| 2026-10-01 |
WPSEC-2026-0025 |
bbPress | bbPress <= 2.6.18 - Unauthenticated Sensitive Information Exposure via oEmbed Endpoint and Canonical Redirect |
Medium 5.3 |
2.6.19 |
| 2026-10-01 |
WPSEC-2026-0024 |
bbPress | bbPress <= 2.6.18 - Authenticated (Contributor+) Sensitive Information Exposure via Single Topic and Single Reply Shortcodes |
Medium 4.3 |
2.6.19 |
| 2026-10-01 |
WPSEC-2026-0023 |
bbPress | bbPress <= 2.6.18 - Unauthenticated Sensitive Information Exposure via Password-Protected Forum and Topic Bypass |
Medium 5.3 |
2.6.19 |
| 2026-10-01 |
WPSEC-2026-0022 |
hCaptcha for WP | hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via Passster REST Unlock Endpoint |
Low 3.7 |
5.4.0 |
| 2026-10-01 |
WPSEC-2026-0021 |
hCaptcha for WP | hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via Expired or Evicted Auto-Verification Registration |
Low 3.7 |
5.4.0 |
| 2026-10-01 |
WPSEC-2026-0020 |
hCaptcha for WP | hCaptcha for WP <= 5.3.0 - Unauthenticated Denial of Service via Unbounded Failed Login Data |
Medium 5.3 |
5.4.0 |
| 2026-10-01 |
WPSEC-2026-0019 |
hCaptcha for WP | hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via LearnPress Checkout Account Creation |
Low 3.7 |
5.4.0 |
| 2026-10-01 |
WPSEC-2026-0018 |
WP Statistics – Simple, privacy-friendly Google Analytics alternative | WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting via Report Filter Dropdown URLs |
Medium 6.1 |
14.16.15 |
| 2026-10-01 |
WPSEC-2026-0017 |
Kadence Blocks | Kadence Blocks <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload in Advanced Form |
Medium 6.1 |
3.7.12 |
| 2026-10-01 |
WPSEC-2026-0016 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated reCAPTCHA v3 Bypass |
Medium 5.3 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0015 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated Sensitive Information Exposure via REST API |
Medium 5.3 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0014 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated HTML Injection via Form Submission Notification Emails |
Medium 5.3 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0013 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Settings |
Medium 6.4 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0012 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Information Exposure via 'metform' Shortcode |
Medium 4.3 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0011 |
Smash Balloon Social Post Feed | Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Post Content in Feed Builder Preview |
High 7.2 |
4.14.0 |
| 2026-10-01 |
WPSEC-2026-0010 |
Ultimate Member | Ultimate Member <= 2.13.1 - Unauthenticated Sensitive Information Exposure via Private Profile Fields |
Medium 5.3 |
2.14.0 |
| 2026-10-01 |
WPSEC-2026-0009 |
Ultimate Member | Ultimate Member <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover |
High 7.5 |
2.14.0 |
| 2026-10-01 |
WPSEC-2026-0008 |
Ultimate Member | Ultimate Member <= 2.13.1 - Authenticated (Administrator+) SQL Injection via Directory Search-Field Identifiers |
Medium 4.9 |
2.14.0 |
| 2026-10-01 |
WPSEC-2026-0007 |
Fluent Forms | Fluent Forms <= 6.2.14 - Unauthenticated Payment Bypass via Zero or Invalid Payment Values |
Medium 5.3 |
6.2.15 |
| 2026-10-01 |
WPSEC-2026-0006 |
Fluent Forms | Fluent Forms <= 6.2.14 - Unauthenticated Reflected Cross-Site Scripting via 'get' Smartcode |
Medium 6.1 |
6.2.15 |
| 2026-10-01 |
WPSEC-2026-0005 |
Fluent Forms | Fluent Forms <= 6.2.14 - Authenticated (Fluent Forms Manager+) Stored Cross-Site Scripting via Payment Item 'price_label' and Payment Summary 'cart_empty_text' Settings |
Medium 4.8 |
6.2.15 |
| 2026-10-01 |
WPSEC-2026-0004 |
Fluent Forms | Fluent Forms <= 6.2.14 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via User Search |
Low 2.7 |
6.2.15 |
| 2026-10-01 |
WPSEC-2026-0003 |
TranslatePress | TranslatePress <= 3.3.6 - Unauthenticated Stored Cross-Site Scripting via trp-gettext Markers in URL Attributes |
High 7.2 |
3.3.7 |
| 2026-10-01 |
WPSEC-2026-0002 |
Wordfence Security – Firewall & Malware Scan | Wordfence Security – Firewall & Malware Scan <= 9.0.1 - Unauthenticated Author Information Disclosure via REST API Username Enumeration Protection Bypass |
Medium 5.3 |
9.0.2 |
| 2026-10-01 |
WPSEC-2026-0001 |
Essential Addons for Elementor – Popular Elementor Templates & Widgets | Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Woo Product Grid Pagination |
Medium 6.4 |
6.8.5 |
