WordPress Vulnerability Report

WordPress Vulnerability Report — January 28, 2026

Since last week, 225 new vulnerabilities have emerged in the WordPress ecosystem, including 207 plugins and 18 themes. Of those, 123 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

Avatar photo
Sarah Ulmer

Published:Jan 28, 2026

Filed Under:WordPress Vulnerability Report

Reading Time:40 min.

In this report, 225 vulnerabilities have been publicly disclosed. Security patches for 102 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 123 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.9 “Gene” was released on December 2, 2025, adding Notes for block-level comments, an expanded Command Palette, and the new Abilities API to standardize permissions for future automation. It also includes performance improvements and new blocks and design tools to support faster, more flexible site building.

After any major release, don’t update live sites until you’ve taken backups and tested in a non-production environment.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 89 Patched / 118 Unpatched

Ecwid by Lightspeed Ecommerce Shopping Cart

Plugin:
Ecwid by Lightspeed Ecommerce Shopping Cart
Plugin Slug:
ecwid-shopping-cart
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24580
The vulnerability has not been patched. You should deactivate the plugin.

Kama Thumbnail

Plugin:
Kama Thumbnail
Plugin Slug:
kama-thumbnail
Installations
10,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24521
The vulnerability has not been patched. You should deactivate the plugin.

Responsive Contact Form Builder & Lead Generation Plugin

Plugin:
Responsive Contact Form Builder & Lead Generation Plugin
Plugin Slug:
lead-form-builder
Installations
10,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-68046
The vulnerability has not been patched. You should deactivate the plugin.

Web Push Notifications – Webpushr

Plugin:
Web Push Notifications – Webpushr
Plugin Slug:
webpushr-web-push-notifications
Installations
10,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24536
The vulnerability has not been patched. You should deactivate the plugin.

CLP Varnish Cache

Plugin:
CLP Varnish Cache
Plugin Slug:
clp-varnish-cache
Installations
9,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24525
The vulnerability has not been patched. You should deactivate the plugin.

WP FullCalendar

Plugin:
WP FullCalendar
Plugin Slug:
wp-fullcalendar
Installations
9,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24523
The vulnerability has not been patched. You should deactivate the plugin.

WP Subscribe

Plugin:
WP Subscribe
Plugin Slug:
wp-subscribe
Installations
9,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24522
The vulnerability has not been patched. You should deactivate the plugin.

Booter – Bots & Crawlers Manager

Plugin:
Booter – Bots & Crawlers Manager
Plugin Slug:
booter-bots-crawlers-manager
Installations
8,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24534
The vulnerability has not been patched. You should deactivate the plugin.

Download After Email – Subscribe & Download Form Plugin

Plugin:
Download After Email – Subscribe & Download Form Plugin
Plugin Slug:
download-after-email
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24541
The vulnerability has not been patched. You should deactivate the plugin.

HD Quiz

Plugin:
HD Quiz
Plugin Slug:
hd-quiz
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24544
The vulnerability has not been patched. You should deactivate the plugin.

Materialis Companion

Plugin:
Materialis Companion
Plugin Slug:
materialis-companion
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24543
The vulnerability has not been patched. You should deactivate the plugin.

WP BackItUp Community Edition

Plugin:
WP BackItUp Community Edition
Plugin Slug:
wp-backitup
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-68039
The vulnerability has not been patched. You should deactivate the plugin.

WP Term Order

Plugin:
WP Term Order
Plugin Slug:
wp-term-order
Installations
7,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24542
The vulnerability has not been patched. You should deactivate the plugin.

Monetag Official Plugin

Plugin:
Monetag Official Plugin
Plugin Slug:
monetag-official
Installations
6,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24551
The vulnerability has not been patched. You should deactivate the plugin.

BOX NOW Delivery

Plugin:
BOX NOW Delivery
Plugin Slug:
box-now-delivery
Installations
5,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24571
The vulnerability has not been patched. You should deactivate the plugin.

Cloudinary – Deliver Images and Videos at Scale

Plugin:
Cloudinary – Deliver Images and Videos at Scale
Plugin Slug:
cloudinary-image-management-and-manipulation-in-the-cloud-cdn
Installations
5,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24560
The vulnerability has not been patched. You should deactivate the plugin.

Easy Property Listings

Plugin:
Easy Property Listings
Plugin Slug:
easy-property-listings
Installations
5,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-68072
The vulnerability has not been patched. You should deactivate the plugin.

Edwiser Bridge – WordPress Moodle Integration

Plugin:
Edwiser Bridge – WordPress Moodle Integration
Plugin Slug:
edwiser-bridge
Installations
5,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24570
The vulnerability has not been patched. You should deactivate the plugin.

Fraud Prevention For WooCommerce and EDD

Plugin:
Fraud Prevention For WooCommerce and EDD
Plugin Slug:
woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers
Installations
5,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24553
The vulnerability has not been patched. You should deactivate the plugin.

Ai Image Alt Text Generator for WP

Plugin:
Ai Image Alt Text Generator for WP
Plugin Slug:
ai-image-alt-text-generator-for-wp
Installations
4,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24579
The vulnerability has not been patched. You should deactivate the plugin.

Ryviu – Product Reviews for WooCommerce

Plugin:
Ryviu – Product Reviews for WooCommerce
Plugin Slug:
ryviu
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24562
The vulnerability has not been patched. You should deactivate the plugin.

