ≤ 8.6.2
Patched Versions: 8.6.3

Mitigation steps: Update to Social Chat version 8.6.3 or greater.

DearFlip – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘.df-element’ Element Inner HTML

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
CVE: CVE-2026-8625
Number of Installations: 200,000+
Affected Software: DearFlip ≤ 2.4.30
Patched Versions: 2.4.37

Mitigation steps: Update to DearFlip version 2.4.37 or greater.

JetBackup – Authenticated (Subscriber+) Privilege Escalation

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Privilege Escalation
CVE: CVE-2026-19453
Number of Installations: 200,000+
Affected Software: JetBackup 3.1.7.9 - 3.1.23.3
Patched Versions: 3.1.23.5

Mitigation steps: Update to JetBackup version 3.1.23.5 or greater.

Qi Addons For Elementor – Reflected DOM-Based Cross-Site Scripting via ‘s’ Parameter

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Reflected DOM-Based Cross-Site Scripting via 's' Parameter
CVE: CVE-2026-92249
Number of Installations: 200,000+
Affected Software: Qi Addons For Elementor ≤ 1.11
Patched Versions: 1.11.1

Mitigation steps: Update to Qi Addons For Elementor version 1.11.1 or greater.

Newsletter – Reflected Cross-Site Scripting via ‘nn’ Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 'nn' Parameter
CVE: CVE-2026-90981
Number of Installations: 200,000+
Affected Software: Newsletter ≤ 9.3.8
Patched Versions: 9.3.9

Mitigation steps: Update to Newsletter version 9.3.9 or greater.

Simple CAPTCHA with Cloudflare Turnstile – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-66632
Number of Installations: 200,000+
Affected Software: Simple CAPTCHA with Cloudflare Turnstile ≤ 1.42.1
Patched Versions: 1.42.3

Mitigation steps: Update to Simple CAPTCHA with Cloudflare Turnstile version 1.42.3 or greater.

FileBird – Authenticated (Author+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting
CVE: CVE-2026-15004
Number of Installations: 200,000+
Affected Software: FileBird ≤ 6.5.6
Patched Versions: 6.5.7

Mitigation steps: Update to FileBird version 6.5.7 or greater.

Mailchimp for WooCommerce – Unauthenticated Insecure Direct Object Reference

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference
CVE: CVE-2026-92436
Number of Installations: 200,000+
Affected Software: Mailchimp for WooCommerce ≤ 6.2
Patched Versions: 6.3

Mitigation steps: Update to Mailchimp for WooCommerce version 6.3 or greater.

TikTok – Missing Authorization to Unauthenticated TikTok Integration Takeover via ‘auth_code’ Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
CVE: CVE-2026-18346
Number of Installations: 200,000+
Affected Software: TikTok ≤ 1.4.1
Patched Versions: 1.4.2

Mitigation steps: Update to TikTok version 1.4.2 or greater.

TikTok – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-92965
Number of Installations: 200,000+
Affected Software: TikTok 1.2.0 - 1.4.1
Patched Versions: 1.4.2

Mitigation steps: Update to TikTok version 1.4.2 or greater.

Mailchimp for WooCommerce – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-92435
Number of Installations: 200,000+
Affected Software: Mailchimp for WooCommerce ≤ 6.1.0
Patched Versions: 6.1.1

Mitigation steps: Update to Mailchimp for WooCommerce version 6.1.1 or greater.

Simple CAPTCHA with Cloudflare Turnstile – Captcha Bypass

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Captcha Bypass
CVE: CVE-2026-66674
Number of Installations: 200,000+
Affected Software: Simple CAPTCHA with Cloudflare Turnstile ≤ 1.42.1
Patched Versions: 1.42.3

Mitigation steps: Update to Simple CAPTCHA with Cloudflare Turnstile version 1.42.3 or greater.

Appointment Booking Plugin – Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
CVE: CVE-2026-92966
Number of Installations: 100,000+
Affected Software: Appointment Booking Plugin ≤ 5.7.0
Patched Versions: 5.7.1

Mitigation steps: Update to Appointment Booking Plugin version 5.7.1 or greater.

Tutor LMS – Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
CVE: CVE-2026-78175
Number of Installations: 100,000+
Affected Software: Tutor LMS ≤ 4.0.7
Patched Versions: 4.0.8

Mitigation steps: Update to Tutor LMS version 4.0.8 or greater.

Modula Image Gallery – Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via ‘file’ Parameter

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
CVE: CVE-2026-92713
Number of Installations: 100,000+
Affected Software: Modula Image Gallery ≤ 3.0.2
Patched Versions: 3.0.3

Mitigation steps: Update to Modula Image Gallery version 3.0.3 or greater.

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘eup_bio’ Biography Field (Entity-Encoded Shortcode Bracket)

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
CVE: CVE-2026-85658
Number of Installations: 100,000+
Affected Software: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content ≤ 4.17.2
Patched Versions: 4.17.3

Mitigation steps: Update to Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content version 4.17.3 or greater.

Two Factor – Unauthenticated Denial of Service

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Denial of Service
CVE: CVE-2026-100508
Number of Installations: 100,000+
Affected Software: Two Factor ≤ 0.16.0
Patched Versions: 0.17.0

Mitigation steps: Update to Two Factor version 0.17.0 or greater.

Modula Image Gallery – Missing Authorization to Unauthenticated Private Gallery Image Disclosure via ‘modula_gallery_id’ and ‘modula_image_id’ Parameters

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
CVE: CVE-2026-89406
Number of Installations: 100,000+
Affected Software: Modula Image Gallery ≤ 3.0.1
Patched Versions: 3.0.2

Mitigation steps: Update to Modula Image Gallery version 3.0.2 or greater.

GiveWP – Unauthenticated Privilege Escalation

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Privilege Escalation
CVE: CVE-2026-85530
Number of Installations: 100,000+
Affected Software: GiveWP ≤ 4.16.8.0
Patched Versions: 4.16.8.1

Mitigation steps: Update to GiveWP version 4.16.8.1 or greater.

Advanced Custom Fields: Extended – Unauthenticated Privilege Escalation

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Privilege Escalation
CVE: CVE-2026-80467
Number of Installations: 100,000+
Affected Software: Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6
Patched Versions: 0.9.2.7

Mitigation steps: Update to Advanced Custom Fields: Extended version 0.9.2.7 or greater.

GiveWP – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-96830
Number of Installations: 100,000+
Affected Software: GiveWP ≤ 4.16.9
Patched Versions: 4.17.0

Mitigation steps: Update to GiveWP version 4.17.0 or greater.

پارسی دیت – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-96836
Number of Installations: 100,000+
Affected Software: پارسی دیت ≤ 6.3
Patched Versions: 6.4

Mitigation steps: Update to پارسی دیت version 6.4 or greater.

WPS Limit Login – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-93622
Number of Installations: 100,000+
Affected Software: WPS Limit Login ≤ 1.5.9.3
Patched Versions: 1.5.9.4

Mitigation steps: Update to WPS Limit Login version 1.5.9.4 or greater.

Asset CleanUp: Page Speed Booster – Unauthenticated Stored Cross-Site Scripting via Comment Content

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content
CVE: CVE-2026-13354
Number of Installations: 100,000+
Affected Software: Asset CleanUp: Page Speed Booster ≤ 1.4.0.5
Patched Versions: 1.4.0.6

Mitigation steps: Update to Asset CleanUp: Page Speed Booster version 1.4.0.6 or greater.

User Role Editor – Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

Security Risk: Medium
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
CVE: CVE-2026-75927
Number of Installations: 100,000+
Affected Software: User Role Editor ≤ 2.50.0
Patched Versions: 2.50.1

Mitigation steps: Update to User Role Editor version 2.50.1 or greater.

Hide My WP Ghost – Unauthenticated Server-Side Request Forgery

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Server-Side Request Forgery
CVE: CVE-2026-81806
Number of Installations: 100,000+
Affected Software: Hide My WP Ghost ≤ 7.0.09
Patched Versions: 7.0.10

Mitigation steps: Update to Hide My WP Ghost version 7.0.10 or greater.

Tutor LMS – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via ‘student_id’ Parameter

Security Risk: Low
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
CVE: CVE-2026-89333
Number of Installations: 100,000+
Affected Software: Tutor LMS ≤ 4.0.8
Patched Versions: 4.0.9

Mitigation steps: Update to Tutor LMS version 4.0.9 or greater.

GiveWP – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-85113
Number of Installations: 100,000+
Affected Software: GiveWP ≤ 4.16.8
Patched Versions: 4.16.9

Mitigation steps: Update to GiveWP version 4.16.9 or greater.

Photo Gallery by 10Web – Authenticated (Author+) SQL Injection via ‘album_id’ Shortcode Attribute

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
CVE: CVE-2026-85652
Number of Installations: 100,000+
Affected Software: Photo Gallery by 10Web ≤ 1.8.44
Patched Versions: 1.8.45

Mitigation steps: Update to Photo Gallery by 10Web version 1.8.45 or greater.

Download Manager – Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via ‘wpdm_duplicate’ Parameter

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
CVE: CVE-2026-92714
Number of Installations: 100,000+
Affected Software: Download Manager ≤ 3.3.68
Patched Versions: 3.3.69

Mitigation steps: Update to Download Manager version 3.3.69 or greater.

