Wordfence: Descubre las vulnerabilidades de WordPress de la semana del 28 de septiembre al 4 de octubre de 2026
Este es un resumen del artículo. Si necesitas contexto adicional, aquí tienes el enlace original: https://www.wordfence.com/blog/2026/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-28-2026-to-october-4-2026/
Last week, there were 501 vulnerabilities disclosed in 367 WordPress Plugins and 9 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 201 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-963 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 449 |
| Unpatched | 52 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 1 |
| Medium Severity | 306 |
| High Severity | 174 |
| Critical Severity | 20 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 206 |
| Missing Authorization | 68 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 42 |
| Exposure of Sensitive Information to an Unauthorized Actor | 34 |
| Deserialization of Untrusted Data | 30 |
| Authorization Bypass Through User-Controlled Key | 23 |
| Improper Control of Generation of Code ('Code Injection') | 14 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 13 |
| Improper Privilege Management | 13 |
| Client-Side Enforcement of Server-Side Security | 9 |
| Improper Authentication | 8 |
| Cross-Site Request Forgery (CSRF) | 7 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Server-Side Request Forgery (SSRF) | 4 |
| Uncontrolled Resource Consumption | 4 |
| External Control of File Name or Path | 3 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 3 |
| URL Redirection to Untrusted Site ('Open Redirect') | 3 |
| Improper Input Validation | 2 |
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 1 |
| Guessable CAPTCHA | 1 |
| Improper Authorization | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 |
| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 1 |
| Incorrect Authorization | 1 |
| Insufficiently Protected Credentials | 1 |
| Path Traversal: '/dir/../filename' | 1 |
| Protection Mechanism Failure | 1 |
| Use of Hard-coded Password | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 72 | |
| 19 | |
| 14 | |
| 12 | |
| 12 | |
| 10 | |
| 9 | |
| 9 | |
| 7 | |
| 7 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning | academy |
| Aculect AI Companion | aculect-ai-companion |
| AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | acymailing |
| Ad Inserter – Ad Manager & AdSense Ads | ad-inserter |
| Advanced Ads – Ad Manager & AdSense | advanced-ads |
| Advanced Partial Payment or Deposit for WooCommerce | advanced-partial-payment-or-deposit-for-woocommerce |
| Advanced Post Manager | advanced-post-manager |
| Advanced Woo Labels – Product Labels & Badges for WooCommerce | advanced-woo-labels |
| AFFI – Affiliate Marketing for WooCommerce | affi-affiliate-marketing-for-woo |
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | ai-engine |
| Airano MCP Bridge | airano-mcp-bridge |
| Ajax Search Pro | ajax-search-pro |
| All in One Files Upload for WooCommerce | all-in-one-files-upload-for-woocommerce |
| All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) | all-in-one-seo-pack |
| AllAble Connector | allable-connector |
| Alt Text AI – Automatically generate image alt text for SEO and accessibility | alttext-ai |
| Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | latepoint |
| Appointment Hour Booking – Booking Calendar | appointment-hour-booking |
| Aruba Migration Tool | aruba-wp-migration-tool |
| Audio Player Block – Advanced Block for Embedding Audio Files | audio-player-block |
| Authorizer | authorizer |
| Autoptimize | autoptimize |
| Awesome Support – WordPress HelpDesk & Support Plugin | awesome-support |
| BA Book Everything | ba-book-everything |
| BackupEase – Scheduled Backup, Restore & Site Migration | backupease |
| BackupSheep WordPress Backup Plugin | backupsheep |
| bbp style pack | bbp-style-pack |
| BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) | woo-bulk-editor |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| BlockStrap Page Builder – Bootstrap Blocks | blockstrap-page-builder-blocks |
| Bold Page Builder | bold-page-builder |
| Booking Activities | booking-activities |
| Booking Calendar | booking |
| Books Gallery – Book Showcase, Library & Affiliate Plugin | wp-books-gallery |
| Branda – White Label & Branding, Free Login Page Customizer | branda-white-labeling |
| Broken Link Notifier | broken-link-notifier |
| BuildKit – Product Builder for WooCommerce – Custom PC Builder | woo-product-builder |
| Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) | burst-statistics |
| Bus Ticket Booking with Seat Reservation | bus-ticket-booking-with-seat-reservation |
| Business Directory Plugin – Easy Listing & Member Directories for WordPress | business-directory-plugin |
| Business Essentials for Contact Form 7 | cf7-redirect-thank-you-page |
| ByteCoreStack – MCP Connector for AI Tools | bcs-mcp-manager |
| Cache Enabler | cache-enabler |
| Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More | calculated-fields-form |
| Captivate Sync | captivatesync-trade |
| CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 | contact-form-7-honeypot |
| CF7 Views – Complete Entry Management for Contact Form 7 | cf7-views |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| CMB2 | cmb2 |
| CMP – Coming Soon & Maintenance Plugin by NiteoThemes | cmp-coming-soon-maintenance |
| CoCart – Headless REST API for WooCommerce | cart-rest-api-for-woocommerce |
| Connections Business Directory | connections |
| Content Egg – Affiliate Product Importer & Price Comparison | content-egg |
| ConvertPlus | convertplug |
| Cool FormKit Lite – Advanced Form Builder for Elementor | extensions-for-elementor-form |
| Cost Calculator Builder | cost-calculator-builder |
| Cost of Goods: Product Cost & Profit Calculator for WooCommerce | cost-of-goods-for-woocommerce |
| Course Booking System | course-booking-system |
| Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates | cozy-addons |
| Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators | creatorlms |
| CTX Feed Pro | webappick-product-feed-for-woocommerce-pro |
| CURCY – Multi Currency for WooCommerce | woo-multi-currency |
| Customer Reviews for WooCommerce | customer-reviews-woocommerce |
| Deema Payment Gateway | deema-payment-gateway |
| DesignSetGo | designsetgo |
| DevKit Pro | devkit |
| Disable and Remove Google Fonts | GDPR & DSGVO friendly | disable-remove-google-fonts |
| Divi Membership | divi-membership |
| DoFollow Case by Case | dofollow-case-by-case |
| Download Manager | downloadmanager |
| Download Manager | download-manager |
| Download Monitor | download-monitor |
| Duplicate Post | copy-delete-posts |
| Easy Google Maps | google-maps-easy |
| Easy PayPal & Stripe Buy Now Button | wp-ecommerce-paypal |
| eCommerce Product Catalog | ecommerce-product-catalog |
| ECPay Ecommerce for WooCommerce | ecpay-ecommerce-for-woocommerce |
| EduAdmin Booking | eduadmin-booking |
| elegro Crypto Payment | elegro-payment |
| ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | elementskit-lite |
| EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | embedpress |
| ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | erp |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Tickets and Registration | event-tickets |
| Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | everest-forms |
| EWWW Image Optimizer | ewww-image-optimizer |
| Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export | wp-ultimate-exporter |
| Extendify | extendify |
| Extra Product Options For WooCommerce | Custom Product Addons and Fields | woo-extra-product-options |
| Faktur Pro for WooCommerce | woorechnung |
| Fast Courier – Shipping & Freight | fast-courier-shipping-freight |
| Featured Image from URL (FIFU) | featured-image-from-url |
| File Media Renamer | file-media-renamer |
| File Uploads Addon for WooCommerce | woo-addon-uploads |
| Five Star Business Profile and Schema | business-profile |
| Five Star Restaurant Reservations – WordPress Booking Plugin | restaurant-reservations |
| Five Star Restaurant Reviews | good-reviews-wp |
| Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce | flexible-coupons |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration | fluent-boards |
| FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | fluent-cart |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More | formgent |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Frontend File Manager Plugin | nmedia-user-file-uploader |
| Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms | frontend-post-submission-manager-lite |
| GD Rating System | gd-rating-system |
| Generate PDF using Contact Form 7 | generate-pdf-using-contact-form-7 |
| Geo Mashup | geo-mashup |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers | rafflepress |
| Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program | gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce |
| GravityExport Lite for Gravity Forms | gf-entries-in-excel |
| Greenshift – animation and page builder blocks | greenshift-animation-and-page-builder-blocks |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| GSpeech TTS – WordPress Text To Speech Plugin | gspeech |
| Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | essential-blocks |
| HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates | happy-elementor-addons |
| hCaptcha for WP | hcaptcha-for-forms-and-more |
| Helpdesk Support Ticket System for WooCommerce | support-ticket-system-for-woocommerce |
| Hide Shipping Method For WooCommerce | hide-shipping-method-for-woocommerce |
| Horizontal scrolling announcements | horizontal-scrolling-announcements |
| Hostinger Migrator | migrator-plugin |
| Hostinger Reach – AI-Powered Email Marketing for WordPress | hostinger-reach |
| HT Contact Form – Drag & Drop Form Builder for WordPress | ht-contactform |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT | hyve-lite |
| IATO MCP | iato-mcp |
| Icegram Engage – Popups, Optins, CTAs & Lead Generation | icegram |
| If-So Dynamic Content – Elementor & All Page Builders Personalization | if-so |
| Image Optimizer | image-optimizer |
| InPost PL | inpost-for-woocommerce |
| Iptanus File Upload | wp-file-upload |
| Issues and Series for Newspapers, Magazines, Publishers, Writers | organize-series |
| Ivory Search – WordPress Search Plugin | add-search-to-menu |
| Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | jeg-elementor-kit |
| JetAppointment | jet-appointments-booking |
| JetBlog | jet-blog |
| JetEngine | jet-engine |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| JetReviews | jet-reviews |
| JNews – Pay Writer | jnews-pay-writer |
| JSON API Auth | json-api-auth |
| JW Player for WordPress | jw-player-7-for-wp |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder | king-addons |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Kognetiks Chatbot | chatbot-chatgpt |
| Kubio AI Page Builder | kubio |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Listdom: AI-powered Business Directory with Classifieds Ads Listings | listdom |
| Loco Translate | loco-translate |
| Lookzy LookBook for WooCommerce | woo-lookbook |
| Magic Tooltips For Contact Form 7 | magic-tooltips-for-contact-form-7 |
| Mail logging & Catcher | wp-mail-catcher |
| Mailchimp for WooCommerce | mailchimp-for-woocommerce |
| Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin | majestic-support |
| MakeCommerce for WooCommerce | makecommerce |
| Mang Board | mangboard |
| MaxGalleria | maxgalleria |
| MCP Content Manager Lite | mcp-content-manager-lite |
| Media Library Assistant | media-library-assistant |
| Media Library Organizer – Folders, File Manager & Media Categories | media-library-organizer |
| Memberful – Membership Plugin | memberful-wp |
| MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | metform |
| Mindio Magic MCP | mindio-magic-mcp |
| Minimum and Maximum Quantity for WooCommerce | min-and-max-quantity-for-woocommerce |
| Mooberry Book Manager | mooberry-book-manager |
| Motors – Car Dealership & Classified Listings Plugin | motors-car-dealership-classified-listings |
| MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | multiple-pages-generator-by-porthas |
| MStore API – Create Native Android & iOS Apps On The Cloud | mstore-api |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| Music Player for WooCommerce | music-player-for-woocommerce |
| MW WP Form | mw-wp-form |
| Nelio Content – Editorial Calendar & Social Media Auto-Posting | nelio-content |
| Nested Pages | wp-nested-pages |
| New User Approve | new-user-approve |
| Newsletter – Send awesome emails from WordPress | newsletter |
| Newsletters, Email Marketing, SMS and Popups by Omnisend | omnisend |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| Ninja Forms – File Uploads | ninja-forms-uploads |
| Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | ninja-forms |
| No External Links | mihdan-no-external-links |
| Notification for Telegram | notification-for-telegram |
| Notivo Notification for WooCommerce | woo-notification |
| OAuth Single Sign On – SSO (OAuth Client) | miniorange-login-with-eve-online-google-facebook |
| Ohio Extra | ohio-extra |
| oik | oik |
| OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | host-webfonts-local |
| Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | optimole-wp |
| Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | otter-blocks |
| Page Builder by SiteOrigin | siteorigin-panels |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Parallax Section Block – Add Parallax Scrolling Effects to Sections | parallax-section |
| Pay with Vipps and MobilePay for WooCommerce | woo-vipps |
| Payflex Payment Gateway | payflex-payment-gateway |
| Payments for Hubtel | payments-hubtel |
| Paytm Payment Gateway | paytm-payments |
| PDF for Contact Form 7 + Drag and Drop Template Builder | pdf-for-contact-form-7 |
| PDF Invoices & Packing Slips for WooCommerce | woocommerce-pdf-invoices-packing-slips |
| PDF Smart Viewer for Elementor | pdf-smart-viewer-for-elementor |
