| 2026-10-01 |
WPSEC-2026-0209 |
Redirection | Redirection <= 5.10.0 - Unauthenticated Open Redirect via Regex Redirect Targets |
Medium 4.7 |
5.10.1 |
| 2026-10-01 |
WPSEC-2026-0208 |
Redirection | Redirection <= 5.10.0 - Unauthenticated CSV Injection via 404 and Redirect Log Exports |
Medium 4.7 |
5.10.1 |
| 2026-10-01 |
WPSEC-2026-0207 |
Top 10 | Top 10 <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Popular Posts Block thumb_size Attribute |
Medium 6.4 |
4.5.1 |
| 2026-10-01 |
WPSEC-2026-0206 |
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.83 - Authenticated (Contributor+) Missing Authorization to Database Table Access via wpdadiehard Shortcode |
Medium 5.4 |
5.5.84 |
| 2026-10-01 |
WPSEC-2026-0205 |
Getwid | Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Counter Block Separator and Decimal Settings |
Medium 6.4 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0204 |
Getwid | Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Hotspot Block |
Medium 6.4 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0203 |
Getwid | Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Block Marker Description |
Medium 6.4 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0202 |
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter |
Medium 6.1 |
3.6.2 |
| 2026-10-01 |
WPSEC-2026-0201 |
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Unauthenticated Sensitive Information Exposure via Smart Tags in Submitted Form Field Values |
Low 3.7 |
3.6.2 |
| 2026-10-01 |
WPSEC-2026-0200 |
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Authenticated (Delegated+) Insecure Direct Object Reference via MCP Form and Entry Abilities |
Medium 6.3 |
3.6.2 |
| 2026-10-01 |
WPSEC-2026-0199 |
LearnPress | LearnPress <= 4.4.7 - Reflected Cross-Site Scripting via 'orderby' Parameter |
Medium 6.1 |
4.4.8 |
| 2026-10-01 |
WPSEC-2026-0198 |
All-In-One Security (AIOS) – Security and Firewall | All-In-One Security (AIOS) – Security and Firewall <= 5.4.9 - Unauthenticated Login Lockout Bypass via Unlock Request |
Low 3.7 |
5.4.10 |
| 2026-10-01 |
WPSEC-2026-0197 |
Events Manager | Events Manager <= 7.4.3 - Unauthenticated User Interface Misrepresentation via 'client_name' Parameter on OAuth Consent Screen |
Medium 4.3 |
7.4.4 |
| 2026-10-01 |
WPSEC-2026-0196 |
Events Manager | Events Manager <= 7.4.3 - Unauthenticated Insecure Direct Object Reference to Booking Timeslot Capacity Bypass |
Medium 5.3 |
7.4.4 |
| 2026-10-01 |
WPSEC-2026-0195 |
Events Manager | Events Manager <= 7.4.3 - Unauthenticated Sensitive Information Exposure via Password-Protected Events in REST API and iCal Feed |
Medium 5.3 |
7.4.4 |
| 2026-10-01 |
WPSEC-2026-0194 |
Events Manager | Events Manager <= 7.4.3 - Authenticated (Author+) Insecure Direct Object Reference via REST API Media Endpoint |
Medium 4.3 |
7.4.4 |
| 2026-10-01 |
WPSEC-2026-0193 |
Kadence Blocks | Kadence Blocks <= 3.7.10 - Unauthenticated HTML Injection in Form Notification Emails via Uploaded File Name |
Medium 4.3 |
3.7.11 |
| 2026-10-01 |
WPSEC-2026-0192 |
Plugin for Google Reviews | Plugin for Google Reviews <= 7.1 - Unauthenticated Sensitive Information Exposure via Business Photo URL |
Low 3.7 |
7.1.1 |
| 2026-10-01 |
WPSEC-2026-0191 |
Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) | Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) <= 3.7.0 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via AJAX REST Fallback |
Medium 4.3 |
3.7.1 |
| 2026-10-01 |
WPSEC-2026-0190 |
Essential Blocks | Essential Blocks <= 6.4.3 - Unauthenticated Denial of Service via Post Grid Pagination |
Medium 5.3 |
6.4.4 |
| 2026-10-01 |
WPSEC-2026-0189 |
Essential Blocks | Essential Blocks <= 6.4.3 - Authenticated (Contributor+) Sensitive Information Exposure via Post Grid Block 'featuredPostId' Attribute |
Medium 4.3 |
6.4.4 |
| 2026-10-01 |
WPSEC-2026-0188 |