Admin login URL Change

Plugin:
Admin login URL Change
Plugin Slug:
admin-login-url-change
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24578
The vulnerability has not been patched. You should deactivate the plugin.

Anything Order by Terms

Plugin:
Anything Order by Terms
Plugin Slug:
anything-order-by-terms
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24567
The vulnerability has not been patched. You should deactivate the plugin.

Contact Form 7 GetResponse Extension

Plugin:
Contact Form 7 GetResponse Extension
Plugin Slug:
contact-form-7-getresponse-extension
Installations
1,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24557
The vulnerability has not been patched. You should deactivate the plugin.

iNET Webkit

Plugin:
iNET Webkit
Plugin Slug:
inet-webkit
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24566
The vulnerability has not been patched. You should deactivate the plugin.

SEO Booster

Plugin:
SEO Booster
Plugin Slug:
seo-booster
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-68019
The vulnerability has not been patched. You should deactivate the plugin.

UX Flat

Plugin:
UX Flat
Plugin Slug:
ux-flat
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24576
The vulnerability has not been patched. You should deactivate the plugin.

WebP Conversion

Plugin:
WebP Conversion
Plugin Slug:
webp-conversion
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24530
The vulnerability has not been patched. You should deactivate the plugin.

Nova Blocks by Pixelgrade

Plugin:
Nova Blocks by Pixelgrade
Plugin Slug:
nova-blocks
Installations
900+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24528
The vulnerability has not been patched. You should deactivate the plugin.

Omnipress

Plugin:
Omnipress
Plugin Slug:
omnipress
Installations
900+
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-24538
The vulnerability has not been patched. You should deactivate the plugin.

Email Inquiry & Cart Options for WooCommerce

Plugin:
Email Inquiry & Cart Options for WooCommerce
Plugin Slug:
woocommerce-email-inquiry-cart-options
Installations
900+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24526
The vulnerability has not been patched. You should deactivate the plugin.

Quick Restaurant Reservations

Plugin:
Quick Restaurant Reservations
Plugin Slug:
quick-restaurant-reservations
Installations
600+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24529
The vulnerability has not been patched. You should deactivate the plugin.

Textmetrics

Plugin:
Textmetrics
Plugin Slug:
webtexttool
Installations
500+
Vulnerability:
Content Injection
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24564
The vulnerability has not been patched. You should deactivate the plugin.

My Post Order

Plugin:
My Post Order
Plugin Slug:
my-posts-order
Installations
400+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68004
The vulnerability has not been patched. You should deactivate the plugin.

Table of Contents Creator

Plugin:
Table of Contents Creator
Plugin Slug:
table-of-contents-creator
Installations
400+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68836
The vulnerability has not been patched. You should deactivate the plugin.

iRobots.txt SEO

Plugin:
iRobots.txt SEO
Plugin Slug:
irobotstxt-seo
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68840
The vulnerability has not been patched. You should deactivate the plugin.

ravpage

Plugin:
ravpage
Plugin Slug:
ravpage
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68835
The vulnerability has not been patched. You should deactivate the plugin.

amr cron manager

Plugin:
amr cron manager
Plugin Slug:
amr-cron-manager
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68848
The vulnerability has not been patched. You should deactivate the plugin.

ArtPlacer Widget

Plugin:
ArtPlacer Widget
Plugin Slug:
artplacer-widget
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24555
The vulnerability has not been patched. You should deactivate the plugin.

ExpressTechSoftwares Addon for MemberPress and Discord

Plugin:
ExpressTechSoftwares Addon for MemberPress and Discord
Plugin Slug:
expresstechsoftwares-memberpress-discord-add-on
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68838
The vulnerability has not been patched. You should deactivate the plugin.

LifePress

Plugin:
LifePress
Plugin Slug:
lifepress
Installations
200+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24563
The vulnerability has not been patched. You should deactivate the plugin.

Paid Downloads

Plugin:
Paid Downloads
Plugin Slug:
paid-downloads
Installations
100+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-68857
The vulnerability has not been patched. You should deactivate the plugin.

wpCAS

Plugin:
wpCAS
Plugin Slug:
wpcas
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68858
The vulnerability has not been patched. You should deactivate the plugin.

Dinatur

Plugin:
Dinatur
Plugin Slug:
dinatur
Installations
80+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68866
The vulnerability has not been patched. You should deactivate the plugin.

ABG Rich Pins

Plugin:
ABG Rich Pins
Plugin Slug:
abg-rich-pins
Installations
50+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24558
The vulnerability has not been patched. You should deactivate the plugin.

Scalenut

Plugin:
Scalenut
Plugin Slug:
scalenut
Installations
40+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68882
The vulnerability has not been patched. You should deactivate the plugin.

ShoutOut

Plugin:
ShoutOut
Plugin Slug:
shoutout
Installations
40+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68894
The vulnerability has not been patched. You should deactivate the plugin.

Administrative Shortcodes

Plugin:
Administrative Shortcodes
Plugin Slug:
administrative-shortcodes
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1099
The vulnerability has not been patched. You should deactivate the plugin.

Administrative Shortcodes

Plugin:
Administrative Shortcodes
Plugin Slug:
administrative-shortcodes
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1257
The vulnerability has not been patched. You should deactivate the plugin.