| Persistent Login | wp-persistent-login |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| Photo Gallery – Responsive Image Galleries by Supsystic | gallery-by-supsystic |
| Photo Reviews for WooCommerce | woo-photo-reviews |
| Photonic Gallery & Lightbox for Flickr, SmugMug & Others | photonic |
| Pie Register – User Registration, Profiles & Content Restriction | pie-register |
| Pixfort Core | pixfort-core |
| Polylang | polylang |
| Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More | popup-maker-wp |
| Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | post-and-page-builder |
| Post Views Stats Counter | post-views-stats-counter |
| Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | premium-addons-for-elementor |
| Premmerce Permalink Manager for WooCommerce | woo-permalink-manager |
| Premmerce Wishlist for WooCommerce | premmerce-woocommerce-wishlist |
| Prevent Files / Folders Access | prevent-file-access |
| Pricing Table WordPress Plugin – Easy Pricing Tables | easy-pricing-tables |
| Prime Mover – Backup and Migration | prime-mover |
| Pro Like Button | prolike-button |
| Product Designer App | product-designer-app |
| Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce | woo-product-feed-pro |
| ProfileGrid – User Profiles, Groups and Communities | profilegrid-user-profiles-groups-and-communities |
| Progress Planner | progress-planner |
| Progressify – All-in-One Progressive Web App (PWA) | progressify |
| Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | wedevs-project-manager |
| Qi Addons For Elementor | qi-addons-for-elementor |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Quiz Cat – WordPress Quiz Plugin | quiz-cat |
| Razorpay for WooCommerce | woo-razorpay |
| Razorpay Payment Links for WooCommerce | rzp-woocommerce |
| ReactPress – Create React App for WordPress | reactpress |
| Real Cookie Banner: GDPR & ePrivacy Cookie Consent | real-cookie-banner |
| Real Estate Manager – Property Listing and Agent Management | real-estate-manager |
| Redux Framework | redux-framework |
| Relevanssi Premium | relevanssi-premium |
| Relevanssi – A Better Search | relevanssi |
| RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress | computer-repair-shop |
| Request a Quote – Quote Forms for Any WordPress Site | request-a-quote |
| Responsive Slider Gallery – Responsive Image Photo Slider | responsive-slider-gallery |
| Responsive Starter Templates – Elementor Templates & Starter Sites | responsive-add-ons |
| REST API Log | wp-rest-api-log |
| Rich Showcase for Google Reviews | widget-google-reviews |
| Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF | robin-image-optimizer |
| Safe Redirect Manager | safe-redirect-manager |
| Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | salon-booking-system |
| SaveTo Wishlist Lite – WooCommerce Wishlist | saveto-wishlist-lite-for-woocommerce |
| Schema & Structured Data for WP & AMP | schema-and-structured-data-for-wp |
| SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO | review-schema |
| Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more | scratch-win-giveaways-for-website-facebook |
| Search in Place | search-in-place |
| SEOPress – AI SEO Plugin & On-site SEO | wp-seopress |
| Sermon'e | sermone |
| ShopBuilder – WooCommerce Builder For Elementor | shopbuilder |
| Simple Event Planner | simple-event-planner |
| Simple Membership | simple-membership |
| Simple Payment | simple-payment |
| Simple Shopping Cart | wordpress-simple-paypal-shopping-cart |
| Simply Schedule Appointments | simply-schedule-appointments |
| Site Reviews | site-reviews |
| SiteOrigin Widgets Bundle | so-widgets-bundle |
| SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP | siteskite |
| Slider Pro | slider-pro-wp |
| Smart Forms – when you need more than just a contact form | smart-forms |
| Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) | smart-manager-for-wp-e-commerce |
| Smart One Click Setup – Complete Demo Import & Export | smart-one-click-setup |
| Smart Popup by Supsystic | popup-by-supsystic |
| Smart Slider 3 | smart-slider-3 |
| SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more | wc-ukr-shipping |
| Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | custom-facebook-feed |
| Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more | social-boost |
| Social Media Share Buttons & Social Sharing Icons | ultimate-social-media-icons |
| Social Sharing Plugin – Sassy Social Share | sassy-social-share |
| Solace Extra | solace-extra |
| StifLi Backup Tools | stifli-backup-tools |
| Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | wp-full-stripe-free |
| Strong Testimonials | strong-testimonials |
| SUMO Affiliates Pro | affs |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| Super Forms – Drag & Drop Form Builder | super-forms |
| SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | supportcandy |
| Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder | supreme-modules-for-divi |
| Tabs Responsive – With WooCommerce Product Tabs Extension | tabs-responsive |
| tagDiv Opt-In Builder | td-subscription |
| Taskbuilder – Project Management & Task Management Tool With Kanban Board | taskbuilder |
| The Events Calendar | the-events-calendar |
| ThemeREX Addons | trx_addons |
| Themify Builder | themify-builder |
| TillKit | tillkit |
| Timetics – Appointment Booking Calendar & Scheduling | timetics |
| Total Donations | totaldonations |
| TranslatePress – Translate Multilingual sites with AI Translation | translatepress-multilingual |
| Transliterator – Multilingual and Multi-script Text Conversion | serbian-transliteration |
| Travelly – Tour & Travel Booking Manager for WooCommerce | tour-booking-manager |
| Trusted Shops Easy Integration for WooCommerce | trusted-shops-easy-integration-for-woocommerce |
| Twenty20 Image Before-After | twenty20 |
| Two Factor | two-factor |
| Ultimate Maps by Supsystic | ultimate-maps-by-supsystic |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform | ultimate-multisite |
| Ultra Addons Lite for Elementor | ut-elementor-addons-lite |
| Unlimited Elements for Elementor | unlimited-elements-for-elementor |
| UPI QR Code Payment Gateway | upi-qr-code-payment-gateway |
| UpSolution Core | us-core |
| User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | wp-user-frontend |
| User Private Files – Secure File Sharing and Client Portal Plugin | user-private-files |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| User Submitted Posts – Enable Users to Submit Posts from the Front End | user-submitted-posts |
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | userswp |
| Verge3D Publishing and E-Commerce | verge3d |
| Viable URL Media Uploader | viable-url-media-uploader |
| VikAppointments Services Booking Calendar | vikappointments |
| VikBooking Hotel Booking Engine & PMS | vikbooking |
| Virtue/Ascend/Pinnacle Toolkit | virtue-toolkit |
| Visitor Traffic Real Time Statistics | visitors-traffic-real-time-statistics |
| Visitor Traffic Real Time Statistics pro | visitors-traffic-real-time-statistics-pro |