Spam protection, Honeypot, Anti-Spam by CleanTalk | Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.87 - Unauthenticated Stored Cross-Site Scripting via Contact Encoder Shortcode Placeholders |
Medium 5.4 |
6.88 |
| 2026-10-01 |
WPSEC-2026-0187 |
Fluent Forms | Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Global Settings Endpoint |
Medium 4.9 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0186 |
Fluent Forms | Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Stored Cross-Site Scripting via Form Field Attributes and Payment Option Labels |
Medium 6.4 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0185 |
Fluent Forms | Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Cross-Form Entry Modification, Deletion and Disclosure via 'entry_id' Parameter |
Medium 4.7 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0184 |
Fluent Forms | Fluent Forms <= 6.2.13 - Unauthenticated Payment Amount Manipulation via Omitted Payment Inputs and Negative Custom Subscription Amounts |
Medium 5.3 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0183 |
Fluent Forms | Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Embedded Post Author Smartcodes |
Medium 4.9 |
6.2.14 |
| 2026-10-01 |
WPSEC-2026-0182 |
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.6 - Authenticated (Author+) Limited Server-Side Request Forgery via Image Sideload Endpoints |
Low 3.5 |
4.7.7 |
| 2026-10-01 |
WPSEC-2026-0181 |
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.6 - Authenticated (Contributor+) Missing Authorization to Template Data Request and CartFlows, Cart Abandonment Recovery and LatePoint Data Import |
Medium 5.4 |
4.7.7 |
| 2026-10-01 |
WPSEC-2026-0180 |
Cookie Notice & Compliance for GDPR / CCPA | Cookie Notice & Compliance for GDPR / CCPA <= 3.1.9 - Authenticated (Administrator+) Missing Authorization to Network-Wide Settings Modification |
Medium 5.8 |
3.1.10 |
| 2026-10-01 |
WPSEC-2026-0179 |
Cookie Notice & Compliance for GDPR / CCPA | Cookie Notice & Compliance for GDPR / CCPA <= 3.1.9 - Authenticated (Administrator+) Privilege Escalation via 'cn_network' Parameter |
Medium 6.8 |
3.1.10 |
| 2026-10-01 |
WPSEC-2026-0178 |
WooCommerce | WooCommerce <= 11.1.0 - Authenticated (Shop Manager+) Privilege Escalation via Mobile App QR Login Token Generation |
Low 3.8 |
11.1.1 |
| 2026-10-01 |
WPSEC-2026-0177 |
WooCommerce | WooCommerce <= 11.1.0 - REST API Key Scope Bypass via Non-REST Requests |
Medium 4.2 |
11.1.1 |
| 2026-10-01 |
WPSEC-2026-0176 |
GPTranslate | GPTranslate <= 2.34.11 - Unauthenticated Stored Cross-Site Scripting via Translated Image, Iframe and Video Attributes |
Medium 5.4 |
2.34.12 |
| 2026-10-01 |
WPSEC-2026-0175 |
PPWP – Password Protect Pages | PPWP – Password Protect Pages <= 1.9.25 - Unauthenticated Sensitive Information Exposure via Predictable Auto-Generated Page Password |
Low 3.7 |
1.9.26 |
| 2026-10-01 |
WPSEC-2026-0174 |
WPFunnels | WPFunnels <= 3.13.1 - Reflected Cross-Site Scripting via 'per_page' Parameter |
Medium 6.1 |
3.13.2 |
| 2026-10-01 |
WPSEC-2026-0173 |
WPFunnels | WPFunnels <= 3.13.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Bump Settings |
Medium 6.4 |
3.13.2 |
| 2026-10-01 |
WPSEC-2026-0172 |
Charitable | Charitable <= 1.8.12.3 - Unauthenticated Reflected Cross-Site Scripting via Donate Button Shortcode |
Medium 6.1 |
1.8.13 |
| 2026-10-01 |
WPSEC-2026-0171 |
Charitable | Charitable <= 1.8.12.3 - Authenticated (Subscriber+) Limited File Upload via 'charitable_plupload_image_upload' AJAX Action |
Medium 4.3 |
1.8.13 |
| 2026-10-01 |
WPSEC-2026-0170 |
Charitable | Charitable <= 1.8.12.3 - Authenticated (Contributor+) Sensitive Information Exposure via 'charitable_campaign_preview' Parameter |
Medium 4.3 |
1.8.13 |
| 2026-10-01 |
WPSEC-2026-0169 |
