| 2026-10-01 |
WPSEC-2026-0109 |
Mihdan: No External Links | Mihdan: No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Redirect Logs |
Medium 5.4 |
5.3.0 |
| 2026-10-01 |
WPSEC-2026-0108 |
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.20 - Unauthenticated Sensitive Information Exposure via Product REST API Endpoints |
Medium 5.3 |
3.0.21 |
| 2026-10-01 |
WPSEC-2026-0107 |
Export All Posts, Products, Orders, Refunds & Users | Export All Posts, Products, Orders, Refunds & Users <= 3.0 - Unauthenticated Sensitive Information Exposure via Debug Log File |
Medium 5.3 |
3.1 |
| 2026-10-01 |
WPSEC-2026-0106 |
WP Ultimate CSV Importer | WP Ultimate CSV Importer <= 9.1 - Unauthenticated Sensitive Information Exposure via Import Files and Logs |
Low 3.7 |
9.2 |
| 2026-10-01 |
WPSEC-2026-0105 |
WP Ultimate CSV Importer | WP Ultimate CSV Importer <= 9.1 - Unauthenticated Sensitive Information Exposure via Single Post CSV Export |
Medium 5.3 |
9.2 |
| 2026-10-01 |
WPSEC-2026-0104 |
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Contact Field Smartcodes in Fluent Forms |
Medium 5.4 |
3.2.5 |
| 2026-10-01 |
WPSEC-2026-0103 |
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.0 - Authenticated (Custom Contact-Read Access) Sensitive Information Exposure via Contact Email History |
Medium 4.3 |
3.2.5 |
| 2026-10-01 |
WPSEC-2026-0102 |
Forms | Forms <= 3.0.1 - Reflected Cross-Site Scripting via Form Field Parameters |
Medium 6.1 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0101 |
Forms | Forms <= 3.0.1 - Authenticated (Contributor+) Missing Authorization to Forms and Submissions Access |
Medium 5.4 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0100 |
Forms | Forms <= 3.0.1 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values |
High 7.2 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0099 |
Forms | Forms <= 3.0.1 - Unauthenticated Information Exposure of Submitter IP Addresses via REST API |
Medium 5.3 |
3.0.2 |
| 2026-10-01 |
WPSEC-2026-0098 |
SureDash | SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Name Fields |
Medium 6.4 |
1.12.1 |
| 2026-10-01 |
WPSEC-2026-0097 |
Five Star Restaurant Menu | Five Star Restaurant Menu <= 2.5.4 - Unauthenticated Price Manipulation via Cart Item Data |
Medium 5.3 |
2.6.0 |
| 2026-10-01 |
WPSEC-2026-0096 |
Five Star Restaurant Menu | Five Star Restaurant Menu <= 2.5.4 - Unauthenticated Payment Bypass via Order Submission and Payment Handlers |
Medium 5.3 |
2.6.0 |
| 2026-10-01 |
WPSEC-2026-0095 |
Five Star Restaurant Menu | Five Star Restaurant Menu <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_prostyle' Shortcode Attribute |
Medium 6.4 |
2.6.0 |
| 2026-10-01 |
WPSEC-2026-0094 |
Five Star Restaurant Menu | Five Star Restaurant Menu <= 2.5.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Overwrite via Menu Item Import |
Medium 5.4 |
2.6.0 |
| 2026-10-01 |
WPSEC-2026-0093 |
Product Feed PRO for WooCommerce | Product Feed PRO for WooCommerce <= 13.5.7 - Missing Authorization to Authenticated (Subscriber+) Shipping Zone Disclosure |
Medium 4.3 |
13.5.8 |
| 2026-10-01 |
WPSEC-2026-0092 |
Product Feed PRO for WooCommerce | Product Feed PRO for WooCommerce <= 13.5.7 - Authenticated (Shop Manager+) PHP Object Injection via Product Attribute Meta |
High 7.2 |
13.5.8 |
| 2026-10-01 |
WPSEC-2026-0091 |
Captivate Sync | Captivate Sync <= 3.3.2 - Authenticated (Editor+) SQL Injection via Episode Duplication |
Medium 4.9 |
3.3.3 |
| 2026-10-01 |
WPSEC-2026-0090 |
Five Star Business Profile and Schema | Five Star Business Profile and Schema <= 2.3.21 - Authenticated (Author+) Sensitive Information Exposure via Schema Rule Field Defaults |
Medium 6.5 |
2.4.0 |
| 2026-10-01 |
WPSEC-2026-0089 |