AI Engine – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via ‘mediaId’ Parameter

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
CVE: CVE-2026-89141
Number of Installations: 100,000+
Affected Software: AI Engine ≤ 3.7.7
Patched Versions: 3.7.8

Mitigation steps: Update to AI Engine version 3.7.8 or greater.

Beaver Builder Page Builder – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-18021
Number of Installations: 100,000+
Affected Software: Beaver Builder Page Builder ≤ 2.10.3.1
Patched Versions: 2.10.3.2

Mitigation steps: Update to Beaver Builder Page Builder version 2.10.3.2 or greater.

LukasApps CAPTCHA tools for Contact Form 7 – Unauthenticated Arbitrary Shortcode Execution

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-85117
Number of Installations: 100,000+
Affected Software: LukasApps CAPTCHA tools for Contact Form 7 0.1.7 - 0.1.8
Patched Versions: 0.1.9

Mitigation steps: Update to LukasApps CAPTCHA tools for Contact Form 7 version 0.1.9 or greater.

Pods – Authenticated (Author+) Arbitrary File Read

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Arbitrary File Read
CVE: CVE-2026-74853
Number of Installations: 100,000+
Affected Software: Pods 3.3 - 3.3.9.1
Patched Versions: 3.3.9.2

Mitigation steps: Update to Pods version 3.3.9.2 or greater.

EmbedPress – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-85002
Number of Installations: 100,000+
Affected Software: EmbedPress ≤ 4.6.6
Patched Versions: 4.6.7

Mitigation steps: Update to EmbedPress version 4.6.7 or greater.

The Plus Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-96829
Number of Installations: 100,000+
Affected Software: The Plus Addons for Elementor ≤ 6.5.1
Patched Versions: 6.5.2

Mitigation steps: Update to The Plus Addons for Elementor version 6.5.2 or greater.

The Post Grid – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-94680
Number of Installations: 100,000+
Affected Software: The Post Grid ≤ 7.9.5
Patched Versions: 7.9.6

Mitigation steps: Update to The Post Grid version 7.9.6 or greater.

The Post Grid – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-84151
Number of Installations: 100,000+
Affected Software: The Post Grid ≤ 7.9.4
Patched Versions: 7.9.5

Mitigation steps: Update to The Post Grid version 7.9.5 or greater.

VK All in One Expansion Unit – Authenticated (Author+) Stored Cross-Site Scripting via ‘vkExUnit_cta_img_position’ Post Meta

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
CVE: CVE-2026-17586
Number of Installations: 100,000+
Affected Software: VK All in One Expansion Unit ≤ 9.118.0
Patched Versions: 9.119.0

Mitigation steps: Update to VK All in One Expansion Unit version 9.119.0 or greater.

Element Pack Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-66574
Number of Installations: 100,000+
Affected Software: Element Pack Addons for Elementor ≤ 8.8.3
Patched Versions: 8.8.4

Mitigation steps: Update to Element Pack Addons for Elementor version 8.8.4 or greater.

Custom Twitter Feeds – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘buttoncolor’ Shortcode Attribute

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
CVE: CVE-2026-84909
Number of Installations: 100,000+
Affected Software: Custom Twitter Feeds ≤ 2.8.0
Patched Versions: 2.9.0

Mitigation steps: Update to Custom Twitter Feeds version 2.9.0 or greater.

Photo Gallery by 10Web – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
CVE: CVE-2026-86311
Number of Installations: 100,000+
Affected Software: Photo Gallery by 10Web ≤ 1.8.44
Patched Versions: 1.8.45

Mitigation steps: Update to Photo Gallery by 10Web version 1.8.45 or greater.

ShopEngine Elementor WooCommerce Builder Addon – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘shopengine_product_title_header_size’ Parameter

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
CVE: CVE-2026-85575
Number of Installations: 100,000+
Affected Software: ShopEngine Elementor WooCommerce Builder Addon ≤ 4.9.5
Patched Versions: 4.9.6

Mitigation steps: Update to ShopEngine Elementor WooCommerce Builder Addon version 4.9.6 or greater.

Aruba HiSpeed Cache – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
CVE: CVE-2026-15889
Number of Installations: 100,000+
Affected Software: Aruba HiSpeed Cache ≤ 3.0.14
Patched Versions: 3.0.15

Mitigation steps: Update to Aruba HiSpeed Cache version 3.0.15 or greater.

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-85418
Number of Installations: 100,000+
Affected Software: Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More ≤ 3.0.8
Patched Versions: 3.0.9

Mitigation steps: Update to Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More version 3.0.9 or greater.

Pods – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘not_found’ Shortcode Attribute

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
CVE: CVE-2026-76573
Number of Installations: 100,000+
Affected Software: Pods ≤ 3.3.9.1
Patched Versions: 3.3.9.2

Mitigation steps: Update to Pods version 3.3.9.2 or greater.

Gallery : FooGallery – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘custom_settings’ Shortcode Attribute

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
CVE: CVE-2026-85414
Number of Installations: 100,000+
Affected Software: Gallery : FooGallery ≤ 3.3.2
Patched Versions: 3.3.3

Mitigation steps: Update to Gallery : FooGallery version 3.3.3 or greater.

Social Media Share Buttons & Social Sharing Icons – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-19719
Number of Installations: 100,000+
Affected Software: Social Media Share Buttons & Social Sharing Icons < 3.0.1
Patched Versions: 3.0.1

Mitigation steps: Update to Social Media Share Buttons & Social Sharing Icons version 3.0.1 or greater.

Social Media Share Buttons & Social Sharing Icons – Reflected DOM-Based Cross-Site Scripting via URL

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Reflected DOM-Based Cross-Site Scripting via URL
CVE: CVE-2026-89047
Number of Installations: 100,000+
Affected Software: Social Media Share Buttons & Social Sharing Icons ≤ 3.0.1
Patched Versions: 3.0.2

Mitigation steps: Update to Social Media Share Buttons & Social Sharing Icons version 3.0.2 or greater.

Tutor LMS – Reflected Cross-Site Scripting via ‘back_url’ and ‘search’ Parameters

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
CVE: CVE-2026-89081
Number of Installations: 100,000+
Affected Software: Tutor LMS ≤ 4.0.8
Patched Versions: 4.0.9

Mitigation steps: Update to Tutor LMS version 4.0.9 or greater.

EmbedPress – Reflected Cross-Site Scripting via ‘hash’ and ‘unique’ Parameters

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
CVE: CVE-2026-89330
Number of Installations: 100,000+
Affected Software: EmbedPress ≤ 4.6.5
Patched Versions: 4.6.6

Mitigation steps: Update to EmbedPress version 4.6.6 or greater.

Relevanssi – Reflected Cross-Site Scripting

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting
CVE: CVE-2026-19985
Number of Installations: 100,000+
Affected Software: Relevanssi ≤ 4.28.1
Patched Versions: 4.28.2

Mitigation steps: Update to Relevanssi version 4.28.2 or greater.

Social Media Share Buttons & Social Sharing Icons – Reflected Cross-Site Scripting

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting
CVE: CVE-2026-19723
Number of Installations: 100,000+
Affected Software: Social Media Share Buttons & Social Sharing Icons < 3.0.1
Patched Versions: 3.0.1

Mitigation steps: Update to Social Media Share Buttons & Social Sharing Icons version 3.0.1 or greater.

Photo Gallery by 10Web – Reflected Cross-Site Scripting

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting
CVE: CVE-2026-12865
Number of Installations: 100,000+
Affected Software: Photo Gallery by 10Web < 1.8.44
Patched Versions: 1.8.44

Mitigation steps: Update to Photo Gallery by 10Web version 1.8.44 or greater.

Asset CleanUp: Page Speed Booster – Authenticated (Administrator+) Server-Side Request Forgery via ‘page_url’ Parameter

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter
CVE: CVE-2026-12037
Number of Installations: 100,000+
Affected Software: Asset CleanUp: Page Speed Booster ≤ 1.4.0.5
Patched Versions: 1.4.0.6

Mitigation steps: Update to Asset CleanUp: Page Speed Booster version 1.4.0.6 or greater.

WP Popular Posts – Unauthenticated Information Disclosure in ‘post_type’ and ‘context’ Parameters

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters
CVE: CVE-2026-92548
Number of Installations: 100,000+
Affected Software: WP Popular Posts ≤ 7.4.2
Patched Versions: 7.4.3

Mitigation steps: Update to WP Popular Posts version 7.4.3 or greater.

GiveWP – Unauthenticated User Impersonation

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated User Impersonation
CVE: CVE-2026-97196
Number of Installations: 100,000+
Affected Software: GiveWP ≤ 4.16.9
Patched Versions: 4.17.0

Mitigation steps: Update to GiveWP version 4.17.0 or greater.

GiveWP – Unauthenticated Insecure Direct Object Reference

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference
CVE: CVE-2026-97066
Number of Installations: 100,000+
Affected Software: GiveWP ≤ 4.16.9
Patched Versions: 4.17.0

Mitigation steps: Update to GiveWP version 4.17.0 or greater.

Captcha Code – Unauthenticated Login Captcha Protection Bypass

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Login Captcha Protection Bypass
CVE: CVE-2026-94457
Number of Installations: 100,000+
Affected Software: Captcha Code ≤ 3.32
Patched Versions: 3.33

Mitigation steps: Update to Captcha Code version 3.33 or greater.

Secure Custom Fields – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-92403
Number of Installations: 100,000+
Affected Software: Secure Custom Fields ≤ 6.9.3
Patched Versions: 6.9.4

Mitigation steps: Update to Secure Custom Fields version 6.9.4 or greater.