WP Visitor Statistics (Real Time Traffic) | WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated Second-Order SQL Injection via fullRef Parameter |
Medium 6.5 |
8.7.1 |
| 2026-10-01 |
WPSEC-2026-0168 |
Visitor Traffic Real Time Statistics | Visitor Traffic Real Time Statistics < 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' and Forwarded-IP HTTP Headers |
High 7.2 |
8.16 |
| 2026-10-01 |
WPSEC-2026-0167 |
Image Photo Gallery Final Tiles Grid | Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Configuration 'script' Field |
Medium 6.4 |
3.6.14 |
| 2026-10-01 |
WPSEC-2026-0166 |
Image Photo Gallery Final Tiles Grid | Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Insecure Direct Object Reference to Gallery, Image and Post Meta Modification |
Medium 4.3 |
3.6.14 |
| 2026-10-01 |
WPSEC-2026-0165 |
Image Photo Gallery Final Tiles Grid | Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
Medium 6.4 |
3.6.14 |
| 2026-10-01 |
WPSEC-2026-0164 |
Jeg Kit for Elementor | Jeg Kit for Elementor <= 3.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-item-indicator' Attribute |
Medium 6.4 |
3.2.20 |
| 2026-10-01 |
WPSEC-2026-0163 |
Jeg Kit for Elementor | Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comments |
High 7.2 |
3.2.20 |
| 2026-10-01 |
WPSEC-2026-0162 |
Salon booking system | Salon booking system <= 10.31.6 - Authenticated (Salon Staff+) Stored Cross-Site Scripting via Customer Notes |
Medium 5.5 |
10.31.7 |
| 2026-10-01 |
WPSEC-2026-0161 |
Ecomail | Ecomail <= 2.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Email Newsletter Subscription Changes via 'ecmid' Parameter |
Medium 4.3 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0160 |
Ecomail | Ecomail <= 2.4.3 - Cross-Site Request Forgery to Bulk Data Synchronization and List Refresh |
Medium 4.3 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0159 |
Ecomail | Ecomail <= 2.4.3 - Authenticated (Contributor+) Missing Authorization to Bulk Data Synchronization and List Refresh |
Medium 4.3 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0158 |
Ecomail | Ecomail <= 2.4.3 - Unauthenticated Missing Authorization to Arbitrary Cart Tracking Events via 'email' Parameter |
Medium 5.3 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0157 |
Ecomail | Ecomail <= 2.4.3 - Missing Authorization to Subscription Status Modification via Webhook REST Endpoint |
Medium 6.5 |
2.5.0 |
| 2026-10-01 |
WPSEC-2026-0156 |
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
Medium 6.4 |
4.2.16 |
| 2026-10-01 |
WPSEC-2026-0155 |
Video Conferencing with Zoom | Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Missing Authorization to Zoom Host and Meeting Disclosure via Block Editor AJAX Actions |
Medium 4.3 |
4.6.11 |
| 2026-10-01 |
WPSEC-2026-0154 |
Video Conferencing with Zoom | Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Missing Authorization to Sensitive Information Exposure via 'get_assign_host_id' AJAX Action |
Medium 4.3 |
4.6.11 |
| 2026-10-01 |
WPSEC-2026-0153 |
Web-Art Login Shield with reCAPTCHA | Web-Art Login Shield with reCAPTCHA <= 1.2.2 - Unauthenticated reCAPTCHA and Login Protect Bypass via 'action' Parameter |
Medium 5.3 |
1.2.3 |
| 2026-10-01 |
WPSEC-2026-0152 |
Web-Art Login Shield with reCAPTCHA | Web-Art Login Shield with reCAPTCHA <= 1.2.2 - Unauthenticated Login Protect Bypass via Race Condition |
Low 3.7 |
1.2.3 |
| 2026-10-01 |
WPSEC-2026-0151 |
Frontend File Manager & Sharing – User Private Files | Frontend File Manager & Sharing – User Private Files <= 2.1.9 - Unauthenticated Sensitive Information Exposure via Attachment Pages |
Medium 5.3 |
2.2.0 |
| 2026-10-01 |
WPSEC-2026-0150 |
Frontend File Manager & Sharing – User Private Files | Frontend File Manager & Sharing – User Private Files <= 2.1.9 - Unauthenticated Sensitive Information Exposure via Direct Access to Private Files |
Medium 5.9 |
2.2.0 |
| 2026-10-01 |
WPSEC-2026-0149 |
Document Engine | Document Engine <= 1.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure via PDF Viewer Block |
Medium 4.3 |
2.0.0 |
| 2026-10-01 |
WPSEC-2026-0148 |
Document Engine | Document Engine <= 1.3 - Authenticated (Author+) Server-Side Request Forgery via Post to PDF Images |
Medium 5.0 |
2.0.0 |
| 2026-10-01 |
WPSEC-2026-0147 |
Document Engine | Document Engine <= 1.3 - Unauthenticated Sensitive Information Exposure via Post to PDF Export |
Medium 5.3 |
2.0.0 |
| 2026-10-01 |
WPSEC-2026-0146 |
CoCart – Headless REST API for WooCommerce | CoCart – Headless REST API for WooCommerce <= 4.9.6 - Cross-Site Request Forgery via REST API Nonce Verification Bypass |
High 8.8 |
4.9.7 |
| 2026-10-01 |
WPSEC-2026-0145 |
EazyDocs | EazyDocs <= 2.14.0 - Login Cross-Site Request Forgery via Google Login Callback |
Medium 4.3 |
2.14.1 |
| 2026-10-01 |
WPSEC-2026-0144 |
EazyDocs | EazyDocs <= 2.14.0 - Unauthenticated Authentication Bypass via Google Login |
High 8.1 |
2.14.1 |
| 2026-10-01 |
WPSEC-2026-0143 |
EazyDocs | EazyDocs <= 2.14.0 - Missing Authorization to Unauthenticated Analytics Table Schema Update |
Medium 5.3 |
2.14.1 |
| 2026-10-01 |
WPSEC-2026-0142 |
Directorist: AI-Powered Business Directory, Listings & Classified Ads | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.9.6 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via Listing Renewal |
Low 3.1 |
8.10 |
| 2026-10-01 |
WPSEC-2026-0141 |
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG and XML File Uploads |
Medium 6.4 |
4.7.8 |
| 2026-10-01 |
WPSEC-2026-0140 |
Coming Soon & Maintenance Mode by Colorlib | Coming Soon & Maintenance Mode by Colorlib <= 1.4.0 - Unauthenticated Sensitive Information Exposure via Comment Form Redirect |
Medium 5.3 |
1.4.1 |
| 2026-10-01 |
WPSEC-2026-0139 |
GPTranslate | GPTranslate <= 2.34.10 - Unauthenticated Stored Cross-Site Scripting via Translation Values |
High 7.2 |
2.34.11 |
| 2026-10-01 |
WPSEC-2026-0138 |
Bus Ticket Booking with Seat Reservation | Bus Ticket Booking with Seat Reservation < 5.9.5 - Missing Authorization to Booking Billing Details Modification via wbtm_standalone_checkout_pay AJAX Action |
Medium 6.5 |
5.9.5 |
| 2026-10-01 |
WPSEC-2026-0137 |
Bus Ticket Booking with Seat Reservation | Bus Ticket Booking with Seat Reservation < 5.9.5 - Unauthenticated Insecure Direct Object Reference to Booking Cancellation and Status Manipulation via Payment Return Handler |
Medium 6.5 |
5.9.5 |
| 2026-10-01 |
WPSEC-2026-0136 |
Scheduling Plugin – Online Booking for WordPress | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Authenticated (Subscriber+) Missing Authorization to Account Connection and Plugin Settings Modification |
Medium 5.4 |
3.5.18 |
| 2026-10-01 |
WPSEC-2026-0135 |
Scheduling Plugin – Online Booking for WordPress | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Missing Authorization to Account Disconnection |
Medium 6.5 |
3.5.18 |
| 2026-10-01 |
WPSEC-2026-0134 |
Scheduling Plugin – Online Booking for WordPress | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
Medium 6.4 |
3.5.18 |
| 2026-10-01 |
WPSEC-2026-0133 |
Scheduling Plugin – Online Booking for WordPress | Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Unauthenticated Authorization Bypass to Admin-Scoped REST API Proxy |
High 8.2 |
3.5.18 |
| 2026-10-01 |
WPSEC-2026-0132 |
Simple Gallery with Filter | Simple Gallery with Filter < 2.4.1 - Cross-Site Request Forgery to Image Caption Modification |
Medium 4.3 |
2.4.1 |
| 2026-10-01 |
WPSEC-2026-0131 |
Video Conferencing with BigBlueButton (BBB) | Video Conferencing with BigBlueButton (BBB) <= 3.2.0 - Unauthenticated Open Redirect via 'current_page' Parameter |
Medium 6.1 |
3.2.15 |
| 2026-10-01 |
WPSEC-2026-0130 |
HT Easy GA4 ( Google Analytics 4 ) | HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Missing Authorization to Unauthenticated Secret Key Update and Cache Deletion |