| Visual Composer Website Builder | visualcomposer |
| Vitepos – Point of Sale (POS) for WooCommerce | vitepos-lite |
| VK Google Job Posting Manager | vk-google-job-posting-manager |
| W3 Total Cache | w3-total-cache |
| WDS MCP Content Manager | wds-mcp-content-manager |
| WEBO MCP | webo-mcp |
| WebSamurai | websamurai |
| WebToffee Gift Cards for WooCommerce | wt-gift-cards-woocommerce |
| WebToffee WP Backup and Migration | wp-migration-duplicator |
| Welcart e-Commerce | usc-e-shop |
| WooCommerce Appointments | woocommerce-appointments |
| WooCommerce Designer Pro | wc-designer-pro |
| WooCommerce Lottery | wc-lottery |
| WP 2FA – Two-factor authentication for WordPress | wp-2fa |
| WP Activity Log | wp-security-audit-log |
| WP BASE Booking of Appointments, Services and Events | wp-base-booking-of-appointments-services-and-events |
| WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | wp-data-access |
| WP Directory Kit | wpdirectorykit |
| WP Express Checkout (Fast Payments via PayPal & Stripe) | wp-express-checkout |
| WP Fusion Lite – Marketing Automation and CRM Integration for WordPress | wp-fusion-lite |
| WP Mail Logging | wp-mail-logging |
| WP Media folder | wp-media-folder |
| WP Mobile Menu – The Mobile-Friendly Responsive Menu | mobile-menu |
| WP OAuth Server (OAuth Authentication) | oauth2-provider |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Popular Posts | wordpress-popular-posts |
| Wp Social Login and Register Social Counter | wp-social |
| WP Spell Check | wp-spell-check |
| WP Statistics – Simple, privacy-friendly Google Analytics alternative | wp-statistics |
| WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export | wp-ultimate-csv-importer |
| WP Ultimate Review | wp-ultimate-review |
| WP User Frontend Pro | wp-user-frontend-pro |
| WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory | wp-user-manager |
| WP Visitor Statistics (Real Time Traffic) | wp-stats-manager |
| WPBot – ChatBot Conversational Forms | conversational-forms |
| WPC Estimated Delivery Date for WooCommerce | wpc-estimated-delivery-date |
| WPC Product Options for WooCommerce | wpc-product-options |
| WPC Shop as a Customer for WooCommerce | wpc-shop-as-customer |
| WPC Smart Quick View for WooCommerce | woo-smart-quick-view |
| WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | wp-cafe |
| WPEPP – Essential Security, Password Protect & Login Page Customizer | wp-edit-password-protected |
| WPFront Notification Bar | wpfront-notification-bar |
| WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | wpfunnels |
| WPML Multilingual & Multicurrency for WooCommerce | woocommerce-multilingual |
| WPMobile.App – Android and iOS App Builder | wpappninja |
| WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons | social-icons-widget-by-wpzoom |
| YayReviews – Advanced Customer Reviews for WooCommerce | yay-customer-reviews-woocommerce |
| YITH WooCommerce Tab Manager | yith-woocommerce-tab-manager |
| Zombify | zombify |
| 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 | pgall-for-woocommerce |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Astra | astra |
| Avada | Website Builder For WordPress & WooCommerce | Avada |
| Betheme | betheme |
| Grand Restaurant WordPress | grandrestaurant |
| Haaken – Fashion Store WordPress Theme | haaken |
| Vayu X | vayu-x |
| Virtue Premium | virtue_premium |
| Wallstreet | wallstreet |
| zella-theme | zella-theme |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Researcher
Affected Software
DevKit Pro [devkit]
Researcher
Affected Software
Divi Membership [divi-membership]
Researcher
Affected Software
Divi Membership [divi-membership]
Researcher
Affected Software
JSON API Auth [json-api-auth]
Researcher
Affected Software
Researcher
Affected Software
Kognetiks Chatbot [chatbot-chatgpt]
Researcher
Affected Software
Researcher
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
Ultimate Multisite <= 2.15.0 – Unauthenticated Authentication Bypass via 'checkout_form' Parameter
9.8
Affected Software
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform [ultimate-multisite]
Researcher
Affected Software
WPMobile.App – Android and iOS App Builder [wpappninja]
Researcher
Affected Software
zella-theme [zella-theme]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
BackupSheep WordPress Backup Plugin [backupsheep]
Researchers
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Cache Enabler [cache-enabler]
Researcher
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
Affected Software
VikAppointments Services Booking Calendar [vikappointments]
Researcher
Affected Software
ByteCoreStack – MCP Connector for AI Tools [bcs-mcp-manager]
Researcher
Affected Software
CoCart – Headless REST API for WooCommerce [cart-rest-api-for-woocommerce]
Researcher
Affected Software
ConvertPlus [convertplug]
Researcher
Affected Software
Featured Image from URL (FIFU) [featured-image-from-url]
Researchers
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Prime Mover – Backup and Migration [prime-mover]
Researcher
Affected Software
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) [smart-manager-for-wp-e-commerce]
Researcher
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
Affected Software
WooCommerce Designer Pro [wc-designer-pro]
Researcher
Affected Software
WPC Shop as a Customer for WooCommerce [wpc-shop-as-customer]
Researcher
Affected Software
Booking Activities [booking-activities]
Researcher
Affected Software
Researcher
Affected Software
Nelio Content – Editorial Calendar & Social Media Auto-Posting [nelio-content]
Researcher
Affected Software
Ninja Forms – File Uploads [ninja-forms-uploads]
Researcher
Affected Software
Photo Reviews for WooCommerce [woo-photo-reviews]
Researcher
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
WEBO MCP [webo-mcp]
Researcher
Affected Software
Advanced Post Manager [advanced-post-manager]
Researcher
Affected Software
Ajax Search Pro [ajax-search-pro]
Researcher
Books Gallery – Book Showcase, Library & Affiliate Plugin <= 4.8.3 – Unauthenticated SQL Injection
7.5
Affected Software
Books Gallery – Book Showcase, Library & Affiliate Plugin [wp-books-gallery]
Researcher
Affected Software
DesignSetGo [designsetgo]
Researcher
Affected Software
eCommerce Product Catalog [ecommerce-product-catalog]
Researcher
Affected Software
EduAdmin Booking [eduadmin-booking]
Researcher
Affected Software
Researcher
Affected Software
EWWW Image Optimizer [ewww-image-optimizer]
Researcher
Affected Software
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export [wp-ultimate-exporter]
Researcher
Affected Software
Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Iptanus File Upload [wp-file-upload]
Researcher
Affected Software
JNews – Pay Writer [jnews-pay-writer]
Researcher
Affected Software
Researcher
Minimum and Maximum Quantity for WooCommerce <= 2.1.2 – Authenticated (Author+) PHP Object Injection
7.5
Affected Software
Minimum and Maximum Quantity for WooCommerce [min-and-max-quantity-for-woocommerce]
Researcher
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Affected Software