Hide My WP Ghost – Unauthenticated Protection Mechanism Bypass

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Protection Mechanism Bypass
CVE: CVE-2026-86796
Number of Installations: 100,000+
Affected Software: Hide My WP Ghost ≤ 7.0.10
Patched Versions: 7.0.11

Mitigation steps: Update to Hide My WP Ghost version 7.0.11 or greater.

Hide My WP Ghost – Unauthenticated Login Protection Bypass

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Login Protection Bypass
CVE: CVE-2026-86800
Number of Installations: 100,000+
Affected Software: Hide My WP Ghost ≤ 7.0.10
Patched Versions: 7.0.11

Mitigation steps: Update to Hide My WP Ghost version 7.0.11 or greater.

Schema & Structured Data for WP & AMP – Unauthenticated Information Exposure

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-82124
Number of Installations: 100,000+
Affected Software: Schema & Structured Data for WP & AMP ≤ 1.65
Patched Versions: 1.66

Mitigation steps: Update to Schema & Structured Data for WP & AMP version 1.66 or greater.

Schema & Structured Data for WP & AMP – Unauthenticated Insecure Direct Object Reference

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference
CVE: CVE-2026-82125
Number of Installations: 100,000+
Affected Software: Schema & Structured Data for WP & AMP ≤ 1.65
Patched Versions: 1.66

Mitigation steps: Update to Schema & Structured Data for WP & AMP version 1.66 or greater.

bbPress – Unauthenticated Information Exposure

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-62137
Number of Installations: 100,000+
Affected Software: bbPress ≤ 2.6.14
Patched Versions: 2.6.15

Mitigation steps: Update to bbPress version 2.6.15 or greater.

Payment Plugins for Stripe WooCommerce – Unauthenticated Information Exposure

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-80339
Number of Installations: 100,000+
Affected Software: Payment Plugins for Stripe WooCommerce ≤ 4.0.11
Patched Versions: 4.0.12

Mitigation steps: Update to Payment Plugins for Stripe WooCommerce version 4.0.12 or greater.

Content Views – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-17517
Number of Installations: 100,000+
Affected Software: Content Views < 4.5.1.2
Patched Versions: 4.5.1.2

Mitigation steps: Update to Content Views version 4.5.1.2 or greater.

EmbedPress – Unauthenticated Paid API Consumption and Database Row Injection

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Paid API Consumption and Database Row Injection
CVE: CVE-2026-84936
Number of Installations: 100,000+
Affected Software: EmbedPress 4.6.0 - 4.6.3
Patched Versions: 4.6.4

Mitigation steps: Update to EmbedPress version 4.6.4 or greater.

FormLayer – Unauthenticated Information Exposure

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-78151
Number of Installations: 100,000+
Affected Software: FormLayer < 1.0.9
Patched Versions: 1.0.9

Mitigation steps: Update to FormLayer version 1.0.9 or greater.

WPML Multilingual & Multicurrency for WooCommerce – Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field

Security Risk: High
Exploitation Level: Requires Shop Manager or higher level authentication.
Vulnerability: Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
CVE: Not provided
Number of Installations: 100,000+
Affected Software: WPML Multilingual & Multicurrency for WooCommerce ≤ 5.5.7
Patched Versions: 5.5.8

Mitigation steps: Update to WPML Multilingual & Multicurrency for WooCommerce version 5.5.8 or greater.

Hide My WP Ghost – Unauthenticated Open Redirect via ‘redirect_to’ Parameter

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Open Redirect via 'redirect_to' Parameter
CVE: CVE-2026-7527
Number of Installations: 100,000+
Affected Software: Hide My WP Ghost ≤ 7.0.02
Patched Versions: 7.0.03

Mitigation steps: Update to Hide My WP Ghost version 7.0.03 or greater.

Temporary Login Without Password – Authenticated (Administrator+) Privilege Escalation

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) Privilege Escalation
CVE: CVE-2026-77752
Number of Installations: 100,000+
Affected Software: Temporary Login Without Password 1.5 - 1.9.8
Patched Versions: 1.9.9

Mitigation steps: Update to Temporary Login Without Password version 1.9.9 or greater.

Newsletters, Email Marketing, SMS and Popups by Omnisend – Authenticated (Subscriber+) Insecure Direct Object Reference

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Insecure Direct Object Reference
CVE: CVE-2026-97074
Number of Installations: 100,000+
Affected Software: Newsletters, Email Marketing, SMS and Popups by Omnisend ≤ 1.9.0
Patched Versions: 1.9.1

Mitigation steps: Update to Newsletters, Email Marketing, SMS and Popups by Omnisend version 1.9.1 or greater.

GiveWP – Authenticated (Subscriber+) Information Exposure

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Information Exposure
CVE: CVE-2026-96834
Number of Installations: 100,000+
Affected Software: GiveWP ≤ 4.16.9
Patched Versions: 4.17.0

Mitigation steps: Update to GiveWP version 4.17.0 or greater.

MailerLite – Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
CVE: CVE-2026-3253
Number of Installations: 100,000+
Affected Software: MailerLite ≤ 1.7.21
Patched Versions: 1.7.22

Mitigation steps: Update to MailerLite version 1.7.22 or greater.

Tutor LMS – Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via ‘payload’ Parameter

Security Risk: Low
Exploitation Level: Requires Custom or higher level authentication.
Vulnerability: Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
CVE: CVE-2026-18439
Number of Installations: 100,000+
Affected Software: Tutor LMS ≤ 4.0.7
Patched Versions: 4.0.8

Mitigation steps: Update to Tutor LMS version 4.0.8 or greater.

Tutor LMS – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via ‘lesson_id’ Parameter

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
CVE: CVE-2026-88944
Number of Installations: 100,000+
Affected Software: Tutor LMS ≤ 4.0.8
Patched Versions: 4.0.9

Mitigation steps: Update to Tutor LMS version 4.0.9 or greater.

Appointment Booking Plugin – Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

Security Risk: Low
Exploitation Level: Requires Custom or higher level authentication.
Vulnerability: Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
CVE: CVE-2026-13471
Number of Installations: 100,000+
Affected Software: Appointment Booking Plugin ≤ 5.6.3
Patched Versions: 5.6.4

Mitigation steps: Update to Appointment Booking Plugin version 5.6.4 or greater.

Appointment Booking Plugin – Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via ‘customer[id]’ Parameter

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
CVE: CVE-2026-18441
Number of Installations: 100,000+
Affected Software: Appointment Booking Plugin ≤ 5.6.9
Patched Versions: 5.6.10

Mitigation steps: Update to Appointment Booking Plugin version 5.6.10 or greater.

Tutor LMS – Authenticated (Subscriber+) Information Exposure

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Information Exposure
CVE: CVE-2026-85572
Number of Installations: 100,000+
Affected Software: Tutor LMS ≤ 4.0.7
Patched Versions: 4.0.8

Mitigation steps: Update to Tutor LMS version 4.0.8 or greater.

Tutor LMS – REST API Authentication Confusion

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: REST API Authentication Confusion
CVE: CVE-2026-85569
Number of Installations: 100,000+
Affected Software: Tutor LMS ≤ 4.0.7
Patched Versions: 4.0.8

Mitigation steps: Update to Tutor LMS version 4.0.8 or greater.

Schema & Structured Data for WP & AMP – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Missing Authorization
CVE: CVE-2026-82126
Number of Installations: 100,000+
Affected Software: Schema & Structured Data for WP & AMP ≤ 1.65
Patched Versions: 1.66

Mitigation steps: Update to Schema & Structured Data for WP & AMP version 1.66 or greater.

Temporary Login Without Password – Authenticated (Custom Role+) Persistent Access After Login Revocation

Security Risk: High
Exploitation Level: Requires custom cole.
Vulnerability: Authenticated (Custom Role+) Persistent Access After Login Revocation
CVE: CVE-2026-77753
Number of Installations: 100,000+
Affected Software: Temporary Login Without Password < 1.9.9
Patched Versions: 1.9.9

Mitigation steps: Update to Temporary Login Without Password version 1.9.9 or greater.

EmbedPress – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Missing Authorization
CVE: CVE-2026-84926
Number of Installations: 100,000+
Affected Software: EmbedPress 4.6.0 - 4.6.3
Patched Versions: 4.6.4

Mitigation steps: Update to EmbedPress version 4.6.4 or greater.

EmbedPress – Missing Authorization to Authenticated (Contributor+) Site-Wide Places Library Modification

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Missing Authorization to Authenticated (Contributor+) Site-Wide Places Library Modification
CVE: CVE-2026-84927
Number of Installations: 100,000+
Affected Software: EmbedPress 4.6.0 - 4.6.3
Patched Versions: 4.6.4

Mitigation steps: Update to EmbedPress version 4.6.4 or greater.

Everest Forms – Unauthenticated PHP Object Injection

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated PHP Object Injection
CVE: CVE-2026-62103
Number of Installations: 90,000+
Affected Software: Everest Forms ≤ 3.6.0
Patched Versions: 3.6.1

Mitigation steps: Update to Everest Forms version 3.6.1 or greater.

Go Live Update Urls – Authenticated (Contributor+) PHP Object Injection

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) PHP Object Injection
CVE: CVE-2026-94678
Number of Installations: 90,000+
Affected Software: Go Live Update Urls ≤ 7.0.8
Patched Versions: 7.1.0

Mitigation steps: Update to Go Live Update Urls version 7.1.0 or greater.