Pie Register | Pie Register <= 3.8.4.13 - Missing Authorization to Unauthenticated User Email Disclosure via 'invitaion_code' Parameter |
Medium 5.3 |
3.8.4.14 |
| 2026-10-01 |
WPSEC-2026-0088 |
BA Book Everything | BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via Service Quantity |
High 7.2 |
1.8.29 |
| 2026-10-01 |
WPSEC-2026-0087 |
LA-Studio Element Kit for Elementor | LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Subscriber+) Missing Authorization to Screenshot Creation and Deletion |
Medium 4.3 |
1.6.3 |
| 2026-10-01 |
WPSEC-2026-0086 |
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Authenticated (Author+) Insecure Direct Object Reference to Arbitrary Attachment File Rename |
Medium 4.3 |
3.2.2 |
| 2026-10-01 |
WPSEC-2026-0085 |
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Missing Authorization to Authenticated (Contributor+) Folder Assignment Modification of Arbitrary Posts |
Medium 4.3 |
3.2.2 |
| 2026-10-01 |
WPSEC-2026-0084 |
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Authenticated (Author+) Arbitrary File Upload via Media Replace |
High 8.8 |
3.2.2 |
| 2026-10-01 |
WPSEC-2026-0083 |
WP Document Revisions | WP Document Revisions <= 5.4.5 - Authenticated (Contributor+) Sensitive Information Exposure via Document List Shortcode, Blocks and get_documents() |
Medium 4.3 |
5.4.6 |
| 2026-10-01 |
WPSEC-2026-0082 |
WP Document Revisions | WP Document Revisions <= 5.4.5 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Attachment Rename and Deletion via Validate Structure Fix Endpoint |
Medium 5.4 |
5.4.6 |
| 2026-10-01 |
WPSEC-2026-0081 |
WP Document Revisions | WP Document Revisions <= 5.4.5 - Authenticated (Contributor+) Missing Authorization to Revision History Disclosure via document_revisions Shortcode and Block |
Medium 4.3 |
5.4.6 |
| 2026-10-01 |
WPSEC-2026-0080 |
WP Document Revisions | WP Document Revisions <= 5.4.5 - Unauthenticated Missing Authorization via Case-Altered Document REST Routes |
Low 3.7 |
5.4.6 |
| 2026-10-01 |
WPSEC-2026-0079 |
WP Document Revisions | WP Document Revisions <= 5.4.5 - Authenticated (Subscriber+) Missing Authorization to Password-Protected Document and Revision Access via AI Summary and Diff REST Endpoints |
Medium 4.3 |
5.4.6 |
| 2026-10-01 |
WPSEC-2026-0078 |
WP Document Revisions | WP Document Revisions <= 5.5.0 - Authenticated (Contributor+) Missing Authorization to Revision History Disclosure via document_revisions Shortcode and Block |
Medium 4.3 |
5.5.1 |
| 2026-10-01 |
WPSEC-2026-0077 |
WP Document Revisions | WP Document Revisions <= 5.5.0 - Unauthenticated Authorization Bypass via REST Route Case Manipulation |
Low 3.7 |
5.5.1 |
| 2026-10-01 |
WPSEC-2026-0076 |
WP Document Revisions | WP Document Revisions <= 5.5.0 - Authenticated (Subscriber+) Missing Authorization to Restricted Revision Content via AI Summary and Diff REST Endpoints |
Medium 4.3 |
5.5.1 |
| 2026-10-01 |
WPSEC-2026-0075 |
WP Document Revisions | WP Document Revisions <= 5.5.0 - Authenticated (Contributor+) Sensitive Information Exposure via Document List Shortcode, Blocks and get_documents() |
Medium 4.3 |
5.5.1 |
| 2026-10-01 |
WPSEC-2026-0074 |
WP Document Revisions | WP Document Revisions <= 5.5.0 - Authenticated (Contributor+) Insecure Direct Object Reference to Media File Rename and Deletion via Validate Structure Endpoint |
Medium 5.4 |
5.5.1 |
| 2026-10-01 |
WPSEC-2026-0073 |
WP Document Revisions | WP Document Revisions <= 5.6.0 - Authenticated (Contributor+) Insecure Direct Object Reference to Media File Rename and Deletion via Validate Structure Endpoint |
Medium 5.4 |
5.6.1 |
| 2026-10-01 |
WPSEC-2026-0072 |
WP Document Revisions | WP Document Revisions <= 5.6.0 - Authenticated (Subscriber+) Missing Authorization to Restricted Revision Content via AI Summary and Diff REST Endpoints |
Medium 4.3 |
5.6.1 |