AdminQuickbar

Plugin:
AdminQuickbar
Plugin Slug:
adminquickbar
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14630
The vulnerability has not been patched. You should deactivate the plugin.

Alchemist Ajax Upload

Plugin:
Alchemist Ajax Upload
Plugin Slug:
alchemist-ajax-upload
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14629
The vulnerability has not been patched. You should deactivate the plugin.

Alpha Blocks

Plugin:
Alpha Blocks
Plugin Slug:
alpha-blocks
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14985
The vulnerability has not been patched. You should deactivate the plugin.

Canto Testimonials

Plugin:
Canto Testimonials
Plugin Slug:
canto-testimonials
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1095
The vulnerability has not been patched. You should deactivate the plugin.

CM CSS Columns

Plugin:
CM CSS Columns
Plugin Slug:
cm-css-columns
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1098
The vulnerability has not been patched. You should deactivate the plugin.

Cookie consent for developers

Plugin:
Cookie consent for developers
Plugin Slug:
cookie-consent-for-developers
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1084
The vulnerability has not been patched. You should deactivate the plugin.

Coven Core

Plugin:
Coven Core
Plugin Slug:
coven-core
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-69295
The vulnerability has not been patched. You should deactivate the plugin.

Directorist Booking

Plugin:
Directorist Booking
Plugin Slug:
directorist-booking
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22336
The vulnerability has not been patched. You should deactivate the plugin.

Directorist Social Login

Plugin:
Directorist Social Login
Plugin Slug:
directorist-social-login
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22337
The vulnerability has not been patched. You should deactivate the plugin.

E-xact Hosted Payment

Plugin:
E-xact Hosted Payment
Plugin Slug:
e-xact-hosted-payment
Vulnerability:
Arbitrary File Deletion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-14829
The vulnerability has not been patched. You should deactivate the plugin.

Easy Theme Options

Plugin:
Easy Theme Options
Plugin Slug:
easy-theme-options
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68839
The vulnerability has not been patched. You should deactivate the plugin.

Final User

Plugin:
Final User
Plugin Slug:
final-user
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69293
The vulnerability has not been patched. You should deactivate the plugin.

Final User

Plugin:
Final User
Plugin Slug:
final-user
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69187
The vulnerability has not been patched. You should deactivate the plugin.

fitness-trainer

Plugin:
fitness-trainer
Plugin Slug:
fitness-trainer
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69188
The vulnerability has not been patched. You should deactivate the plugin.

GZSEO

Plugin:
GZSEO
Plugin Slug:
gzseo
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14941
The vulnerability has not been patched. You should deactivate the plugin.

Hospital Doctor Directory

Plugin:
Hospital Doctor Directory
Plugin Slug:
hospital-doctor-directory
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68057
The vulnerability has not been patched. You should deactivate the plugin.

Hospital Doctor Directory

Plugin:
Hospital Doctor Directory
Plugin Slug:
hospital-doctor-directory
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69186
The vulnerability has not been patched. You should deactivate the plugin.

Hospital Doctor Directory

Plugin:
Hospital Doctor Directory
Plugin Slug:
hospital-doctor-directory
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69183
The vulnerability has not been patched. You should deactivate the plugin.

Hotel Listing

Plugin:
Hotel Listing
Plugin Slug:
hotel-listing
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68059
The vulnerability has not been patched. You should deactivate the plugin.

Hotel Listing

Plugin:
Hotel Listing
Plugin Slug:
hotel-listing
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69185
The vulnerability has not been patched. You should deactivate the plugin.

Institutions Directory

Plugin:
Institutions Directory
Plugin Slug:
institutions-directory
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-68058
The vulnerability has not been patched. You should deactivate the plugin.

Institutions Directory

Plugin:
Institutions Directory
Plugin Slug:
institutions-directory
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69184
The vulnerability has not been patched. You should deactivate the plugin.

Institutions Directory

Plugin:
Institutions Directory
Plugin Slug:
institutions-directory
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69182
The vulnerability has not been patched. You should deactivate the plugin.

Integrate Google Drive

Plugin:
Integrate Google Drive
Plugin Slug:
integrate-google-drive
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24540
The vulnerability has not been patched. You should deactivate the plugin.

JavaScript Notifier

Plugin:
JavaScript Notifier
Plugin Slug:
javascript-notifier
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1191
The vulnerability has not been patched. You should deactivate the plugin.

JobBank

Plugin:
JobBank
Plugin Slug:
jobbank
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69189
The vulnerability has not been patched. You should deactivate the plugin.

JustClick registration plugin

Plugin:
JustClick registration plugin
Plugin Slug:
justclick-subscriber
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-13676
The vulnerability has not been patched. You should deactivate the plugin.

Kalrav AI Agent

Plugin:
Kalrav AI Agent
Plugin Slug:
kalrav-ai-agent
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-13374
The vulnerability has not been patched. You should deactivate the plugin.

Lawyer Directory

Plugin:
Lawyer Directory
Plugin Slug:
lawyer-directory
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69181
The vulnerability has not been patched. You should deactivate the plugin.

ListingHub

Plugin:
ListingHub
Plugin Slug:
listinghub
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69191
The vulnerability has not been patched. You should deactivate the plugin.