Event Tickets and Registration – Missing Authorization to Unauthenticated Stripe Credentials Update

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated Stripe Credentials Update
CVE: CVE-2026-3174
Number of Installations: 90,000+
Affected Software: Event Tickets and Registration ≤ 5.27.4
Patched Versions: 5.27.4.1

Mitigation steps: Update to Event Tickets and Registration version 5.27.4.1 or greater.

AI Engine – Unauthenticated Stored Cross-Site Scripting via ‘model_’ Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
CVE: CVE-2026-96561
Number of Installations: 90,000+
Affected Software: AI Engine ≤ 3.8.0
Patched Versions: 3.8.1

Mitigation steps: Update to AI Engine version 3.8.1 or greater.

Event Tickets and Registration – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-93526
Number of Installations: 90,000+
Affected Software: Event Tickets and Registration ≤ 5.29.4
Patched Versions: 5.29.5

Mitigation steps: Update to Event Tickets and Registration version 5.29.5 or greater.

Kadence WooCommerce Email Designer – Authenticated (Shop Manager+) PHP Object Injection

Security Risk: TBC
Exploitation Level: Requires Shop Manager or higher level authentication.
Vulnerability: Authenticated (Shop Manager+) PHP Object Injection
CVE: CVE-2026-94677
Number of Installations: 90,000+
Affected Software: Kadence WooCommerce Email Designer ≤ 1.5.19.1
Patched Versions: 1.5.19.2

Mitigation steps: Update to Kadence WooCommerce Email Designer version 1.5.19.2 or greater.

Event Tickets and Registration – Authenticated (Contributor+) SQL Injection

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) SQL Injection
CVE: CVE-2026-97287
Number of Installations: 90,000+
Affected Software: Event Tickets and Registration ≤ 5.29.5
Patched Versions: 5.29.5.1

Mitigation steps: Update to Event Tickets and Registration version 5.29.5.1 or greater.

Hustle – Unauthenticated Arbitrary Shortcode Execution

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-80440
Number of Installations: 90,000+
Affected Software: Hustle < 7.8.14.2
Patched Versions: 7.8.14.2

Mitigation steps: Update to Hustle version 7.8.14.2 or greater.

Booking for Appointments and Events Calendar – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘load_manually’ Parameter

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
CVE: CVE-2026-10148
Number of Installations: 90,000+
Affected Software: Booking for Appointments and Events Calendar ≤ 2.4.9
Patched Versions: 2.4.10

Mitigation steps: Update to Booking for Appointments and Events Calendar version 2.4.10 or greater.

Booking for Appointments and Events Calendar – Authenticated (Custom Role+) Privilege Escalation

Security Risk: Medium
Exploitation Level: Requires Custom Role or higher level authentication.
Vulnerability: Authenticated (Custom Role+) Privilege Escalation
CVE: CVE-2026-77705
Number of Installations: 90,000+
Affected Software: Booking for Appointments and Events Calendar < 2.4.10
Patched Versions: 2.4.10

Mitigation steps: Update to Booking for Appointments and Events Calendar version 2.4.10 or greater.

Booking for Appointments and Events Calendar – Authenticated (Custom+) Missing Authorization to Limited Account Takeover

Security Risk: Medium
Exploitation Level: Requires Custom or higher level authentication.
Vulnerability: Authenticated (Custom+) Missing Authorization to Limited Account Takeover
CVE: CVE-2026-14311
Number of Installations: 90,000+
Affected Software: Booking for Appointments and Events Calendar ≤ 2.4.4
Patched Versions: 2.4.5

Mitigation steps: Update to Booking for Appointments and Events Calendar version 2.4.5 or greater.

AI Engine – Unauthenticated Insecure Direct Object Reference

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference
CVE: CVE-2026-93623
Number of Installations: 90,000+
Affected Software: AI Engine ≤ 3.7.8
Patched Versions: 3.7.9

Mitigation steps: Update to AI Engine version 3.7.9 or greater.

Booking for Appointments and Events Calendar – Missing Authorization to Unauthenticated Payment Bypass

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated Payment Bypass
CVE: CVE-2026-16582
Number of Installations: 90,000+
Affected Software: Booking for Appointments and Events Calendar ≤ 2.4.5
Patched Versions: 2.4.6

Mitigation steps: Update to Booking for Appointments and Events Calendar version 2.4.6 or greater.

Booking for Appointments and Events Calendar – Unauthenticated Payment Bypass

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Payment Bypass
CVE: CVE-2026-77689
Number of Installations: 90,000+
Affected Software: Booking for Appointments and Events Calendar 9.0 - 9.8.0
Patched Versions: 9.8.1

Mitigation steps: Update to Booking for Appointments and Events Calendar version 9.8.1 or greater.

Booking for Appointments and Events Calendar – Authenticated (Editor+) SQL Injection

Security Risk: Medium
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: Authenticated (Editor+) SQL Injection
CVE: CVE-2026-62112
Number of Installations: 90,000+
Affected Software: Booking for Appointments and Events Calendar ≤ 2.4.9
Patched Versions: 2.4.10

Mitigation steps: Update to Booking for Appointments and Events Calendar version 2.4.10 or greater.

BuddyPress – Insecure Direct Object Reference to Notifications Deletion

Security Risk: Medium
Exploitation Level: Requires custom role.
Vulnerability: Insecure Direct Object Reference to Notifications Deletion
CVE: CVE-2024-12145
Number of Installations: 90,000+
Affected Software: BuddyPress ≤ 14.3.3
Patched Versions: 14.3.4

Mitigation steps: Update to BuddyPress version 14.3.4 or greater.

JetFormBuilder – Unauthenticated Privilege Escalation via ‘_jet_engine_booking_form_id’ Parameter

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
CVE: CVE-2026-12793
Number of Installations: 80,000+
Affected Software: JetFormBuilder ≤ 3.6.2
Patched Versions: 3.6.2.1

Mitigation steps: Update to JetFormBuilder version 3.6.2.1 or greater.

JetFormBuilder – Unauthenticated Arbitrary Shortcode Execution

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-19859
Number of Installations: 80,000+
Affected Software: JetFormBuilder < 3.6.5.2
Patched Versions: 3.6.5.2

Mitigation steps: Update to JetFormBuilder version 3.6.5.2 or greater.

Customer Reviews for WooCommerce – Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via ‘items[][media]’ Parameter

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
CVE: CVE-2026-89055
Number of Installations: 80,000+
Affected Software: Customer Reviews for WooCommerce ≤ 5.120.0
Patched Versions: 5.121.0

Mitigation steps: Update to Customer Reviews for WooCommerce version 5.121.0 or greater.

SureCart – Authenticated (Subscriber+) Arbitrary Account Email Takeover

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Arbitrary Account Email Takeover
CVE: CVE-2026-18480
Number of Installations: 80,000+
Affected Software: SureCart < 4.6.3
Patched Versions: 4.6.3

Mitigation steps: Update to SureCart version 4.6.3 or greater.

HUSKY – Unauthenticated Local File Inclusion via ‘custom_tpl’ Shortcode Attribute via ‘woof_draw_products’ AJAX

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
CVE: CVE-2026-92969
Number of Installations: 80,000+
Affected Software: HUSKY ≤ 1.4.4
Patched Versions: 1.4.5

Mitigation steps: Update to HUSKY version 1.4.5 or greater.

JetFormBuilder – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-84817
Number of Installations: 80,000+
Affected Software: JetFormBuilder ≤ 3.6.5.1
Patched Versions: 3.6.5.2

Mitigation steps: Update to JetFormBuilder version 3.6.5.2 or greater.

JetFormBuilder – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-19861
Number of Installations: 80,000+
Affected Software: JetFormBuilder < 3.6.5.2
Patched Versions: 3.6.5.2

Mitigation steps: Update to JetFormBuilder version 3.6.5.2 or greater.

JetFormBuilder – Authenticated (Administrator+) Arbitrary File Deletion

Security Risk: Medium
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) Arbitrary File Deletion
CVE: CVE-2026-19860
Number of Installations: 80,000+
Affected Software: JetFormBuilder ≤ 3.6.5.2
Patched Versions: 3.6.5.3

Mitigation steps: Update to JetFormBuilder version 3.6.5.3 or greater.

Strong Testimonials – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-97286
Number of Installations: 80,000+
Affected Software: Strong Testimonials ≤ 3.3.11
Patched Versions: 3.3.12

Mitigation steps: Update to Strong Testimonials version 3.3.12 or greater.

Kubio AI Page Builder – Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
CVE: CVE-2026-14472
Number of Installations: 80,000+
Affected Software: Kubio AI Page Builder ≤ 2.8.4
Patched Versions: 2.8.5

Mitigation steps: Update to Kubio AI Page Builder version 2.8.5 or greater.

Strong Testimonials – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘lightbox_class’ Shortcode Attribute

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
CVE: CVE-2026-92622
Number of Installations: 80,000+
Affected Software: Strong Testimonials ≤ 3.3.8
Patched Versions: 3.3.9

Mitigation steps: Update to Strong Testimonials version 3.3.9 or greater.

GutenKit – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘postBodyCss’

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
CVE: CVE-2026-2573
Number of Installations: 80,000+
Affected Software: GutenKit ≤ 2.4.4
Patched Versions: 2.4.5

Mitigation steps: Update to GutenKit version 2.4.5 or greater.