| 2026-10-01 |
WPSEC-2026-0071 |
WP Document Revisions | WP Document Revisions <= 5.6.0 - Unauthenticated Authorization Bypass via REST Route Case Manipulation |
Low 3.7 |
5.6.1 |
| 2026-10-01 |
WPSEC-2026-0070 |
WP Document Revisions | WP Document Revisions <= 5.6.0 - Authenticated (Contributor+) Missing Authorization to Revision History Disclosure via document_revisions Shortcode and Block |
Medium 4.3 |
5.6.1 |
| 2026-10-01 |
WPSEC-2026-0069 |
WP Document Revisions | WP Document Revisions <= 5.6.0 - Authenticated (Contributor+) Sensitive Information Exposure via Document List Shortcode, Blocks and get_documents() |
Medium 4.3 |
5.6.1 |
| 2026-10-01 |
WPSEC-2026-0068 |
WP Document Revisions | WP Document Revisions <= 5.6.1 - Authenticated (Author+) Sensitive Information Exposure via Media Library |
Medium 5.3 |
5.7.0 |
| 2026-10-01 |
WPSEC-2026-0067 |
Sensei LMS | Sensei LMS <= 4.26.3 - Authenticated (Subscriber+) Missing Authorization to Lesson Completion |
Medium 4.3 |
4.26.4 |
| 2026-10-01 |
WPSEC-2026-0066 |
Sensei LMS | Sensei LMS <= 4.26.3 - Unauthenticated Sensitive Information Exposure via Private Messages |
Medium 5.3 |
4.26.4 |
| 2026-10-01 |
WPSEC-2026-0065 |
Sensei LMS | Sensei LMS <= 4.26.3 - Unauthenticated Sensitive Information Exposure via Quiz Answer File Uploads |
Medium 5.3 |
4.26.4 |
| 2026-10-01 |
WPSEC-2026-0064 |
Sensei LMS | Sensei LMS <= 4.26.3 - Authenticated (Teacher+) Missing Authorization to Lesson and Module Course Reassignment |
Medium 4.3 |
4.26.4 |
| 2026-10-01 |
WPSEC-2026-0063 |
Sensei LMS | Sensei LMS <= 4.26.3 - Authenticated (Teacher+) Insecure Direct Object Reference to Arbitrary Post Overwrite via quiz_id |
Medium 5.3 |
4.26.4 |
| 2026-10-01 |
WPSEC-2026-0062 |
Sensei LMS | Sensei LMS <= 4.26.3 - Unauthenticated Sensitive Information Exposure via Restricted Lesson Content |
Medium 5.3 |
4.26.4 |
| 2026-10-01 |
WPSEC-2026-0061 |
My Agile Privacy® | My Agile Privacy® <= 3.3.7 - Missing Authorization to Unauthenticated Policy Metadata Modification |
Low 3.7 |
3.4.0 |
| 2026-10-01 |
WPSEC-2026-0060 |
ProfileGrid | ProfileGrid <= 6.0.0.2 - Authenticated (Subscriber+) SQL Injection via Group IDs |
Medium 4.3 |
6.0.0.3 |
| 2026-10-01 |
WPSEC-2026-0059 |
ProfileGrid | ProfileGrid <= 6.0.0.2 - Cross-Site Request Forgery to Group Joining |
Medium 4.3 |
6.0.0.3 |
| 2026-10-01 |
WPSEC-2026-0058 |
ProfileGrid | ProfileGrid <= 6.0.0.2 - Authenticated (Subscriber+) Missing Authorization to Forced Friendship via Friend Request Acceptance |
Medium 5.4 |
6.0.0.3 |
| 2026-10-01 |
WPSEC-2026-0057 |
ProfileGrid | ProfileGrid <= 6.0.0.2 - Cross-Site Request Forgery to Account Takeover via Profile Edit Form |
High 8.8 |
6.0.0.3 |
| 2026-10-01 |
WPSEC-2026-0056 |
ProfileGrid | ProfileGrid <= 6.0.0.2 - Unauthenticated Sensitive Information Exposure via Blog Post Listing AJAX Actions |
Medium 5.3 |
6.0.0.3 |
| 2026-10-01 |
WPSEC-2026-0055 |
WP User Manager – User Profile Builder & Membership | WP User Manager – User Profile Builder & Membership <= 2.9.20 - Unauthenticated Stripe Payment Bypass to Paid Role Capabilities and Role-Restricted Content |
Medium 4.8 |
2.9.21 |
| 2026-10-01 |
WPSEC-2026-0054 |
PPOM for WooCommerce | PPOM for WooCommerce <= 34.0.9 - Unauthenticated Price Manipulation via 'ppom_option_price' Parameter |
Medium 5.3 |
34.0.10 |
| 2026-10-01 |
WPSEC-2026-0053 |
Kubio AI Page Builder | Kubio AI Page Builder <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Item Link |
Medium 6.4 |
2.9.3 |
| 2026-10-01 |
WPSEC-2026-0052 |
Kubio AI Page Builder | Kubio AI Page Builder <= 2.9.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content |
Medium 6.1 |
2.9.3 |
| 2026-10-01 |
WPSEC-2026-0051 |
Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager | Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager <= 0.0.11 - Unauthenticated Sensitive Information Exposure via Banner Settings |
Medium 5.3 |
0.0.12 |
| 2026-10-01 |
WPSEC-2026-0050 |
Awesome Support | Awesome Support <= 6.4.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via wpas_mark_reply_read AJAX Action |
Medium 5.4 |
6.4.1 |
| 2026-10-01 |
WPSEC-2026-0049 |
UsersWP | UsersWP <= 1.2.74 - Unauthenticated Email Verification Bypass via Login |
Medium 5.3 |
1.2.75 |
| 2026-10-01 |
WPSEC-2026-0048 |
UsersWP | UsersWP <= 1.2.75 - Authenticated (Subscriber+) Limited File Deletion via Avatar/Banner Image Crop |
Medium 5.4 |
1.2.76 |
| 2026-10-01 |
WPSEC-2026-0047 |
WP Ultimate Review | WP Ultimate Review <= 2.4.3 - Unauthenticated Denial of Service via Review Rating |
Medium 5.3 |
2.4.4 |
| 2026-10-01 |
WPSEC-2026-0046 |
WP Ultimate Review | WP Ultimate Review <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Review Criteria Ratings |
Medium 6.4 |
2.4.4 |
| 2026-10-01 |
WPSEC-2026-0045 |
WP Ultimate Review | WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via Review Submission |
High 7.3 |
2.4.4 |
| 2026-10-01 |
WPSEC-2026-0044 |
Loco Translate | Loco Translate <= 2.8.8 - Authenticated (Translator+) Stored Cross-Site Scripting via Project File Prefix |
Medium 5.5 |
2.8.9 |
| 2026-10-01 |
WPSEC-2026-0043 |
Loco Translate | Loco Translate <= 2.8.8 - Authenticated (Translator+) Path Traversal to Limited File Read via Download Endpoint |
Medium 4.9 |
2.8.9 |
| 2026-10-01 |
WPSEC-2026-0042 |
Loco Translate | Loco Translate <= 2.8.8 - Authenticated (Translator+) Arbitrary File and Directory Deletion via Backup Revision Delete |
Medium 6.5 |
2.8.9 |
| 2026-10-01 |
WPSEC-2026-0041 |
Team – Team Members Showcase Plugin | Team – Team Members Showcase Plugin <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tlpteam' Shortcode |
Medium 6.4 |
6.0.3 |
| 2026-10-01 |
WPSEC-2026-0040 |
OMGF | OMGF <= 6.3.11 - Authenticated (Contributor+) Path Traversal via Font Family Name |
Low 3.1 |
6.3.12 |
| 2026-10-01 |
WPSEC-2026-0039 |
OMGF | OMGF <= 6.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Font Download Error Notices |
Medium 4.4 |
6.3.12 |
| 2026-10-01 |
WPSEC-2026-0038 |
OMGF | OMGF <= 6.3.11 - Authenticated (Contributor+) Server-Side Request Forgery via Font Stylesheet Link Processing |
Medium 4.9 |
6.3.12 |
| 2026-10-01 |
WPSEC-2026-0037 |
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.1.3 - Authenticated (Vendor+) Insecure Direct Object Reference to Commission Rate Disclosure via Commission Calculator REST Endpoint |
Medium 4.3 |
5.2.0 |
| 2026-10-01 |
WPSEC-2026-0036 |
Wp Social | Wp Social <= 3.2.1 - Cross-Site Request Forgery to Social Login Provider Settings Update |
Medium 4.3 |
3.2.2 |
| 2026-10-01 |
WPSEC-2026-0035 |
Wp Social | Wp Social <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute |
Medium 6.4 |
3.2.2 |
| 2026-10-01 |
WPSEC-2026-0034 |
Data Tables Generator by Supsystic | Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Table Cell Content and Custom CSS |
Medium 4.4 |
1.15.3 |
| 2026-10-01 |
WPSEC-2026-0033 |
Otter Blocks | Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Missing Authorization to Form Submission Email Disclosure via Dashboard Widget |
Medium 4.3 |
3.2.7 |
| 2026-10-01 |
WPSEC-2026-0032 |
Prime Slider – Addons For Elementor | Prime Slider – Addons For Elementor <= 4.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Query Control Dynamic Select Search |
Medium 4.3 |
4.6.2 |
| 2026-10-01 |
WPSEC-2026-0031 |
Prime Slider – Addons For Elementor | Prime Slider – Addons For Elementor <= 4.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Blog Widget Zinest Skin Featured Posts |
Medium 4.3 |
4.6.2 |
| 2026-10-01 |
WPSEC-2026-0030 |