Login Page Editor

Plugin:
Login Page Editor
Plugin Slug:
login-page-editor
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1088
The vulnerability has not been patched. You should deactivate the plugin.

Meta-box GalleryMeta

Plugin:
Meta-box GalleryMeta
Plugin Slug:
meta-box-gallerymeta
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Low
CVE:
2026-0687
The vulnerability has not been patched. You should deactivate the plugin.

Meta-box GalleryMeta

Plugin:
Meta-box GalleryMeta
Plugin Slug:
meta-box-gallerymeta
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1302
The vulnerability has not been patched. You should deactivate the plugin.

Moderate Selected Posts

Plugin:
Moderate Selected Posts
Plugin Slug:
moderate-selected-posts
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14907
The vulnerability has not been patched. You should deactivate the plugin.

Postalicious

Plugin:
Postalicious
Plugin Slug:
postalicious
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1266
The vulnerability has not been patched. You should deactivate the plugin.

Radio Player

Plugin:
Radio Player
Plugin Slug:
radio-player
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24548
The vulnerability has not been patched. You should deactivate the plugin.

Real Estate Pro

Plugin:
Real Estate Pro
Plugin Slug:
real-estate-pro
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69192
The vulnerability has not been patched. You should deactivate the plugin.

Responsive Header

Plugin:
Responsive Header
Plugin Slug:
responsive-header
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1300
The vulnerability has not been patched. You should deactivate the plugin.

Set Bulk Post Categories

Plugin:
Set Bulk Post Categories
Plugin Slug:
set-bulk-post-categories
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1081
The vulnerability has not been patched. You should deactivate the plugin.

Simple Crypto Shortcodes

Plugin:
Simple Crypto Shortcodes
Plugin Slug:
simple-crypto-shortcodes
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14903
The vulnerability has not been patched. You should deactivate the plugin.

Star Review Manager

Plugin:
Star Review Manager
Plugin Slug:
star-review-manager
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1076
The vulnerability has not been patched. You should deactivate the plugin.

ThemeRuby Multi Authors

Plugin:
ThemeRuby Multi Authors
Plugin Slug:
themeruby-multi-authors
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1097
The vulnerability has not been patched. You should deactivate the plugin.

Ultra Portfolio

Plugin:
Ultra Portfolio
Plugin Slug:
ultra-portfolio
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69180
The vulnerability has not been patched. You should deactivate the plugin.

Alex User Counter

Plugin:
Alex User Counter
Plugin Slug:
user-counter
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1070
The vulnerability has not been patched. You should deactivate the plugin.

Viet contact

Plugin:
Viet contact
Plugin Slug:
viet-contact
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1045
The vulnerability has not been patched. You should deactivate the plugin.

VK Google Job Posting Manager

Plugin:
VK Google Job Posting Manager
Plugin Slug:
vk-google-job-posting-manager
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-12836
The vulnerability has not been patched. You should deactivate the plugin.

Wise Analytics

Plugin:
Wise Analytics
Plugin Slug:
wise-analytics
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14609
The vulnerability has not been patched. You should deactivate the plugin.

WishList Member X

Plugin:
WishList Member X
Plugin Slug:
wishlist-member-x
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-24575
The vulnerability has not been patched. You should deactivate the plugin.

Wizit Gateway for WooCommerce

Plugin:
Wizit Gateway for WooCommerce
Plugin Slug:
wizit-gateway-for-woocommerce
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14843
The vulnerability has not been patched. You should deactivate the plugin.

WP-ClanWars

Plugin:
WP-ClanWars
Plugin Slug:
wp-clanwars
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-0806
The vulnerability has not been patched. You should deactivate the plugin.

WP Hello Bar

Plugin:
WP Hello Bar
Plugin Slug:
wp-hello-bar
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1042
The vulnerability has not been patched. You should deactivate the plugin.

WP Membership

Plugin:
WP Membership
Plugin Slug:
wp-membership
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69292
The vulnerability has not been patched. You should deactivate the plugin.

WP Membership

Plugin:
WP Membership
Plugin Slug:
wp-membership
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69193
The vulnerability has not been patched. You should deactivate the plugin.

WP Youtube Video Gallery

Plugin:
WP Youtube Video Gallery
Plugin Slug:
wp-youtube-video-gallery
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14906
The vulnerability has not been patched. You should deactivate the plugin.

ZT Captcha

Plugin:
ZT Captcha
Plugin Slug:
zt-captcha
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1075
The vulnerability has not been patched. You should deactivate the plugin.

The Events Calendar

Plugin:
The Events Calendar
Plugin Slug:
the-events-calendar
Installations
700,000+
Vulnerability:
Broken Access Control
Patched in Version:
6.15.13.1
Severity Score:
Medium
CVE:
2025-15043
The vulnerability has been patched, so you should update to version 6.15.13.1.

Happy Addons for Elementor

Plugin:
Happy Addons for Elementor
Plugin Slug:
happy-elementor-addons
Installations
400,000+
Vulnerability:
SQL Injection
Patched in Version:
3.20.6
Severity Score:
High
CVE:
2025-68999
The vulnerability has been patched, so you should update to version 3.20.6.

Custom Fonts – Host Your Fonts Locally

Plugin:
Custom Fonts – Host Your Fonts Locally
Plugin Slug:
custom-fonts
Installations
300,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.1.17
Severity Score:
Medium
CVE:
2025-14351
The vulnerability has been patched, so you should update to version 2.1.17.