SureCart – Authenticated (Shop Worker+) Privilege Escalation

Security Risk: TBC
Exploitation Level: Requires Shop Worker or higher level authentication.
Vulnerability: Authenticated (Shop Worker+) Privilege Escalation
CVE: CVE-2026-97245
Number of Installations: 80,000+
Affected Software: SureCart ≤ 4.7.2
Patched Versions: 4.7.3

Mitigation steps: Update to SureCart version 4.7.3 or greater.

JetFormBuilder – Reflected Cross-Site Scripting via ‘jfb_xss’ (URL Query Variable) Parameter via Calculated Field

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
CVE: CVE-2026-92212
Number of Installations: 80,000+
Affected Software: JetFormBuilder ≤ 3.6.5.3
Patched Versions: 3.6.5.4

Mitigation steps: Update to JetFormBuilder version 3.6.5.4 or greater.

ShopLentor – Reflected Cross-Site Scripting via Query-String Parameter Name

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via Query-String Parameter Name
CVE: CVE-2026-92554
Number of Installations: 80,000+
Affected Software: ShopLentor ≤ 3.5.1
Patched Versions: 3.5.2

Mitigation steps: Update to ShopLentor version 3.5.2 or greater.

HUSKY – Reflected Cross-Site Scripting

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting
CVE: CVE-2026-18562
Number of Installations: 80,000+
Affected Software: HUSKY ≤ 1.4.3
Patched Versions: 1.4.3.1

Mitigation steps: Update to HUSKY version 1.4.3.1 or greater.

Customer Reviews for WooCommerce – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-96823
Number of Installations: 80,000+
Affected Software: Customer Reviews for WooCommerce ≤ 5.120.0
Patched Versions: 5.121.0

Mitigation steps: Update to Customer Reviews for WooCommerce version 5.121.0 or greater.

Payment Plugins for PayPal WooCommerce – Unauthenticated Insecure Direct Object Reference

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference
CVE: CVE-2026-80342
Number of Installations: 80,000+
Affected Software: Payment Plugins for PayPal WooCommerce ≤ 2.0.26
Patched Versions: 2.0.27

Mitigation steps: Update to Payment Plugins for PayPal WooCommerce version 2.0.27 or greater.

SureCart – Unauthorized WordPress Account Creation

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthorized WordPress Account Creation
CVE: CVE-2026-75793
Number of Installations: 80,000+
Affected Software: SureCart < 4.7.0
Patched Versions: 4.7.0

Mitigation steps: Update to SureCart version 4.7.0 or greater.

JetFormBuilder – Unauthenticated Information Exposure

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-19858
Number of Installations: 80,000+
Affected Software: JetFormBuilder < 3.6.5.2
Patched Versions: 3.6.5.2

Mitigation steps: Update to JetFormBuilder version 3.6.5.2 or greater.

Payment Plugins for PayPal WooCommerce – Unauthenticated Information Exposure

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-80340
Number of Installations: 80,000+
Affected Software: Payment Plugins for PayPal WooCommerce ≤ 2.0.25
Patched Versions: 2.0.26

Mitigation steps: Update to Payment Plugins for PayPal WooCommerce version 2.0.26 or greater.

JetFormBuilder – Missing Authorization to Unauthenticated JetEngine Options Page Modification

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated JetEngine Options Page Modification
CVE: Not provided
Number of Installations: 80,000+
Affected Software: JetFormBuilder ≤ 3.6.2
Patched Versions: 3.6.2.1

Mitigation steps: Update to JetFormBuilder version 3.6.2.1 or greater.

JetFormBuilder – Unauthenticated Email Header Injection

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Email Header Injection
CVE: CVE-2026-19862
Number of Installations: 80,000+
Affected Software: JetFormBuilder < 3.6.5.2
Patched Versions: 3.6.5.2

Mitigation steps: Update to JetFormBuilder version 3.6.5.2 or greater.

Email Log – Authenticated (Administrator+) SQL Injection

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) SQL Injection
CVE: CVE-2026-94174
Number of Installations: 80,000+
Affected Software: Email Log ≤ 2.63
Patched Versions: 2.64

Mitigation steps: Update to Email Log version 2.64 or greater.

Product Feed Manager for WooCommerce – Authenticated (Shop Manager+) Path Traversal to File Deletion via ‘provider’ Parameter

Security Risk: Medium
Exploitation Level: Requires Shop Manager or higher level authentication.
Vulnerability: Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
CVE: CVE-2026-15095
Number of Installations: 80,000+
Affected Software: Product Feed Manager for WooCommerce ≤ 6.6.43
Patched Versions: 6.6.44

Mitigation steps: Update to Product Feed Manager for WooCommerce version 6.6.44 or greater.

Checkout Field Manager (Checkout Manager) for WooCommerce – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Missing Authorization
CVE: CVE-2026-87831
Number of Installations: 80,000+
Affected Software: Checkout Field Manager (Checkout Manager) for WooCommerce ≤ 7.9.6
Patched Versions: 7.9.7

Mitigation steps: Update to Checkout Field Manager (Checkout Manager) for WooCommerce version 7.9.7 or greater.

Checkout Field Manager (Checkout Manager) for WooCommerce – Authenticated (Subscriber+) Insecure Direct Object Reference

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Insecure Direct Object Reference
CVE: CVE-2026-87829
Number of Installations: 80,000+
Affected Software: Checkout Field Manager (Checkout Manager) for WooCommerce ≤ 7.9.6
Patched Versions: 7.9.7

Mitigation steps: Update to Checkout Field Manager (Checkout Manager) for WooCommerce version 7.9.7 or greater.

Payment Plugins for PayPal WooCommerce – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Missing Authorization
CVE: CVE-2026-80341
Number of Installations: 80,000+
Affected Software: Payment Plugins for PayPal WooCommerce ≤ 2.0.25
Patched Versions: 2.0.26

Mitigation steps: Update to Payment Plugins for PayPal WooCommerce version 2.0.26 or greater.

GutenKit – Authenticated (Contributor+) Arbitrary CSS Injection

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Arbitrary CSS Injection
CVE: CVE-2026-19698
Number of Installations: 80,000+
Affected Software: GutenKit ≤ 2.5.0
Patched Versions: 2.5.1

Mitigation steps: Update to GutenKit version 2.5.1 or greater.

Hummingbird Performance – Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
CVE: CVE-2026-83627
Number of Installations: 70,000+
Affected Software: Hummingbird Performance ≤ 3.21.0
Patched Versions: 3.21.1

Mitigation steps: Update to Hummingbird Performance version 3.21.1 or greater.

Import and export users and customers – Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
CVE: CVE-2026-86583
Number of Installations: 70,000+
Affected Software: Import and export users and customers ≤ 2.4.17
Patched Versions: 2.4.18

Mitigation steps: Update to Import and export users and customers version 2.4.18 or greater.

LearnPress – Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via ‘item_id’ Parameter

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
CVE: CVE-2026-93882
Number of Installations: 70,000+
Affected Software: LearnPress ≤ 4.4.8
Patched Versions: 4.4.9

Mitigation steps: Update to LearnPress version 4.4.9 or greater.

10Web Booster – Authenticated (Contributor+) PHP Object Injection

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) PHP Object Injection
CVE: CVE-2026-94121
Number of Installations: 70,000+
Affected Software: 10Web Booster ≤ 2.33.6
Patched Versions: 2.34.0

Mitigation steps: Update to 10Web Booster version 2.34.0 or greater.

AMP for WP – Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
CVE: CVE-2026-83591
Number of Installations: 70,000+
Affected Software: AMP for WP ≤ 1.1.16
Patched Versions: 1.1.17

Mitigation steps: Update to AMP for WP version 1.1.17 or greater.

Import and export users and customers – Authenticated (Admin+) Privilege Escalation

Security Risk: Medium
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Authenticated (Admin+) Privilege Escalation
CVE: CVE-2026-92540
Number of Installations: 70,000+
Affected Software: Import and export users and customers ≤ 2.5.1
Patched Versions: 2.5.2

Mitigation steps: Update to Import and export users and customers version 2.5.2 or greater.

Hummingbird Performance – Authenticated (Administrator+) Remote Code Execution

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) Remote Code Execution
CVE: CVE-2026-19224
Number of Installations: 70,000+
Affected Software: Hummingbird Performance < 3.21.2
Patched Versions: 3.21.2

Mitigation steps: Update to Hummingbird Performance version 3.21.2 or greater.

Media Library Assistant – Authenticated (Contributor+) SQL Injection

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) SQL Injection
CVE: CVE-2026-97293
Number of Installations: 70,000+
Affected Software: Media Library Assistant ≤ 3.41
Patched Versions: 3.42

Mitigation steps: Update to Media Library Assistant version 3.42 or greater.

Ninja Tables – Unauthenticated Arbitrary Shortcode Execution

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-86612
Number of Installations: 70,000+
Affected Software: Ninja Tables ≤ 5.2.16
Patched Versions: 5.2.17

Mitigation steps: Update to Ninja Tables version 5.2.17 or greater.

HT Mega Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table ‘display_options’ Setting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting
CVE: CVE-2026-11895
Number of Installations: 70,000+
Affected Software: HT Mega Addons for Elementor ≤ 3.1.1
Patched Versions: 3.1.2

Mitigation steps: Update to HT Mega Addons for Elementor version 3.1.2 or greater.