Nested Pages [wp-nested-pages]
Researcher
Affected Software
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. [host-webfonts-local]
Researcher
Affected Software
Paytm Payment Gateway [paytm-payments]
Researcher
Affected Software
PDF for Contact Form 7 + Drag and Drop Template Builder [pdf-for-contact-form-7]
Researcher
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Affected Software
Pro Like Button [prolike-button]
Researcher
Affected Software
Product Designer App [product-designer-app]
Researcher
Affected Software
SaveTo Wishlist Lite – WooCommerce Wishlist [saveto-wishlist-lite-for-woocommerce]
Researcher
Schema & Structured Data for WP & AMP <= 1.66 – Authenticated (Contributor+) PHP Object Injection
7.5
Affected Software
Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]
Researcher
Affected Software
Simple Event Planner [simple-event-planner]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
SiteOrigin Widgets Bundle [so-widgets-bundle]
Researcher
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
tagDiv Opt-In Builder [td-subscription]
Researcher
Affected Software
Themify Builder [themify-builder]
Researcher
Affected Software
Two Factor [two-factor]
Researcher
Affected Software
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
VK Google Job Posting Manager [vk-google-job-posting-manager]
Researcher
Affected Software
WooCommerce Appointments [woocommerce-appointments]
Researcher
Affected Software
WooCommerce Lottery [wc-lottery]
Researcher
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
Affected Software
Researcher
Affected Software
WP Spell Check [wp-spell-check]
Researcher
Affected Software
WP Visitor Statistics (Real Time Traffic) [wp-stats-manager]
Researcher
WPBot – ChatBot Conversational Forms <= 1.5.0 – Authenticated (Subscriber+) PHP Object Injection
7.5
Affected Software
WPBot – ChatBot Conversational Forms [conversational-forms]
Researcher
Affected Software
Researcher
Affected Software
Aculect AI Companion [aculect-ai-companion]
Researcher
Affected Software
Authorizer [authorizer]
Researcher
Affected Software
Researcher
Affected Software
hCaptcha for WP [hcaptcha-for-forms-and-more]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
All in One Files Upload for WooCommerce [all-in-one-files-upload-for-woocommerce]
Researcher
Affected Software
Appointment Hour Booking – Booking Calendar [appointment-hour-booking]
Researcher
Affected Software
Astra [astra]
Researcher
Affected Software
Autoptimize [autoptimize]
Researcher
Affected Software
BA Book Everything [ba-book-everything]
Researcher
Affected Software
Betheme [betheme]
Researcher
BlockStrap Page Builder – Bootstrap Blocks <= 0.1.58 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
BlockStrap Page Builder – Bootstrap Blocks [blockstrap-page-builder-blocks]
Researcher
Affected Software
Broken Link Notifier [broken-link-notifier]
Researcher
Affected Software
Business Essentials for Contact Form 7 [cf7-redirect-thank-you-page]
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
CTX Feed Pro [webappick-product-feed-for-woocommerce-pro]
Researchers
Affected Software
CURCY – Multi Currency for WooCommerce [woo-multi-currency]
Researcher
Affected Software
Customer Reviews for WooCommerce [customer-reviews-woocommerce]
Researcher
DoFollow Case by Case <= 3.6.0 – Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
Affected Software
DoFollow Case by Case [dofollow-case-by-case]
Researcher
Affected Software
Download Monitor [download-monitor]
Researcher
Affected Software
Easy Google Maps [google-maps-easy]
Researcher
Extendify <= 3.1.6 – Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
7.2
Affected Software
Extendify [extendify]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Frontend File Manager Plugin [nmedia-user-file-uploader]
Researcher
Affected Software
Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms [frontend-post-submission-manager-lite]
Researcher
Affected Software
GD Rating System [gd-rating-system]
Researcher
Affected Software
Geo Mashup [geo-mashup]
Researcher
Affected Software
Researcher
Affected Software
HT Contact Form – Drag & Drop Form Builder for WordPress [ht-contactform]
Researcher
Affected Software
Researcher
JetAppointment <= 2.5.2.1 – Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
7.2
Affected Software
JetAppointment [jet-appointments-booking]
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
JW Player for WordPress [jw-player-7-for-wp]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Kubio AI Page Builder [kubio]
Researcher
Affected Software
Kubio AI Page Builder [kubio]
Researcher
Affected Software
Kubio AI Page Builder [kubio]
Researcher
Affected Software
Magic Tooltips For Contact Form 7 [magic-tooltips-for-contact-form-7]
Researcher
Affected Software
Mail logging & Catcher [wp-mail-catcher]
Researcher
Affected Software
Mang Board [mangboard]
Researcher
Affected Software
MaxGalleria [maxgalleria]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
MW WP Form [mw-wp-form]
Researcher
Newsletter <= 9.4.0 – Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
7.2
Affected Software
Newsletter – Send awesome emails from WordPress [newsletter]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
No External Links [mihdan-no-external-links]
Researcher
Affected Software
Notification for Telegram [notification-for-telegram]
Researcher
Affected Software
Parallax Section Block – Add Parallax Scrolling Effects to Sections [parallax-section]
Researcher
Affected Software
Paytm Payment Gateway [paytm-payments]
Researcher
Affected Software
PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips]
Researcher
Affected Software
PDF Smart Viewer for Elementor [pdf-smart-viewer-for-elementor]
Researcher
Affected Software
Persistent Login [wp-persistent-login]
Researcher
Affected Software
Researcher
Affected Software
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor [post-and-page-builder]
Researcher
Affected Software
Post Views Stats Counter [post-views-stats-counter]
Researcher
Premmerce Permalink Manager for WooCommerce <= 2.3.13 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Premmerce Permalink Manager for WooCommerce [woo-permalink-manager]
Researcher
Affected Software
Premmerce Wishlist for WooCommerce [premmerce-woocommerce-wishlist]
Researcher
Affected Software
Premmerce Wishlist for WooCommerce [premmerce-woocommerce-wishlist]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Real Cookie Banner: GDPR & ePrivacy Cookie Consent [real-cookie-banner]
Researcher
Affected Software
Relevanssi – A Better Search [relevanssi]
Researcher
Affected Software
Relevanssi Premium [relevanssi-premium]
Researcher
Affected Software
Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF [robin-image-optimizer]
Researcher
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Affected Software
Search in Place [search-in-place]
Researcher
Affected Software
SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]
Researcher
Affected Software
ShopBuilder – WooCommerce Builder For Elementor [shopbuilder]
Researcher
Affected Software
Simple Payment [simple-payment]
Researcher
Affected Software
Researcher
Affected Software
Smart Popup by Supsystic [popup-by-supsystic]
Researcher
Affected Software
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed]
Researcher
Social Sharing Plugin – Sassy Social Share <= 3.3.79 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Social Sharing Plugin – Sassy Social Share [sassy-social-share]
Researcher
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
Affected Software
SUMO Affiliates Pro [affs]
Researcher
Affected Software
Total Donations [totaldonations]
Researcher
Affected Software
TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]
Researcher
Affected Software
Transliterator – Multilingual and Multi-script Text Conversion [serbian-transliteration]
Researcher
Affected Software
Trusted Shops Easy Integration for WooCommerce [trusted-shops-easy-integration-for-woocommerce]
Researcher
Affected Software
Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]
Researcher
Affected Software
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
UpSolution Core [us-core]
Researcher
Affected Software
Researcher
Affected Software
Verge3D Publishing and E-Commerce [verge3d]
Researcher
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
Affected Software
Visitor Traffic Real Time Statistics [visitors-traffic-real-time-statistics]
Researcher
Affected Software
Visitor Traffic Real Time Statistics pro [visitors-traffic-real-time-statistics-pro]
Researcher
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Affected Software
WP Media folder [wp-media-folder]
Researcher
Affected Software
WP User Frontend Pro [wp-user-frontend-pro]
Researcher
Affected Software
WPC Product Options for WooCommerce [wpc-product-options]
Researcher
Affected Software
Researcher
Prime Mover – Backup and Migration <= 2.2.0 – Authenticated (Admin+) Arbitrary Directory Deletion
7.1
Affected Software
Prime Mover – Backup and Migration [prime-mover]
Researcher
Affected Software
Researcher
Affected Software
Cost of Goods: Product Cost & Profit Calculator for WooCommerce [cost-of-goods-for-woocommerce]
Researcher
Affected Software
Extra Product Options For WooCommerce | Custom Product Addons and Fields [woo-extra-product-options]
Researcher
Affected Software
Hide Shipping Method For WooCommerce [hide-shipping-method-for-woocommerce]
Researcher
Affected Software
Music Player for WooCommerce [music-player-for-woocommerce]
Researcher
Affected Software
Page Builder by SiteOrigin [siteorigin-panels]
Researcher
Affected Software
Pay with Vipps and MobilePay for WooCommerce [woo-vipps]
Researcher
Affected Software
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce [woo-product-feed-pro]
Researcher
Affected Software
Responsive Slider Gallery – Responsive Image Photo Slider [responsive-slider-gallery]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
BuildKit – Product Builder for WooCommerce – Custom PC Builder [woo-product-builder]
Researcher
Affected Software
BuildKit – Product Builder for WooCommerce – Custom PC Builder [woo-product-builder]
Researcher
Affected Software
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
Mooberry Book Manager [mooberry-book-manager]
Researcher
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
Affected Software
Pricing Table WordPress Plugin – Easy Pricing Tables [easy-pricing-tables]
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
Affected Software
Quiz Cat – WordPress Quiz Plugin [quiz-cat]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Researcher
Affected Software
tagDiv Opt-In Builder [td-subscription]
Researcher
Affected Software
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
WP Directory Kit <= 1.5.4 – Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
6.5
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
Audio Player Block – Advanced Block for Embedding Audio Files [audio-player-block]
Researcher
Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]
Researcher
Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]
Researcher
Affected Software
bbp style pack [bbp-style-pack]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Branda – White Label & Branding, Free Login Page Customizer [branda-white-labeling]
Researcher
Affected Software
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Researcher
Affected Software
Cool FormKit Lite – Advanced Form Builder for Elementor [extensions-for-elementor-form]
Researcher
Affected Software
Download Manager [downloadmanager]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Duplicate Post [copy-delete-posts]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
EWWW Image Optimizer [ewww-image-optimizer]
Researcher
Affected Software
Researcher
Affected Software
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns [essential-blocks]
Researcher
Affected Software
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]
Researcher
Horizontal Scrolling Announcements <= 2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Horizontal scrolling announcements [horizontal-scrolling-announcements]
Researcher
Affected Software
Hostinger Reach – AI-Powered Email Marketing for WordPress [hostinger-reach]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
JetReviews [jet-reviews]
Researcher
Affected Software
Researcher
Affected Software
Kubio AI Page Builder [kubio]
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
Affected Software
Researcher
Affected Software
Loco Translate [loco-translate]
Researcher
Affected Software
Researcher
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Affected Software
Ohio Extra [ohio-extra]
Researcher
Affected Software
oik [oik]
Researcher
Affected Software
Pixfort Core [pixfort-core]
Researcher
Affected Software
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]
Researcher
Affected Software
Qi Addons For Elementor [qi-addons-for-elementor]
Researcher
Affected Software
ReactPress – Create React App for WordPress [reactpress]
Researcher
Affected Software
Real Estate Manager – Property Listing and Agent Management [real-estate-manager]
Researcher
Affected Software
Redux Framework [redux-framework]
Researcher
Affected Software
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]
Researcher
Affected Software
Responsive Starter Templates – Elementor Templates & Starter Sites [responsive-add-ons]
Researcher
Affected Software
Rich Showcase for Google Reviews [widget-google-reviews]
Researcher
Affected Software
Smart Slider 3 [smart-slider-3]
Researcher
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
SupportCandy <= 3.5.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter
6.4
Affected Software
Researcher
Affected Software
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder [supreme-modules-for-divi]
Researcher
Affected Software
ThemeREX Addons [trx_addons]
Researcher
Affected Software
ThemeREX Addons [trx_addons]
Researcher
Affected Software
Twenty20 Image Before-After [twenty20]
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
Ultra Addons Lite for Elementor [ut-elementor-addons-lite]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