Newsletter – Send awesome emails from WordPress

Plugin:
Newsletter – Send awesome emails from WordPress
Plugin Slug:
newsletter
Installations
300,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
9.1.1
Severity Score:
Medium
CVE:
2026-1051
The vulnerability has been patched, so you should update to version 9.1.1.

WP Go Maps (formerly WP Google Maps)

Plugin:
WP Go Maps (formerly WP Google Maps)
Plugin Slug:
wp-google-maps
Installations
300,000+
Vulnerability:
Broken Access Control
Patched in Version:
10.0.05
Severity Score:
Medium
CVE:
2026-0593
The vulnerability has been patched, so you should update to version 10.0.05.

Photo Gallery by 10Web – Mobile-Friendly Image Gallery

Plugin:
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Plugin Slug:
photo-gallery
Installations
200,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.8.37
Severity Score:
Medium
CVE:
2026-1036
The vulnerability has been patched, so you should update to version 1.8.37.

Advanced Custom Fields: Extended

Plugin:
Advanced Custom Fields: Extended
Plugin Slug:
acf-extended
Installations
100,000+
Vulnerability:
Privilege Escalation
Patched in Version:
0.9.2.2
Severity Score:
Critical
CVE:
2025-14533
The vulnerability has been patched, so you should update to version 0.9.2.2.

Beaver Builder Page Builder – Drag and Drop Website Builder

Plugin:
Beaver Builder Page Builder – Drag and Drop Website Builder
Plugin Slug:
beaver-builder-lite-version
Installations
100,000+
Vulnerability:
Arbitrary Code Execution
Patched in Version:
2.9.4.2
Severity Score:
High
CVE:
2025-69319
The vulnerability has been patched, so you should update to version 2.9.4.2.

BuddyPress

Plugin:
BuddyPress
Plugin Slug:
buddypress
Installations
100,000+
Vulnerability:
Arbitrary Code Execution
Patched in Version:
14.3.4
Severity Score:
High
CVE:
2024-11976
The vulnerability has been patched, so you should update to version 14.3.4.

Schema & Structured Data for WP & AMP

Plugin:
Schema & Structured Data for WP & AMP
Plugin Slug:
schema-and-structured-data-for-wp
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.54.1
Severity Score:
Medium
CVE:
2025-14069
The vulnerability has been patched, so you should update to version 1.54.1.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.9.5
Severity Score:
Medium
CVE:
2026-0548
The vulnerability has been patched, so you should update to version 3.9.5.

User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin

Plugin:
User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.4.7
Severity Score:
High
CVE:
2025-67956
The vulnerability has been patched, so you should update to version 4.4.7.

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

Plugin:
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
Plugin Slug:
notificationx
Installations
40,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.2.1
Severity Score:
Medium
CVE:
2026-0554
The vulnerability has been patched, so you should update to version 3.2.1.

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

Plugin:
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
Plugin Slug:
notificationx
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.1
Severity Score:
High
CVE:
2025-15380
The vulnerability has been patched, so you should update to version 3.2.1.

MailerLite – WooCommerce integration

Plugin:
MailerLite – WooCommerce integration
Plugin Slug:
woo-mailerlite
Installations
30,000+
Vulnerability:
SQL Injection
Patched in Version:
3.1.3
Severity Score:
Critical
CVE:
2025-67945
The vulnerability has been patched, so you should update to version 3.1.3.

Xpro Addons — 140+ Widgets for Elementor

Plugin:
Xpro Addons — 140+ Widgets for Elementor
Plugin Slug:
xpro-elementor-addons
Installations
30,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.4.20
Severity Score:
Critical
CVE:
2025-69312
The vulnerability has been patched, so you should update to version 1.4.20.

All-in-One Video Gallery

Plugin:
All-in-One Video Gallery
Plugin Slug:
all-in-one-video-gallery
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.7.1
Severity Score:
Medium
CVE:
2025-15516
The vulnerability has been patched, so you should update to version 4.7.1.

All-in-One Video Gallery

Plugin:
All-in-One Video Gallery
Plugin Slug:
all-in-one-video-gallery
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.7.1
Severity Score:
Medium
CVE:
2025-14947
The vulnerability has been patched, so you should update to version 4.7.1.

Image Photo Gallery Final Tiles Grid

Plugin:
Image Photo Gallery Final Tiles Grid
Plugin Slug:
final-tiles-grid-gallery-lite
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.6.10
Severity Score:
Medium
CVE:
2025-15466
The vulnerability has been patched, so you should update to version 3.6.10.

UPI QR Code Payment Gateway for WooCommerce

Plugin:
UPI QR Code Payment Gateway for WooCommerce
Plugin Slug:
upi-qr-code-payment-for-woocommerce
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.6.1
Severity Score:
Medium
CVE:
2025-67969
The vulnerability has been patched, so you should update to version 1.6.1.

Demo Importer Plus

Plugin:
Demo Importer Plus
Plugin Slug:
demo-importer-plus
Installations
10,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
2.0.10
Severity Score:
High
CVE:
2025-14478
The vulnerability has been patched, so you should update to version 2.0.10.