HT Mega Addons for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-86788
Number of Installations: 70,000+
Affected Software: HT Mega Addons for Elementor 3.2.0 - 3.2.5
Patched Versions: 3.2.6

Mitigation steps: Update to HT Mega Addons for Elementor version 3.2.6 or greater.

Media Library Assistant – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘mla_link_href’ Shortcode Parameter

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
CVE: CVE-2026-6641
Number of Installations: 70,000+
Affected Software: Media Library Assistant ≤ 3.35
Patched Versions: 3.36

Mitigation steps: Update to Media Library Assistant version 3.36 or greater.

Media Library Assistant – Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
CVE: CVE-2026-6642
Number of Installations: 70,000+
Affected Software: Media Library Assistant ≤ 3.35
Patched Versions: 3.36

Mitigation steps: Update to Media Library Assistant version 3.36 or greater.

Media Library Assistant – Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
CVE: CVE-2026-6640
Number of Installations: 70,000+
Affected Software: Media Library Assistant ≤ 3.35
Patched Versions: 3.36

Mitigation steps: Update to Media Library Assistant version 3.36 or greater.

LearnPress – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘layout_custom_css’

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
CVE: CVE-2026-12230
Number of Installations: 70,000+
Affected Software: LearnPress ≤ 4.3.9.1
Patched Versions: 4.4.0

Mitigation steps: Update to LearnPress version 4.4.0 or greater.

Greenshift – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-83544
Number of Installations: 70,000+
Affected Software: Greenshift < 13.2.0
Patched Versions: 13.2.0

Mitigation steps: Update to Greenshift version 13.2.0 or greater.

Greenshift – Authenticated (Contributor+) Server-Side Request Forgery

Security Risk: Low
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Server-Side Request Forgery
CVE: CVE-2026-83543
Number of Installations: 70,000+
Affected Software: Greenshift < 13.2.0
Patched Versions: 13.2.0

Mitigation steps: Update to Greenshift version 13.2.0 or greater.

LearnPress – Authenticated (Instructor+) Stored Cross-Site Scripting

Security Risk: TBC
Exploitation Level: Requires Instructor or higher level authentication.
Vulnerability: Authenticated (Instructor+) Stored Cross-Site Scripting
CVE: CVE-2026-82024
Number of Installations: 70,000+
Affected Software: LearnPress ≤ 4.4.5
Patched Versions: 4.4.6

Mitigation steps: Update to LearnPress version 4.4.6 or greater.

Import and export users and customers – Authenticated (Subscriber+) Privilege Escalation

Security Risk: TBC
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Privilege Escalation
CVE: CVE-2026-94178
Number of Installations: 70,000+
Affected Software: Import and export users and customers ≤ 2.5.2
Patched Versions: 2.5.4

Mitigation steps: Update to Import and export users and customers version 2.5.4 or greater.

LearnPress – Reflected Cross-Site Scripting

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting
CVE: CVE-2026-86444
Number of Installations: 70,000+
Affected Software: LearnPress ≤ 4.4.6
Patched Versions: 4.4.7

Mitigation steps: Update to LearnPress version 4.4.7 or greater.

Import and export users and customers – Authenticated (Administrator+) Server-Side Request Forgery

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) Server-Side Request Forgery
CVE: CVE-2026-16542
Number of Installations: 70,000+
Affected Software: Import and export users and customers ≤ 2.4.4
Patched Versions: 2.4.5

Mitigation steps: Update to Import and export users and customers version 2.4.5 or greater.

10Web Booster – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-82195
Number of Installations: 70,000+
Affected Software: 10Web Booster ≤ 2.33.0
Patched Versions: 2.34.0

Mitigation steps: Update to 10Web Booster version 2.34.0 or greater.

WPC Smart Compare for WooCommerce – Unauthenticated Information Exposure

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-90985
Number of Installations: 70,000+
Affected Software: WPC Smart Compare for WooCommerce ≤ 6.6.0
Patched Versions: 6.6.1

Mitigation steps: Update to WPC Smart Compare for WooCommerce version 6.6.1 or greater.

LearnPress – Unauthenticated Information Exposure

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-86446
Number of Installations: 70,000+
Affected Software: LearnPress 4.4.3 - 4.4.6
Patched Versions: 4.4.7

Mitigation steps: Update to LearnPress version 4.4.7 or greater.

3D FlipBook – Unauthenticated Sensitive Information Exposure in ‘id’ Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Sensitive Information Exposure in 'id' Parameter
CVE: CVE-2026-15758
Number of Installations: 70,000+
Affected Software: 3D FlipBook ≤ 1.16.20
Patched Versions: 1.16.21

Mitigation steps: Update to 3D FlipBook version 1.16.21 or greater.

LearnPress – Unauthenticated Information Exposure

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-86448
Number of Installations: 70,000+
Affected Software: LearnPress ≤ 4.4.6
Patched Versions: 4.4.7

Mitigation steps: Update to LearnPress version 4.4.7 or greater.

Slim SEO – Authenticated (Contributor+) Insecure Direct Object Reference

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Insecure Direct Object Reference
CVE: CVE-2026-62113
Number of Installations: 70,000+
Affected Software: Slim SEO ≤ 4.10.0
Patched Versions: 4.10.1

Mitigation steps: Update to Slim SEO version 4.10.1 or greater.

LearnPress – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires custom role.
Vulnerability: Missing Authorization
CVE: CVE-2026-82023
Number of Installations: 70,000+
Affected Software: LearnPress ≤ 4.4.5
Patched Versions: 4.4.6

Mitigation steps: Update to LearnPress version 4.4.6 or greater.

Ultra Addons for Contact Form 7 – Unauthenticated Arbitrary File Upload via Signature Form Field

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary File Upload via Signature Form Field
CVE: CVE-2026-82901
Number of Installations: 60,000+
Affected Software: Ultra Addons for Contact Form 7 ≤ 3.5.50
Patched Versions: 3.5.51

Mitigation steps: Update to Ultra Addons for Contact Form 7 version 3.5.51 or greater.

Ultra Addons for Contact Form 7 – Unauthenticated Arbitrary File Upload

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary File Upload
CVE: CVE-2026-84750
Number of Installations: 60,000+
Affected Software: Ultra Addons for Contact Form 7 3.2.4 - 3.5.50
Patched Versions: 3.5.51

Mitigation steps: Update to Ultra Addons for Contact Form 7 version 3.5.51 or greater.

Online Scheduling and Appointment Booking System – Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via ‘order_id’ Parameter

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
CVE: CVE-2026-93399
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 28.2
Patched Versions: 28.3

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.3 or greater.

WP Ultimate Review – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘xs_submit_review_data[xs_reviw_summery]’ Parameter

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
CVE: CVE-2026-92235
Number of Installations: 60,000+
Affected Software: WP Ultimate Review ≤ 2.4.2
Patched Versions: 2.4.3

Mitigation steps: Update to WP Ultimate Review version 2.4.3 or greater.

Site Reviews – Unauthenticated PHP Object Injection

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated PHP Object Injection
CVE: CVE-2026-82925
Number of Installations: 60,000+
Affected Software: Site Reviews 7.2.2 - 8.2.2
Patched Versions: 8.3.0

Mitigation steps: Update to Site Reviews version 8.3.0 or greater.

Online Scheduling and Appointment Booking System – Authenticated (Bookly Administrator+) PHP Object Injection

Security Risk: Low
Exploitation Level: Requires Bookly Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Bookly Administrator+) PHP Object Injection
CVE: CVE-2026-86841
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System 23.2 - 28.2
Patched Versions: 28.3

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.3 or greater.

WP Maps – Authenticated (Subscriber+) Local File Inclusion via ‘page’ Parameter

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter
CVE: CVE-2026-13456
Number of Installations: 60,000+
Affected Software: WP Maps ≤ 4.9.8
Patched Versions: 5.0.0

Mitigation steps: Update to WP Maps version 5.0.0 or greater.

Online Scheduling and Appointment Booking System – Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via ‘conversation_id’ Parameter

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
CVE: CVE-2026-89063
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 28.1
Patched Versions: 28.2

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.2 or greater.

Comments – Unauthenticated SQL Injection

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated SQL Injection
CVE: CVE-2026-19704
Number of Installations: 60,000+
Affected Software: Comments < 7.6.66
Patched Versions: 7.6.66

Mitigation steps: Update to Comments version 7.6.66 or greater.

Site Reviews – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-94078
Number of Installations: 60,000+
Affected Software: Site Reviews ≤ 8.3.1
Patched Versions: 8.3.2

Mitigation steps: Update to Site Reviews version 8.3.2 or greater.

Ultra Addons for Contact Form 7 – Authenticated (Editor+) PHP Object Injection

Security Risk: Medium
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: Authenticated (Editor+) PHP Object Injection
CVE: CVE-2026-96833
Number of Installations: 60,000+
Affected Software: Ultra Addons for Contact Form 7 ≤ 3.5.51
Patched Versions: 3.5.52

Mitigation steps: Update to Ultra Addons for Contact Form 7 version 3.5.52 or greater.

WP Maps – Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter
CVE: CVE-2026-13179
Number of Installations: 60,000+
Affected Software: WP Maps ≤ 4.9.8
Patched Versions: 5.0.0

Mitigation steps: Update to WP Maps version 5.0.0 or greater.

Ultra Addons for Contact Form 7 – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-95586
Number of Installations: 60,000+
Affected Software: Ultra Addons for Contact Form 7 ≤ 3.5.50
Patched Versions: 3.5.51

Mitigation steps: Update to Ultra Addons for Contact Form 7 version 3.5.51 or greater.