User Submitted Posts – Enable Users to Submit Posts from the Front End [user-submitted-posts]
Researcher
Affected Software
Viable URL Media Uploader [viable-url-media-uploader]
Researcher
Patch Status
Patched
Patched
Published
Sep 30, 2026
Sep 30, 2026
Affected Software
Virtue Premium [virtue_premium]
Researcher
Patch Status
Patched
Patched
Published
Sep 30, 2026
Sep 30, 2026
Affected Software
Virtue Premium [virtue_premium]
Researcher
Affected Software
Virtue/Ascend/Pinnacle Toolkit [virtue-toolkit]
Researcher
Affected Software
Visual Composer Website Builder [visualcomposer]
Researcher
Affected Software
WP OAuth Server (OAuth Authentication) [oauth2-provider]
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
Wp Social Login and Register Social Counter [wp-social]
Researcher
Affected Software
YITH WooCommerce Tab Manager [yith-woocommerce-tab-manager]
Researcher
Affected Software
ByteCoreStack – MCP Connector for AI Tools [bcs-mcp-manager]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]
Researcher
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]
Researcher
Affected Software
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]
Researcher
Disable and Remove Google Fonts | GDPR & DSGVO friendly <= 2.0.2 – Reflected Cross-Site Scripting
6.1
Affected Software
Disable and Remove Google Fonts | GDPR & DSGVO friendly [disable-remove-google-fonts]
Researcher
Affected Software
Researcher
Affected Software
EWWW Image Optimizer [ewww-image-optimizer]
Researcher
Affected Software
Five Star Restaurant Reviews [good-reviews-wp]
Researcher
Affected Software
Grand Restaurant WordPress [grandrestaurant]
Researcher
Affected Software
Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]
Researcher
Affected Software
Researcher
Affected Software
Ivory Search – WordPress Search Plugin [add-search-to-menu]
Researcher
Affected Software
Researcher
Affected Software
WP Mobile Menu – The Mobile-Friendly Responsive Menu [mobile-menu]
Researcher
Affected Software
Researcher
Affected Software
Payflex Payment Gateway [payflex-payment-gateway]
Researcher
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Affected Software
Photo Reviews for WooCommerce [woo-photo-reviews]
Researcher
Affected Software
Progressify – All-in-One Progressive Web App (PWA) [progressify]
Researcher
Affected Software
Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPC Estimated Delivery Date for WooCommerce [wpc-estimated-delivery-date]
Researcher
Affected Software
WPC Smart Quick View for WooCommerce [woo-smart-quick-view]
Researcher
Affected Software
WPFront Notification Bar [wpfront-notification-bar]
Researcher
Affected Software
Researcher
Affected Software
Advanced Woo Labels – Product Labels & Badges for WooCommerce [advanced-woo-labels]
Researcher
Affected Software
Autoptimize [autoptimize]
Researcher
Affected Software
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
WPMobile.App – Android and iOS App Builder [wpappninja]
Researcher
Affected Software
AFFI – Affiliate Marketing for WooCommerce [affi-affiliate-marketing-for-woo]
Researcher
Affected Software
Researchers
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
BuildKit – Product Builder for WooCommerce – Custom PC Builder [woo-product-builder]
Researcher
Bus Ticket Booking with Seat Reservation <= 5.9.3 – Unauthenticated Insecure Direct Object Reference
5.3
Affected Software
Bus Ticket Booking with Seat Reservation [bus-ticket-booking-with-seat-reservation]
Researcher
Affected Software
CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 [contact-form-7-honeypot]
Researcher
Affected Software
CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]
Researcher
Affected Software
Connections Business Directory [connections]
Researcher
Affected Software
Cost Calculator Builder [cost-calculator-builder]
Researcher
Affected Software
Course Booking System [course-booking-system]
Affected Software
Researcher
Affected Software
Deema Payment Gateway [deema-payment-gateway]
Researcher
Affected Software
Deema Payment Gateway [deema-payment-gateway]
Affected Software
Download Manager [download-manager]
Researcher
Easy PayPal & Stripe Buy Now Button 1.8 – 2.0.5 – Unauthenticated Arbitrary Payment Amount Reduction
5.3
Affected Software
Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal]
Researcher
Affected Software
WPEPP – Essential Security, Password Protect & Login Page Customizer [wp-edit-password-protected]
Researcher
Affected Software
elegro Crypto Payment [elegro-payment]
Researcher
Affected Software
Fast Courier – Shipping & Freight [fast-courier-shipping-freight]
Researcher
Affected Software
File Uploads Addon for WooCommerce [woo-addon-uploads]
Researcher
File Uploads Addon for WooCommerce 1.7.2 – 1.7.5 – Unauthenticated Insecure Direct Object Reference
5.3
Affected Software
File Uploads Addon for WooCommerce [woo-addon-uploads]
Researcher
Affected Software
Five Star Restaurant Reservations – WordPress Booking Plugin [restaurant-reservations]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
GravityExport Lite for Gravity Forms [gf-entries-in-excel]
Researcher
Affected Software
Hostinger Migrator [migrator-plugin]
Researcher
Affected Software
Researcher
Affected Software
InPost PL [inpost-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Lookzy LookBook for WooCommerce [woo-lookbook]
Researcher
Affected Software
Mailchimp for WooCommerce [mailchimp-for-woocommerce]
Researcher
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researcher
Affected Software
New User Approve [new-user-approve]
Researcher
Affected Software
Newsletter – Send awesome emails from WordPress [newsletter]
Researcher
Affected Software
Notivo Notification for WooCommerce [woo-notification]
Researcher
Affected Software
OAuth Single Sign On – SSO (OAuth Client) [miniorange-login-with-eve-online-google-facebook]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
Pay with Vipps and MobilePay for WooCommerce [woo-vipps]
Researcher
Affected Software
Payments for Hubtel [payments-hubtel]
Researcher
Affected Software
Payments for Hubtel [payments-hubtel]
Researcher
Affected Software
Payments for Hubtel [payments-hubtel]
Researcher
Affected Software
Paytm Payment Gateway [paytm-payments]
Researcher
Affected Software
Photo Reviews for WooCommerce [woo-photo-reviews]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
Affected Software
Razorpay for WooCommerce [woo-razorpay]
Researcher
Affected Software
Request a Quote – Quote Forms for Any WordPress Site [request-a-quote]
Researcher
Affected Software
REST API Log [wp-rest-api-log]
Researcher
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO 3.1.0 – Missing Authorization
5.3
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Sermon'e [sermone]
Researcher
Affected Software
Site Reviews [site-reviews]
Researcher
Affected Software
Slider Pro [slider-pro-wp]
Researcher
Affected Software
Smart One Click Setup – Complete Demo Import & Export [smart-one-click-setup]
Researcher
Affected Software
Solace Extra [solace-extra]
Researcher
Affected Software
StifLi Backup Tools [stifli-backup-tools]
Researcher
Affected Software
Researcher
Affected Software