Unlimited Elements For Elementor | Unlimited Elements For Elementor < 2.0.21 - Unauthenticated SQL Injection via AJAX Search 'ucs' Parameter |
Medium 5.9 |
2.0.21 |
| 2026-10-01 |
WPSEC-2026-0029 |
Unlimited Elements For Elementor | Unlimited Elements For Elementor < 2.0.21 - Authenticated (Contributor+) Information Exposure via Elementor Template and Layout Rendering |
Medium 4.3 |
2.0.21 |
| 2026-10-01 |
WPSEC-2026-0028 |
Unlimited Elements For Elementor | Unlimited Elements For Elementor < 2.0.21 - Authenticated (Contributor+) SQL Injection via Terms 'Direct Children of Selected Terms' Setting |
Medium 6.5 |
2.0.21 |
| 2026-10-01 |
WPSEC-2026-0027 |
Event Tickets and Registration | Event Tickets and Registration <= 5.29.5.1 - Unauthenticated Business Logic Error to Seat Overbooking via Duplicate Reservation IDs |
Medium 5.3 |
5.29.5.2 |
| 2026-10-01 |
WPSEC-2026-0026 |
Event Tickets and Registration | Event Tickets and Registration <= 5.29.5.2 - Authenticated (Contributor+) Missing Authorization to Ticket Creation and Modification via REST API |
Medium 4.3 |
5.30.0 |
| 2026-10-01 |
WPSEC-2026-0025 |
bbPress | bbPress <= 2.6.18 - Unauthenticated Sensitive Information Exposure via oEmbed Endpoint and Canonical Redirect |
Medium 5.3 |
2.6.19 |
| 2026-10-01 |
WPSEC-2026-0024 |
bbPress | bbPress <= 2.6.18 - Authenticated (Contributor+) Sensitive Information Exposure via Single Topic and Single Reply Shortcodes |
Medium 4.3 |
2.6.19 |
| 2026-10-01 |
WPSEC-2026-0023 |
bbPress | bbPress <= 2.6.18 - Unauthenticated Sensitive Information Exposure via Password-Protected Forum and Topic Bypass |
Medium 5.3 |
2.6.19 |
| 2026-10-01 |
WPSEC-2026-0022 |
hCaptcha for WP | hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via Passster REST Unlock Endpoint |
Low 3.7 |
5.4.0 |
| 2026-10-01 |
WPSEC-2026-0021 |
hCaptcha for WP | hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via Expired or Evicted Auto-Verification Registration |
Low 3.7 |
5.4.0 |
| 2026-10-01 |
WPSEC-2026-0020 |
hCaptcha for WP | hCaptcha for WP <= 5.3.0 - Unauthenticated Denial of Service via Unbounded Failed Login Data |
Medium 5.3 |
5.4.0 |
| 2026-10-01 |
WPSEC-2026-0019 |
hCaptcha for WP | hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via LearnPress Checkout Account Creation |
Low 3.7 |
5.4.0 |
| 2026-10-01 |
WPSEC-2026-0018 |
WP Statistics – Simple, privacy-friendly Google Analytics alternative | WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting via Report Filter Dropdown URLs |
Medium 6.1 |
14.16.15 |
| 2026-10-01 |
WPSEC-2026-0017 |
Kadence Blocks | Kadence Blocks <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload in Advanced Form |
Medium 6.1 |
3.7.12 |
| 2026-10-01 |
WPSEC-2026-0016 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated reCAPTCHA v3 Bypass |
Medium 5.3 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0015 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated Sensitive Information Exposure via REST API |
Medium 5.3 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0014 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated HTML Injection via Form Submission Notification Emails |
Medium 5.3 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0013 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Settings |
Medium 6.4 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0012 |
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Information Exposure via 'metform' Shortcode |
Medium 4.3 |
4.3.1 |
| 2026-10-01 |
WPSEC-2026-0011 |
Smash Balloon Social Post Feed | Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Post Content in Feed Builder Preview |
High 7.2 |
4.14.0 |
| 2026-10-01 |
WPSEC-2026-0010 |
Ultimate Member | Ultimate Member <= 2.13.1 - Unauthenticated Sensitive Information Exposure via Private Profile Fields |
Medium 5.3 |
2.14.0 |