Master Slider – Authenticated (Contributor+) Stored Cross-Site Scripting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting
CVE: CVE-2026-14844
Number of Installations: 60,000+
Affected Software: Master Slider ≤ 3.11.2
Patched Versions: None

Mitigation steps: No patched version listed. Review vendor guidance and apply compensating controls.

Brizy – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘rootAttributes’ Parameter

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
CVE: CVE-2026-2585
Number of Installations: 60,000+
Affected Software: Brizy ≤ 2.8.14
Patched Versions: 2.8.15

Mitigation steps: Update to Brizy version 2.8.15 or greater.

Advanced Popups – Authenticated (Author+) Stored Cross-Site Scripting via ‘Notification Button Link’ Field

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
CVE: CVE-2026-11996
Number of Installations: 60,000+
Affected Software: Advanced Popups ≤ 1.2.3
Patched Versions: 1.2.4

Mitigation steps: Update to Advanced Popups version 1.2.4 or greater.

Theme My Login – Authenticated (Subscriber+) Privilege Escalation

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Privilege Escalation
CVE: CVE-2026-81583
Number of Installations: 60,000+
Affected Software: Theme My Login 7.0 - 7.1.15
Patched Versions: 7.2.0

Mitigation steps: Update to Theme My Login version 7.2.0 or greater.

Online Scheduling and Appointment Booking System – Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
CVE: CVE-2026-2520
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 27.2
Patched Versions: 27.3

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 27.3 or greater.

Events Manager – Unauthenticated Stored Cross-Site Scripting via Event Attributes

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting via Event Attributes
CVE: CVE-2025-14945
Number of Installations: 60,000+
Affected Software: Events Manager ≤ 7.3.3
Patched Versions: 7.3.4

Mitigation steps: Update to Events Manager version 7.3.4 or greater.

Online Scheduling and Appointment Booking System – Unauthenticated Payment Bypass

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Payment Bypass
CVE: CVE-2026-86838
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 28.2
Patched Versions: 28.3

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.3 or greater.

Online Scheduling and Appointment Booking System – Unauthenticated Insecure Direct Object Reference

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference
CVE: CVE-2026-86837
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 28.2
Patched Versions: 28.3

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.3 or greater.

Online Scheduling and Appointment Booking System – Unauthenticated Authorization Bypass via PHP Type Juggling via ‘verification_code’ Parameter Type Juggling via json_data

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
CVE: CVE-2026-92799
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 28.2
Patched Versions: 28.3

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.3 or greater.

Online Scheduling and Appointment Booking System – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-96348
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 28.2
Patched Versions: 28.3

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.3 or greater.

Online Scheduling and Appointment Booking System – Unauthenticated Insecure Direct Object Reference

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference
CVE: CVE-2026-91847
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 28.1
Patched Versions: 28.2

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.2 or greater.

WP Maps – Authenticated (Administrator+) SQL Injection

Security Risk: Low
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) SQL Injection
CVE: CVE-2026-66618
Number of Installations: 60,000+
Affected Software: WP Maps ≤ 4.9.9
Patched Versions: 5.0.0

Mitigation steps: Update to WP Maps version 5.0.0 or greater.

Online Scheduling and Appointment Booking System – Authenticated (Staff+) Insecure Direct Object Reference

Security Risk: TBC
Exploitation Level: Requires Staff or higher level authentication.
Vulnerability: Authenticated (Staff+) Insecure Direct Object Reference
CVE: CVE-2026-86839
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 28.2
Patched Versions: 28.3

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.3 or greater.

Online Scheduling and Appointment Booking System – Authenticated (Subscriber+) Insecure Direct Object Reference

Security Risk: TBC
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Insecure Direct Object Reference
CVE: CVE-2026-96347
Number of Installations: 60,000+
Affected Software: Online Scheduling and Appointment Booking System ≤ 28.2
Patched Versions: 28.3

Mitigation steps: Update to Online Scheduling and Appointment Booking System version 28.3 or greater.

Events Manager – Authenticated (Subscriber+) Information Exposure

Security Risk: TBC
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Information Exposure
CVE: CVE-2026-93662
Number of Installations: 60,000+
Affected Software: Events Manager 7.4.1 - 7.4.4
Patched Versions: 7.4.5

Mitigation steps: Update to Events Manager version 7.4.5 or greater.

Events Manager – Authenticated (Contributor+) Insecure Direct Object Reference

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Insecure Direct Object Reference
CVE: CVE-2026-93661
Number of Installations: 60,000+
Affected Software: Events Manager ≤ 7.4.4
Patched Versions: 7.4.5

Mitigation steps: Update to Events Manager version 7.4.5 or greater.

Theme My Login – Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via ‘gimmeanotherblog’ Signup Stage

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
CVE: CVE-2026-83628
Number of Installations: 60,000+
Affected Software: Theme My Login ≤ 7.1.15
Patched Versions: 7.2.0

Mitigation steps: Update to Theme My Login version 7.2.0 or greater.

WP Recipe Maker – Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
CVE: CVE-2026-89274
Number of Installations: 50,000+
Affected Software: WP Recipe Maker ≤ 10.8.1
Patched Versions: 10.8.2

Mitigation steps: Update to WP Recipe Maker version 10.8.2 or greater.

Simply Schedule Appointments – Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via ‘recursive’ Parameter on the appointment_types REST Endpoint via Public Nonce

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
CVE: CVE-2026-92245
Number of Installations: 50,000+
Affected Software: Simply Schedule Appointments ≤ 1.6.12.32
Patched Versions: 1.6.12.33

Mitigation steps: Update to Simply Schedule Appointments version 1.6.12.33 or greater.

Simply Schedule Appointments – Authenticated (Subscriber+) Local File Inclusion via ‘ssa_locale’ Parameter

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
CVE: CVE-2026-89294
Number of Installations: 50,000+
Affected Software: Simply Schedule Appointments ≤ 1.6.12.27
Patched Versions: 1.6.12.33

Mitigation steps: Update to Simply Schedule Appointments version 1.6.12.33 or greater.

WP Store Locator – Unauthenticated Denial of Service

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Denial of Service
CVE: CVE-2026-94681
Number of Installations: 50,000+
Affected Software: WP Store Locator < 3.0.0
Patched Versions: 3.0.0

Mitigation steps: Update to WP Store Locator version 3.0.0 or greater.

Product Filter for WooCommerce by WBW – Unauthenticated SQL Injection

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated SQL Injection
CVE: CVE-2026-95601
Number of Installations: 50,000+
Affected Software: Product Filter for WooCommerce by WBW ≤ 3.1.7
Patched Versions: 3.1.8

Mitigation steps: Update to Product Filter for WooCommerce by WBW version 3.1.8 or greater.

RTMKit – Authenticated (Contributor+) PHP Object Injection

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) PHP Object Injection
CVE: CVE-2026-84752
Number of Installations: 50,000+
Affected Software: RTMKit ≤ 2.1.5
Patched Versions: 2.1.6

Mitigation steps: Update to RTMKit version 2.1.6 or greater.

User Registration & Membership – Unauthenticated Open Redirect

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Open Redirect
CVE: CVE-2026-80072
Number of Installations: 50,000+
Affected Software: User Registration & Membership < 5.2.8
Patched Versions: 5.2.8

Mitigation steps: Update to User Registration & Membership version 5.2.8 or greater.

RTMKit – Unauthenticated Stored Cross-Site Scripting

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Stored Cross-Site Scripting
CVE: CVE-2026-84763
Number of Installations: 50,000+
Affected Software: RTMKit ≤ 2.1.5
Patched Versions: 2.1.6

Mitigation steps: Update to RTMKit version 2.1.6 or greater.

WP Table Builder – Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via ‘ids’ Parameter

Security Risk: High
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
CVE: CVE-2026-6922
Number of Installations: 50,000+
Affected Software: WP Table Builder ≤ 2.2.1
Patched Versions: 2.2.2

Mitigation steps: Update to WP Table Builder version 2.2.2 or greater.

Simply Schedule Appointments – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via ‘complete_group’ Parameter

Security Risk: TBC
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
CVE: CVE-2026-91109
Number of Installations: 50,000+
Affected Software: Simply Schedule Appointments ≤ 1.6.12.31
Patched Versions: 1.6.12.33

Mitigation steps: Update to Simply Schedule Appointments version 1.6.12.33 or greater.

WP Recipe Maker – Unauthenticated Arbitrary Shortcode Execution

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution
CVE: CVE-2026-86601
Number of Installations: 50,000+
Affected Software: WP Recipe Maker ≤ 10.8.1
Patched Versions: 10.8.2

Mitigation steps: Update to WP Recipe Maker version 10.8.2 or greater.

Email Subscribers & Newsletters – Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
CVE: CVE-2026-12757
Number of Installations: 50,000+
Affected Software: Email Subscribers & Newsletters ≤ 5.9.27
Patched Versions: 5.9.28

Mitigation steps: Update to Email Subscribers & Newsletters version 5.9.28 or greater.

Contextual Related Posts – Authenticated (Author+) Stored Cross-Site Scripting via ‘other_attributes’ Block Parameter

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
CVE: CVE-2026-85653
Number of Installations: 50,000+
Affected Software: Contextual Related Posts ≤ 4.4.1
Patched Versions: 4.4.2

Mitigation steps: Update to Contextual Related Posts version 4.4.2 or greater.