FlatPM – Ad Manager, AdSense and Custom Code

Plugin:
FlatPM – Ad Manager, AdSense and Custom Code
Plugin Slug:
flatpm-wp
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.3
Severity Score:
Medium
CVE:
2026-0690
The vulnerability has been patched, so you should update to version 3.2.3.

Head Meta Data

Plugin:
Head Meta Data
Plugin Slug:
head-meta-data
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
20260105
Severity Score:
Medium
CVE:
2026-0608
The vulnerability has been patched, so you should update to version 20260105.

LA-Studio Element Kit for Elementor

Plugin:
LA-Studio Element Kit for Elementor
Plugin Slug:
lastudio-element-kit
Installations
10,000+
Vulnerability:
Backdoor
Patched in Version:
1.6.0
Severity Score:
Critical
CVE:
2026-0920
The vulnerability has been patched, so you should update to version 1.6.0.

Nexter Extension – Site Enhancements Toolkit

Plugin:
Nexter Extension – Site Enhancements Toolkit
Plugin Slug:
nexter-extension
Installations
10,000+
Vulnerability:
PHP Object Injection
Patched in Version:
4.4.7
Severity Score:
Critical
CVE:
2026-0726
The vulnerability has been patched, so you should update to version 4.4.7.

Recipe Card Blocks Lite

Plugin:
Recipe Card Blocks Lite
Plugin Slug:
recipe-card-blocks-by-wpzoom
Installations
10,000+
Vulnerability:
SQL Injection
Patched in Version:
3.4.13
Severity Score:
High
CVE:
2025-14973
The vulnerability has been patched, so you should update to version 3.4.13.

WP DSGVO Tools (GDPR)

Plugin:
WP DSGVO Tools (GDPR)
Plugin Slug:
shapepress-dsgvo
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.1.37
Severity Score:
Medium
CVE:
2026-0914
The vulnerability has been patched, so you should update to version 3.1.37.

Automatic Featured Images from Videos

Plugin:
Automatic Featured Images from Videos
Plugin Slug:
automatic-featured-images-from-videos
Installations
8,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.2.8
Severity Score:
Medium
CVE:
2026-24535
The vulnerability has been patched, so you should update to version 1.2.8.

Protección de datos – RGPD

Plugin:
Protección de datos – RGPD
Plugin Slug:
proteccion-datos-rgpd
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
0.69
Severity Score:
Medium
CVE:
2026-24539
The vulnerability has been patched, so you should update to version 0.69.

Poll, Survey & Quiz Maker Plugin by Opinion Stage

Plugin:
Poll, Survey & Quiz Maker Plugin by Opinion Stage
Plugin Slug:
social-polls-by-opinionstage
Installations
7,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
19.6.25
Severity Score:
High
The vulnerability has been patched, so you should update to version 19.6.25.

Media Library File Size

Plugin:
Media Library File Size
Plugin Slug:
media-library-file-size
Installations
5,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.6.8
Severity Score:
Medium
CVE:
2026-24569
The vulnerability has been patched, so you should update to version 1.6.8.

Booking Activities

Plugin:
Booking Activities
Plugin Slug:
booking-activities
Installations
4,000+
Vulnerability:
Privilege Escalation
Patched in Version:
1.16.45
Severity Score:
High
CVE:
2025-67953
The vulnerability has been patched, so you should update to version 1.16.45.

Tabby Checkout

Plugin:
Tabby Checkout
Plugin Slug:
tabby-checkout
Installations
4,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
5.9.1
Severity Score:
High
CVE:
2025-68035
The vulnerability has been patched, so you should update to version 5.9.1.

AIKTP

Plugin:
AIKTP
Plugin Slug:
aiktp
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.0.05
Severity Score:
Medium
CVE:
2026-1103
The vulnerability has been patched, so you should update to version 5.0.05.

Frontis Blocks — Block Library for the Block Editor

Plugin:
Frontis Blocks — Block Library for the Block Editor
Plugin Slug:
frontis-blocks
Installations
3,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
1.1.7
Severity Score:
High
CVE:
2026-0807
The vulnerability has been patched, so you should update to version 1.1.7.

Frontis Blocks — Block Library for the Block Editor

Plugin:
Frontis Blocks — Block Library for the Block Editor
Plugin Slug:
frontis-blocks
Installations
3,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
1.1.6
Severity Score:
High
CVE:
2025-68030
The vulnerability has been patched, so you should update to version 1.1.6.

Gallery PhotoBlocks

Plugin:
Gallery PhotoBlocks
Plugin Slug:
photoblocks-grid-gallery
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.3
Severity Score:
Medium
CVE:
2026-24389
The vulnerability has been patched, so you should update to version 1.3.3.

Salon Booking System – Free Version

Plugin:
Salon Booking System – Free Version
Plugin Slug:
salon-booking-system
Installations
3,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
10.30.4
Severity Score:
Medium
CVE:
2025-67954
The vulnerability has been patched, so you should update to version 10.30.4.

Same Category Posts

Plugin:
Same Category Posts
Plugin Slug:
same-category-posts
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.20
Severity Score:
Medium
CVE:
2025-14797
The vulnerability has been patched, so you should update to version 1.1.20.

WP Directory Kit

Plugin:
WP Directory Kit
Plugin Slug:
wpdirectorykit
Installations
3,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
1.5.0
Severity Score:
Medium
CVE:
2025-13920
The vulnerability has been patched, so you should update to version 1.5.0.