TillKit [tillkit]
Researcher
Affected Software
Researcher
Affected Software
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]
Researcher
Affected Software
Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
UPI QR Code Payment Gateway [upi-qr-code-payment-gateway]
Researcher
Affected Software
Researcher
Affected Software
User Private Files – Secure File Sharing and Client Portal Plugin [user-private-files]
Researcher
Affected Software
Researcher
Affected Software
WebToffee Gift Cards for WooCommerce [wt-gift-cards-woocommerce]
Researcher
Affected Software
WebToffee WP Backup and Migration [wp-migration-duplicator]
Researcher
Affected Software
WP Express Checkout (Fast Payments via PayPal & Stripe) [wp-express-checkout]
Researcher
Affected Software
WP Popular Posts [wordpress-popular-posts]
Researcher
Affected Software
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPMobile.App – Android and iOS App Builder [wpappninja]
Researcher
Affected Software
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons [social-icons-widget-by-wpzoom]
Researcher
Affected Software
YayReviews – Advanced Customer Reviews for WooCommerce [yay-customer-reviews-woocommerce]
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.5.17 – Missing Authorization to Unauthenticated Settings Update
5.3
Affected Software
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 [pgall-for-woocommerce]
Researcher
Affected Software
Business Directory Plugin – Easy Listing & Member Directories for WordPress [business-directory-plugin]
Researcher
Affected Software
Captivate Sync [captivatesync-trade]
Researcher
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researcher
Affected Software
SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]
Researcher
Affected Software
Researcher
Affected Software
WP Activity Log [wp-security-audit-log]
Researcher
Patch Status
Patched
Patched
Published
Sep 30, 2026
Sep 30, 2026
Affected Software
WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]
Researcher
Affected Software
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]
Researcher
Affected Software
EWWW Image Optimizer [ewww-image-optimizer]
Researcher
Affected Software
Researcher
Affected Software
WP Mail Logging [wp-mail-logging]
Researcher
Affected Software
Researcher
Affected Software
Safe Redirect Manager [safe-redirect-manager]
Researcher
Affected Software
Researcher
Prime Mover – Backup and Migration <= 2.2.0 – Authenticated (Admin+) Stored Cross-Site Scripting
4.4
Affected Software
Prime Mover – Backup and Migration [prime-mover]
Researcher
Schema & Structured Data for WP & AMP <= 1.66 – Authenticated (Editor+) Stored Cross-Site Scripting
4.4
Affected Software
Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]
Researcher
Affected Software
Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]
Researcher
Affected Software
Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]
Researcher
Affected Software
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]
Researcher
Affected Software
Researcher
Patch Status
Patched
Patched
Published
Oct 2, 2026
Oct 2, 2026
Affected Software
Researcher
Advanced Ads – Ad Manager & AdSense <= 2.0.26 – Authenticated (Subscriber+) Information Exposure
4.3
Affected Software
Advanced Ads – Ad Manager & AdSense [advanced-ads]
Researcher
Affected Software
Advanced Partial Payment or Deposit for WooCommerce [advanced-partial-payment-or-deposit-for-woocommerce]
Researcher
Affected Software
Airano MCP Bridge [airano-mcp-bridge]
Researcher
Affected Software
All in One Files Upload for WooCommerce [all-in-one-files-upload-for-woocommerce]
Researcher
Affected Software
AllAble Connector [allable-connector]
Researcher
Affected Software
Researcher
Affected Software
Aruba Migration Tool [aruba-wp-migration-tool]
Researcher
Affected Software
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) [burst-statistics]
Researcher
Affected Software
ECPay Ecommerce for WooCommerce [ecpay-ecommerce-for-woocommerce]
Researcher
Faktur Pro for WooCommerce <= 3.2.2 – Authenticated (Customer+) Insecure Direct Object Reference
4.3
Affected Software
Faktur Pro for WooCommerce [woorechnung]
Researcher
Affected Software
Featured Image from URL (FIFU) [featured-image-from-url]
Researcher
Affected Software
File Media Renamer [file-media-renamer]
Researcher
Five Star Business Profile and Schema 2.3.20 – 2.3.21 – Authenticated (Author+) Information Exposure
4.3
Affected Software
Five Star Business Profile and Schema [business-profile]
Researcher
Affected Software
Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce [flexible-coupons]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program [gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce]
Researcher
Affected Software
Helpdesk Support Ticket System for WooCommerce [support-ticket-system-for-woocommerce]
Researcher
Affected Software
IATO MCP [iato-mcp]
Researcher
Affected Software
Image Optimizer [image-optimizer]
Researcher
Affected Software
Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]
Researcher
Affected Software
Researcher
Affected Software
Loco Translate [loco-translate]
Researcher
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]
Researcher
Affected Software
MakeCommerce for WooCommerce [makecommerce]
Researcher
Affected Software
MCP Content Manager Lite [mcp-content-manager-lite]
Researcher
Affected Software
Media Library Organizer – Folders, File Manager & Media Categories [media-library-organizer]
Researcher
Affected Software
Memberful – Membership Plugin [memberful-wp]
Researcher
Affected Software
Mindio Magic MCP [mindio-magic-mcp]
Researcher
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Photo Gallery – Responsive Image Galleries by Supsystic [gallery-by-supsystic]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Prevent Files / Folders Access [prevent-file-access]
Researcher
Affected Software
Progress Planner [progress-planner]
Researcher
Affected Software
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]
Researcher
Affected Software
Razorpay Payment Links for WooCommerce [rzp-woocommerce]
Researcher
Affected Software
Redux Framework [redux-framework]
Researcher
Affected Software
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]
Researcher
Affected Software
Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF [robin-image-optimizer]
Researcher
Affected Software
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more [scratch-win-giveaways-for-website-facebook]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
Travelly – Tour & Travel Booking Manager for WooCommerce [tour-booking-manager]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Vayu X [vayu-x]
Researcher
Affected Software
Wallstreet [wallstreet]
Researcher
Affected Software
WDS MCP Content Manager [wds-mcp-content-manager]
Researcher
Affected Software
WebSamurai [websamurai]
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026) appeared first on Wordfence.
Puedes consultar el artículo original aquí: https://www.wordfence.com/blog/2026/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-28-2026-to-october-4-2026/