Gum Addon for Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘pop_tag’ Widget Setting

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
CVE: CVE-2026-8354
Number of Installations: 50,000+
Affected Software: Gum Addon for Elementor ≤ 1.3.15
Patched Versions: 1.3.16

Mitigation steps: Update to Gum Addon for Elementor version 1.3.16 or greater.

Getwid – Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps ‘customStyle’

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
CVE: CVE-2026-5924
Number of Installations: 50,000+
Affected Software: Getwid 2.1.3
Patched Versions: 2.2.0

Mitigation steps: Update to Getwid version 2.2.0 or greater.

User Registration & Membership – Authenticated (Author+) Privilege Escalation

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Authenticated (Author+) Privilege Escalation
CVE: CVE-2026-80071
Number of Installations: 50,000+
Affected Software: User Registration & Membership < 5.2.8
Patched Versions: 5.2.8

Mitigation steps: Update to User Registration & Membership version 5.2.8 or greater.

User Registration & Membership – Authenticated (Subscriber+) Privilege Escalation

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Privilege Escalation
CVE: CVE-2026-86406
Number of Installations: 50,000+
Affected Software: User Registration & Membership 4.4.6 - 5.2.7
Patched Versions: 5.2.8

Mitigation steps: Update to User Registration & Membership version 5.2.8 or greater.

WP-Members Membership Plugin – Reflected Cross-Site Scripting

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting
CVE: CVE-2026-84960
Number of Installations: 50,000+
Affected Software: WP-Members Membership Plugin ≤ 3.5.6
Patched Versions: 3.5.7

Mitigation steps: Update to WP-Members Membership Plugin version 3.5.7 or greater.

Product Filter for WooCommerce by WBW – Reflected Cross-Site Scripting via ‘wpf_fid’ Parameter

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Reflected Cross-Site Scripting via 'wpf_fid' Parameter
CVE: CVE-2026-7804
Number of Installations: 50,000+
Affected Software: Product Filter for WooCommerce by WBW ≤ 3.4.2
Patched Versions: 3.4.3

Mitigation steps: Update to Product Filter for WooCommerce by WBW version 3.4.3 or greater.

WP Recipe Maker – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘notes’ Parameter via REST Preview Endpoint

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
CVE: CVE-2026-90884
Number of Installations: 50,000+
Affected Software: WP Recipe Maker ≤ 10.8.1
Patched Versions: 10.8.2

Mitigation steps: Update to WP Recipe Maker version 10.8.2 or greater.

Simply Schedule Appointments – Unauthenticated Insecure Direct Object Reference

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Insecure Direct Object Reference
CVE: CVE-2026-94673
Number of Installations: 50,000+
Affected Software: Simply Schedule Appointments ≤ 1.6.12.31
Patched Versions: 1.6.12.33

Mitigation steps: Update to Simply Schedule Appointments version 1.6.12.33 or greater.

Simply Schedule Appointments – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-94074
Number of Installations: 50,000+
Affected Software: Simply Schedule Appointments ≤ 1.6.12.29
Patched Versions: 1.6.12.31

Mitigation steps: Update to Simply Schedule Appointments version 1.6.12.31 or greater.

Email Subscribers & Newsletters – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-83555
Number of Installations: 50,000+
Affected Software: Email Subscribers & Newsletters ≤ 5.9.34
Patched Versions: 5.9.35

Mitigation steps: Update to Email Subscribers & Newsletters version 5.9.35 or greater.

WP Recipe Maker – Unauthenticated Arbitrary User Meta Corruption

Security Risk: TBC
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Arbitrary User Meta Corruption
CVE: CVE-2026-86608
Number of Installations: 50,000+
Affected Software: WP Recipe Maker 9.8.0 - 10.8.1
Patched Versions: 10.8.2

Mitigation steps: Update to WP Recipe Maker version 10.8.2 or greater.

User Registration & Membership – Missing Authorization

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Missing Authorization
CVE: CVE-2026-74017
Number of Installations: 50,000+
Affected Software: User Registration & Membership ≤ 5.2.7
Patched Versions: 5.2.8

Mitigation steps: Update to User Registration & Membership version 5.2.8 or greater.

User Registration & Membership – Unauthenticated Information Exposure

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Unauthenticated Information Exposure
CVE: CVE-2026-86407
Number of Installations: 50,000+
Affected Software: User Registration & Membership 5.0 - 5.2.7
Patched Versions: 5.2.8

Mitigation steps: Update to User Registration & Membership version 5.2.8 or greater.

المنتور فارسی – Payment Bypass to Unauthenticated Unauthorized Order Completion

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Payment Bypass to Unauthenticated Unauthorized Order Completion
CVE: CVE-2026-86809
Number of Installations: 50,000+
Affected Software: المنتور فارسی 2.7.10 - 2.8.1
Patched Versions: 2.8.2

Mitigation steps: Update to المنتور فارسی version 2.8.2 or greater.

Email Subscribers & Newsletters – Authenticated (Administrator+) Stored Cross-Site Scripting

Security Risk: Minimal
Exploitation Level: Requires Administratoristrator or higher level authentication.
Vulnerability: Authenticated (Administrator+) Stored Cross-Site Scripting
CVE: CVE-2025-15692
Number of Installations: 50,000+
Affected Software: Email Subscribers & Newsletters ≤ 5.8.5
Patched Versions: 5.8.6

Mitigation steps: Update to Email Subscribers & Newsletters version 5.8.6 or greater.

Blog2Social: Social Media Auto Post & Scheduler – Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers
CVE: CVE-2026-92829
Number of Installations: 50,000+
Affected Software: Blog2Social: Social Media Auto Post & Scheduler ≤ 9.1.0
Patched Versions: 9.1.1

Mitigation steps: Update to Blog2Social: Social Media Auto Post & Scheduler version 9.1.1 or greater.

WP Recipe Maker – Authenticated (Subscriber+) Information Exposure

Security Risk: TBC
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Information Exposure
CVE: CVE-2026-86603
Number of Installations: 50,000+
Affected Software: WP Recipe Maker ≤ 10.8.1
Patched Versions: 10.8.2

Mitigation steps: Update to WP Recipe Maker version 10.8.2 or greater.

WP Recipe Maker – Authenticated (Subscriber+) Information Exposure

Security Risk: TBC
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Information Exposure
CVE: CVE-2026-86602
Number of Installations: 50,000+
Affected Software: WP Recipe Maker 10.3.0 - 10.8.1
Patched Versions: 10.8.2

Mitigation steps: Update to WP Recipe Maker version 10.8.2 or greater.

Blog2Social: Social Media Auto Post & Scheduler – Insecure Direct Object Reference

Security Risk: Medium
Exploitation Level: Requires custom role.
Vulnerability: Insecure Direct Object Reference
CVE: CVE-2026-89031
Number of Installations: 50,000+
Affected Software: Blog2Social: Social Media Auto Post & Scheduler ≤ 9.0.0
Patched Versions: 9.1.0

Mitigation steps: Update to Blog2Social: Social Media Auto Post & Scheduler version 9.1.0 or greater.

Blog2Social: Social Media Auto Post & Scheduler – Authenticated (Subscriber+) Username Enumeration

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Username Enumeration
CVE: CVE-2026-89029
Number of Installations: 50,000+
Affected Software: Blog2Social: Social Media Auto Post & Scheduler ≤ 9.0.0
Patched Versions: 9.1.0

Mitigation steps: Update to Blog2Social: Social Media Auto Post & Scheduler version 9.1.0 or greater.

Blog2Social: Social Media Auto Post & Scheduler – Missing Authorization

Security Risk: Medium
Exploitation Level: Requires custom role.
Vulnerability: Missing Authorization
CVE: CVE-2026-89030
Number of Installations: 50,000+
Affected Software: Blog2Social: Social Media Auto Post & Scheduler ≤ 9.0.0
Patched Versions: 9.1.0

Mitigation steps: Update to Blog2Social: Social Media Auto Post & Scheduler version 9.1.0 or greater.

Seraphinite Accelerator – Authenticated (Subscriber+) Full Admin Area Denial of Service

Security Risk: Low
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Authenticated (Subscriber+) Full Admin Area Denial of Service
CVE: CVE-2026-87828
Number of Installations: 50,000+
Affected Software: Seraphinite Accelerator ≤ 2.29.23
Patched Versions: 2.29.24

Mitigation steps: Update to Seraphinite Accelerator version 2.29.24 or greater.

WP Recipe Maker – Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via ‘[wprm-recipe]’ Shortcode

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode
CVE: CVE-2026-75905
Number of Installations: 50,000+
Affected Software: WP Recipe Maker ≤ 10.8.0
Patched Versions: 10.8.1

Mitigation steps: Update to WP Recipe Maker version 10.8.1 or greater.

Themes

Astra – Authenticated (Shop Manager+) Arbitrary CSS Injection

Security Risk: High
Exploitation Level: Requires Shop Manager or higher level authentication.
Vulnerability: Authenticated (Shop Manager+) Arbitrary CSS Injection
CVE: CVE-2026-27085
Number of Installations: 1,000,000+
Affected Software: Astra ≤ 4.13.12
Patched Versions: 4.14.0

Mitigation steps: Update to Astra version 4.14.0 or greater.

Update your website software to reduce risk. Users unable to upgrade to the latest version are advised to implement a web application firewall, which can virtually patch known vulnerabilities and safeguard their website.