KiviCare – Clinic & Patient Management System (EHR)

Plugin:
KiviCare – Clinic & Patient Management System (EHR)
Plugin Slug:
kivicare-clinic-management-system
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.6.16
Severity Score:
Medium
CVE:
2026-0927
The vulnerability has been patched, so you should update to version 3.6.16.

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments

Plugin:
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
Plugin Slug:
wallet-system-for-woocommerce
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.7.3
Severity Score:
Medium
CVE:
2025-14450
The vulnerability has been patched, so you should update to version 2.7.3.

ElementCamp

Plugin:
ElementCamp
Plugin Slug:
element-camp
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.3.6
Severity Score:
Medium
CVE:
2026-24556
The vulnerability has been patched, so you should update to version 2.3.6.

Friendly Functions for Welcart

Plugin:
Friendly Functions for Welcart
Plugin Slug:
friendly-functions-for-welcart
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.2.6
Severity Score:
Medium
CVE:
2026-1208
The vulnerability has been patched, so you should update to version 1.2.6.

GDPR CCPA Compliance & Cookie Consent Banner

Plugin:
GDPR CCPA Compliance & Cookie Consent Banner
Plugin Slug:
ninja-gdpr-compliance
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.7.5
Severity Score:
Medium
CVE:
2025-68073
The vulnerability has been patched, so you should update to version 2.7.5.

Quick Contact Form

Plugin:
Quick Contact Form
Plugin Slug:
quick-contact-form
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
8.2.7
Severity Score:
Medium
CVE:
2025-12718
The vulnerability has been patched, so you should update to version 8.2.7.

Broadstreet

Plugin:
Broadstreet
Plugin Slug:
broadstreet
Installations
700+
Vulnerability:
Broken Access Control
Patched in Version:
1.52.2
Severity Score:
High
CVE:
2025-69311
The vulnerability has been patched, so you should update to version 1.52.2.

My auctions allegro

Plugin:
My auctions allegro
Plugin Slug:
my-auctions-allegro-free-edition
Installations
600+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.6.33
Severity Score:
High
CVE:
2025-67943
The vulnerability has been patched, so you should update to version 3.6.33.

TaxCloud for WooCommerce

Plugin:
TaxCloud for WooCommerce
Plugin Slug:
simple-sales-tax
Installations
500+
Vulnerability:
Broken Access Control
Patched in Version:
8.4.0
Severity Score:
Medium
CVE:
2025-67958
The vulnerability has been patched, so you should update to version 8.4.0.

TableOn – WordPress Posts Table Filterable 

Plugin:
TableOn – WordPress Posts Table Filterable 
Plugin Slug:
posts-table-filterable
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.4.3
Severity Score:
High
CVE:
2025-69316
The vulnerability has been patched, so you should update to version 1.0.4.3.

Thim Blocks

Plugin:
Thim Blocks
Plugin Slug:
thim-blocks
Installations
300+
Vulnerability:
Arbitrary File Download
Patched in Version:
1.0.2
Severity Score:
Medium
CVE:
2025-13725
The vulnerability has been patched, so you should update to version 1.0.2.

Link Invoice Payment for WooCommerce

Plugin:
Link Invoice Payment for WooCommerce
Plugin Slug:
invoice-payment-for-woocommerce
Installations
200+
Vulnerability:
Broken Access Control
Patched in Version:
2.8.1
Severity Score:
Medium
CVE:
2025-14971
The vulnerability has been patched, so you should update to version 2.8.1.

Melapress Role Editor

Plugin:
Melapress Role Editor
Plugin Slug:
melapress-role-editor
Installations
50+
Vulnerability:
Privilege Escalation
Patched in Version:
1.2.0
Severity Score:
High
CVE:
2025-14866
The vulnerability has been patched, so you should update to version 1.2.0.

AdForest Elementor

Plugin:
AdForest Elementor
Plugin Slug:
adforest-elementor
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.12
Severity Score:
High
CVE:
2025-67947
The vulnerability has been patched, so you should update to version 3.0.12.

Homey Core

Plugin:
Homey Core
Plugin Slug:
homey-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.4
Severity Score:
High
CVE:
2025-67964
The vulnerability has been patched, so you should update to version 2.4.4.

Kentha Elementor Widgets

Plugin:
Kentha Elementor Widgets
Plugin Slug:
kentha-elementor
Vulnerability:
Local File Inclusion
Patched in Version:
3.1
Severity Score:
High
CVE:
2026-24390
The vulnerability has been patched, so you should update to version 3.1.

Lawyer Directory

Plugin:
Lawyer Directory
Plugin Slug:
lawyer-directory
Vulnerability:
Broken Access Control
Patched in Version:
1.3.4
Severity Score:
High
CVE:
2025-67967
The vulnerability has been patched, so you should update to version 1.3.4.

Lawyer Directory

Plugin:
Lawyer Directory
Plugin Slug:
lawyer-directory
Vulnerability:
Privilege Escalation
Patched in Version:
1.3.4
Severity Score:
High
CVE:
2025-67966
The vulnerability has been patched, so you should update to version 1.3.4.

Listivo Core

Plugin:
Listivo Core
Plugin Slug:
listivo-core
Vulnerability:
Local File Inclusion
Patched in Version:
2.3.78
Severity Score:
High
CVE:
2025-67957
The vulnerability has been patched, so you should update to version 2.3.78.