Medium 6.5 |
1.9.5 |
| 2026-10-01 |
WPSEC-2026-0129 |
HT Easy GA4 ( Google Analytics 4 ) | HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Cross-Site Request Forgery to Google Account Connection and Logout |
Medium 5.4 |
1.9.5 |
| 2026-10-01 |
WPSEC-2026-0128 |
HT Easy GA4 ( Google Analytics 4 ) | HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Unauthenticated Insecure Direct Object Reference to Order Data Exposure via 'order' Parameter |
Medium 5.3 |
1.9.5 |
| 2026-10-01 |
WPSEC-2026-0127 |
UiChemy | UiChemy <= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Import |
Medium 6.4 |
5.2.3 |
| 2026-10-01 |
WPSEC-2026-0126 |
UiChemy | UiChemy <= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Composer Section Code |
Medium 6.4 |
5.2.3 |
| 2026-10-01 |
WPSEC-2026-0125 |
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.6 - Unauthenticated reCAPTCHA Bypass via Inline Payment Forms |
Medium 5.3 |
8.5.7 |
| 2026-10-01 |
WPSEC-2026-0124 |
Better Messages | Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure of Hidden Chat Room Participants via 'getChatRooms' REST Endpoint |
Medium 4.3 |
3.0.12 |
| 2026-10-01 |
WPSEC-2026-0123 |
Better Messages | Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure via Favorites Page |
Medium 4.3 |
3.0.12 |
| 2026-10-01 |
WPSEC-2026-0122 |
Better Messages | Better Messages <= 3.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting via End-to-End Encrypted Messages |
Medium 6.4 |
3.0.12 |
| 2026-10-01 |
WPSEC-2026-0121 |
Five Star Restaurant Reservations | Five Star Restaurant Reservations <= 2.7.24 - Unauthenticated Sensitive Information Exposure via View Bookings Form |
Medium 5.3 |
2.8.0 |
| 2026-10-01 |
WPSEC-2026-0120 |
WP User Avatars | WP User Avatars <= 1.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Assignment via assign_wp_user_avatars_media AJAX Action |
Medium 4.3 |
2.0.0 |
| 2026-10-01 |
WPSEC-2026-0119 |
Advanced Shipment Tracking for WooCommerce | Advanced Shipment Tracking for WooCommerce <= 4.0.3 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure via ast_email_preview AJAX Action |
Medium 4.3 |
4.0.4 |
| 2026-10-01 |
WPSEC-2026-0118 |
WP Ghost (Hide My WP Ghost) | WP Ghost (Hide My WP Ghost) <= 7.0.11 - Unauthenticated Login CAPTCHA Bypass via 'woocommerce-login-nonce' Parameter |
Medium 5.3 |
7.0.12 |
| 2026-10-01 |
WPSEC-2026-0117 |
CMB2 | CMB2 <= 2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Field Display Values |
Medium 6.4 |
2.13.2 |
| 2026-10-01 |
WPSEC-2026-0116 |
DoFollow Case by Case | DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Link Attributes |
High 7.2 |
3.6.1 |
| 2026-10-01 |
WPSEC-2026-0115 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Subscriber+) Missing Authorization to Marketplace-Wide WooCommerce REST API Access |
High 8.8 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0114 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Missing Authorization to Withdrawal Approval and Balance Bypass |
Medium 6.5 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0113 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Missing Authorization to Marketplace Module Activation and Deactivation |
Medium 5.4 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0112 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Customer+) Insecure Direct Object Reference to Refund Request on Arbitrary Orders |
Medium 4.3 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0111 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Subscriber+) Privilege Escalation via Store REST Endpoint Admin-Only Fields |
Medium 6.5 |
5.0.19 |
| 2026-10-01 |
WPSEC-2026-0110 |
MultiVendorX | MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Cross-Store Follower Information Disclosure via FollowStore REST Endpoint |
Medium 4.3 |
5.0.19 |