Movie Booking

Plugin:
Movie Booking
Plugin Slug:
movie-booking
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.1.6
Severity Score:
High
CVE:
2025-67963
The vulnerability has been patched, so you should update to version 1.1.6.

MyHome Core

Plugin:
MyHome Core
Plugin Slug:
myhome-core
Vulnerability:
Local File Inclusion
Patched in Version:
4.1.1
Severity Score:
High
CVE:
2025-67955
The vulnerability has been patched, so you should update to version 4.1.1.

Real Homes CRM

Plugin:
Real Homes CRM
Plugin Slug:
realhomes-crm
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.0.1
Severity Score:
Critical
CVE:
2025-67968
The vulnerability has been patched, so you should update to version 1.0.1.

Schedula – Smart Appointment Booking

Plugin:
Schedula – Smart Appointment Booking
Plugin Slug:
schedula-smart-appointment-booking
Vulnerability:
Broken Access Control
Patched in Version:
1.1
Severity Score:
Medium
CVE:
2025-67970
The vulnerability has been patched, so you should update to version 1.1.

WorkScout-Core

Plugin:
WorkScout-Core
Plugin Slug:
workscout-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.07
Severity Score:
High
CVE:
2025-67960
The vulnerability has been patched, so you should update to version 1.7.07.

YouTube Feed Pro

Plugin:
YouTube Feed Pro
Plugin Slug:
youtube-feed-pro
Vulnerability:
Arbitrary File Download
Patched in Version:
2.6.1
Severity Score:
High
CVE:
2025-12002
The vulnerability has been patched, so you should update to version 2.6.1.

WordPress Themes — 13 Patched / 5 Unpatched

EcoBlue

Theme:
EcoBlue
Theme Slug:
ecoblue
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22338
The vulnerability has not been patched. You should switch themes.

Enfold

Theme:
Enfold
Theme Slug:
enfold
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-68900
The vulnerability has not been patched. You should switch themes.

Listihub

Theme:
Listihub
Theme Slug:
listihub
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69190
The vulnerability has not been patched. You should switch themes.

PeakShops

Theme:
PeakShops
Theme Slug:
peakshops
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-69294
The vulnerability has not been patched. You should switch themes.

Prowess

Theme:
Prowess
Theme Slug:
prowess
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-24531
The vulnerability has not been patched. You should switch themes.

AdForest

Theme:
AdForest
Theme Slug:
adforest
Vulnerability:
Local File Inclusion
Patched in Version:
6.0.12
Severity Score:
High
CVE:
2025-67946
The vulnerability has been patched, so you should update to version 6.0.12.

CarSpot

Theme:
CarSpot
Theme Slug:
carspot
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.6
Severity Score:
High
CVE:
2025-69317
The vulnerability has been patched, so you should update to version 2.4.6.

Craft

Theme:
Craft
Theme Slug:
craftcoffee
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.7
Severity Score:
High
CVE:
2025-68538
The vulnerability has been patched, so you should update to version 2.3.7.

DotLife

Theme:
DotLife
Theme Slug:
dotlife
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.9.5
Severity Score:
High
CVE:
2025-68520
The vulnerability has been patched, so you should update to version 4.9.5.

Grand Magazine

Theme:
Grand Magazine
Theme Slug:
grandmagazine
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.5.8
Severity Score:
High
CVE:
2025-69320
The vulnerability has been patched, so you should update to version 3.5.8.

Grand Spa

Theme:
Grand Spa
Theme Slug:
grandspa
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.5.6
Severity Score:
High
CVE:
2025-69321
The vulnerability has been patched, so you should update to version 3.5.6.

Grand Tour

Theme:
Grand Tour
Theme Slug:
grandtour
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.6.2
Severity Score:
High
CVE:
2025-67952
The vulnerability has been patched, so you should update to version 5.6.2.

Hostiko

Theme:
Hostiko
Theme Slug:
hostiko
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
94.3.6
Severity Score:
High
CVE:
2025-67949
The vulnerability has been patched, so you should update to version 94.3.6.

Hoteller

Theme:
Hoteller
Theme Slug:
hoteller
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.8.9
Severity Score:
High
CVE:
2025-68518
The vulnerability has been patched, so you should update to version 6.8.9.

PeakShops

Theme:
PeakShops
Theme Slug:
peakshops
Vulnerability:
Local File Inclusion
Patched in Version:
1.5.9
Severity Score:
High
CVE:
2025-69322
The vulnerability has been patched, so you should update to version 1.5.9.

Traveler

Theme:
Traveler
Theme Slug:
traveler
Vulnerability:
SQL Injection
Patched in Version:
3.2.8
Severity Score:
High
CVE:
2026-24367
The vulnerability has been patched, so you should update to version 3.2.8.

Werkstatt

Theme:
Werkstatt
Theme Slug:
werkstatt
Vulnerability:
Local File Inclusion
Patched in Version:
4.8.3
Severity Score:
High
CVE:
2025-69314
The vulnerability has been patched, so you should update to version 4.8.3.

WorkScout

Theme:
WorkScout
Theme Slug:
workscout
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.1.08
Severity Score:
High
CVE:
2025-67959
The vulnerability has been patched, so you should update to version 4.1.08.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles