Wordfence: Previene riesgos analizando vulnerabilidades semanales de WordPress
Este es un resumen del artículo. Si necesitas contexto adicional, aquí tienes el enlace original: https://www.wordfence.com/blog/2026/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-21-2026-to-september-27-2026/
Last week, there were 319 vulnerabilities disclosed in 222 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 156 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-959 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-960 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-961 – Data redacted while we work with the vendor on a patch.
- WordPress Core <= 7.1.1 – Unauthenticated Local File Inclusion via locate_template() Path Traversal
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 305 |
| Unpatched | 14 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 226 |
| High Severity | 79 |
| Critical Severity | 14 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 96 |
| Missing Authorization | 59 |
| Authorization Bypass Through User-Controlled Key | 26 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 24 |
| Exposure of Sensitive Information to an Unauthorized Actor | 22 |
| Improper Privilege Management | 14 |
| Deserialization of Untrusted Data | 11 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 11 |
| Improper Control of Generation of Code ('Code Injection') | 8 |
| Client-Side Enforcement of Server-Side Security | 7 |
| Server-Side Request Forgery (SSRF) | 7 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 5 |
| Incorrect Authorization | 5 |
| Cross-Site Request Forgery (CSRF) | 4 |
| Improper Authentication | 4 |
| Improper Authorization | 3 |
| Protection Mechanism Failure | 3 |
| Uncontrolled Resource Consumption | 3 |
| Guessable CAPTCHA | 2 |
| Unrestricted Upload of File with Dangerous Type | 2 |
| Improper Input Validation | 1 |
| Incorrect Privilege Assignment | 1 |
| Origin Validation Error | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 34 | |
| 11 | |
| 11 | |
| 8 | |
| 8 | |
| 8 | |
| 8 | |
| 8 | |
| 7 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | tenweb-speed-optimizer |
| Ad Inserter – Ad Manager & AdSense Ads | ad-inserter |
| Admin Notices Manager | admin-notices-manager |
| Advanced Contact form 7 DB | advanced-cf7-db |
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | ai-engine |
| All-In-One Security (AIOS) – Security and Firewall | all-in-one-wp-security-and-firewall |
| AMP for WP – Accelerated Mobile Pages | accelerated-mobile-pages |
| AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) | appmysite |
| Appointment Booking Plugin & Scheduling System – Webba Booking Calendar | webba-booking-lite |
| Asset CleanUp: Page Speed Booster | wp-asset-clean-up |
| Automatic.css | automatic-css |
| Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code | automation-web-platform |
| BA Book Everything | ba-book-everything |
| Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | bp-better-messages |
| Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More | better-payment |
| Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification | wc-blacklist-manager |
| Blocksy Companion | blocksy-companion |
| Blog2Social: Social Media Auto Post & Scheduler | blog2social |
| Bluff Post | bluff-post |
| BM Content Builder | bm-builder |
| Booking Calendar | booking |
| Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar | booking-manager |
| Business Directory Plugin – Easy Listing & Member Directories for WordPress | business-directory-plugin |
| Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More | calculated-fields-form |
| Captcha Code | captcha-code-authentication |
| CartFlows – Funnel Builder & Checkout Plugin for WooCommerce | cartflows |
| CMB2 | cmb2 |
| CMP – Coming Soon & Maintenance Plugin by NiteoThemes | cmp-coming-soon-maintenance |
| Conekta Payment Gateway | conekta-payment-gateway |
| Contextual Related Posts | contextual-related-posts |
| Core Web Vitals & PageSpeed Booster | core-web-vitals-pagespeed-booster |
| CSS & JavaScript Toolbox | css-javascript-toolbox |
| Custom Field Template | custom-field-template |
| Custom Thank You Page for WooCommerce | custom-thank-you-page |
| Customer Reviews for WooCommerce | customer-reviews-woocommerce |
| Directorist: AI-Powered Business Directory, Listings & Classified Ads | directorist |
| Ditty – Responsive News Tickers, Sliders, and Lists | ditty-news-ticker |
| Divi Dash | divi-dash |
| Download Manager | downloadmanager |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| Easy Hide Login | easy-hide-login |
| eesy_ID2WP – Publish InDesign HTML5 | eesy-id2wp-publish-indesign-html5 |
| Elementor Website Builder – more than just a page builder | elementor |
| ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | elementskit-lite |
| Email Log | email-log |
| Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | email-subscribers |
| EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | embedpress |
| ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | erp |
| Estatik Real Estate Plugin | estatik |
| EthPress – Web3 Login | ethpress |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| Event Tickets and Registration | event-tickets |
| Events Manager – Calendar, Bookings, Tickets, Appointments and more! | events-manager |
| Fancy Product Designer | fancy-product-designer |
| File Manager | wp-file-manager |
| File Manager Pro – Filester | filester |
| FileOrganizer – WordPress File Manager | fileorganizer |
| Fluent Support – Helpdesk & Customer Support Ticket System | fluent-support |
| FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration | fluent-boards |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| GEO Plugin by Squirrly SEO | squirrly-seo |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Give Tributes | give-tributes |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| Go Live Update Urls | go-live-update-urls |
| Groups – Memberships and Access Control | groups |
| Gutenverse – WordPress Blocks, Page Builder & Site Editor | gutenverse |
| Handily | handily |
| HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates | happy-elementor-addons |
| Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms | happyforms |
| HashBar – Announcement, Notification Bar & Popup Campaign | hashbar-wp-notification-bar |
| Hostel | hostel |
| HT Contact Form – Drag & Drop Form Builder for WordPress | ht-contactform |
| HUSKY – Products Filter for WooCommerce Professional | woocommerce-products-filter |
| Image Buzz | image-buzz |
| Import and export users and customers | import-users-from-csv-with-meta |
| JetEngine | jet-engine |
| JetFormBuilder Stripe Gateway | jet-form-builder-stripe-gateway |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| JetTricks | jet-tricks |
| JSM Show Post Metadata | jsm-show-post-meta |
| Kadence WooCommerce Email Designer | kadence-woocommerce-email-designer |
| King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder | king-addons |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | knit-pay |
| LayerSlider | LayerSlider |
| Link Library | link-library |
| Live Composer – Free WordPress Website Builder | live-composer-page-builder |
| Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator | live-copy-paste |
| Mailchimp for WooCommerce | mailchimp-for-woocommerce |
| MailerLite – Signup forms (official) | official-mailerlite-sign-up-forms |
| Malcure Malware Shield — Removal, Repair, Monitor | wp-malware-removal |
| Mang Board | mangboard |
| MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | marketking-multivendor-marketplace-for-woocommerce |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP | ai-workflow-automation-ai-agent-hub |
| Meta Box AIO | meta-box-aio |
| Meta Box Frontend Submission | mb-frontend-submission |
| Meta Box User Profile | mb-user-profile |
| miniOrange OTP Login, Verification and SMS Notifications | miniorange-otp-verification |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| Mollie Forms | mollie-forms |
| Netgsm | netgsm |
| Newsletters | newsletters-lite |
| NextScripts: Social Networks Auto-Poster | social-networks-auto-poster-facebook-twitter-g |
| Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | ninja-forms |
| Ninja Tables – Easy Data Table Builder | ninja-tables |
| NP Quote Request for WooCommerce | woo-rfq-for-woocommerce |
| Ocean Extra | ocean-extra |
| Online Booking & Scheduling Calendar by vcita | meeting-scheduler-by-vcita |
| Online Scheduling and Appointment Booking System – Bookly | bookly-responsive-appointment-booking-tool |
| OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin | desktop-mode |
| Optima Express IDX | optima-express |
| Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | optimole-wp |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management | wp-payment-form |
| Payment Plugins for PayPal WooCommerce | pymntpl-paypal-woocommerce |
| Paymob for WooCommerce | paymob-for-woocommerce |
| PayPlus Payment Gateway | payplus-payment-gateway |
| Paytium: Mollie payment forms & donations | paytium |
| Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | nextgen-gallery |
| Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing | woocommerce-google-adwords-conversion-tracking-tag |
| PixelPlay | pixelplay |
| PixelYourSite – Your smart PIXEL (TAG) & API Manager | pixelyoursite |
| Podcast Importer SecondLine | podcast-importer-secondline |
| Points and Rewards for WooCommerce | points-and-rewards-for-woocommerce |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Post Voting System | post-voting-system |
| PowerPress Podcasting plugin by Blubrry | powerpress |
| Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | premium-addons-for-elementor |
| Premium Blocks – Gutenberg Blocks, Patterns & Templates | premium-blocks-for-gutenberg |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster | easy-sale-badges-for-woocommerce |
| Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels | webappick-product-feed-for-woocommerce |
| Product Filter for WooCommerce by WBW | woo-product-filter |
| Product Table & List Builder for WooCommerce | wc-product-table-lite |
| PublishPress Capabilities: User Role Access Control, Admin Area Permissions | capability-manager-enhanced |
| Razorpay Payment Button Plugin | razorpay-payment-button |
| Real3D Flipbook | real3d-flipbook |
| Rename wp-login.php to anything you want | rename-wp-loginphp-to-anything-you-want |
| Repeater Fields for Elementor Forms | repeater-for-elementor |
| Request a Quote for WooCommerce | woocommerce-request-a-quote |
| Restaurant Menu and Food Ordering | mp-restaurant-menu |
| Reycob Product Import Export | reycob-product-import-export |
| RW Elephant Rental Inventory | rw-elephant-rental-inventory |
| s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions | s2member |
| Safe SVG | safe-svg |
| Shopping Cart & eCommerce Store | wp-easycart |
| ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | shortpixel-image-optimiser |
| Simple Discount Rules for Woocommerce | woo-product-category-discount |
| Simply Schedule Appointments | simply-schedule-appointments |
| Site Reviews | site-reviews |
| SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP | siteskite |
| Spectra Legacy – Gutenberg Blocks | ultimate-addons-for-gutenberg |
| Sprout Invoices – Client Invoicing & Estimates | sprout-invoices |
| SPS-Suite | sps-suite-121 |
| SSL Zen — SSL Certificate Installer & HTTPS Redirects | ssl-zen |
| Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form | wp-subscribe-form |
| SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | surecart |
| Tainacan | tainacan |
| Tangible: Loops & Logic | tangible-loops-and-logic |
| Team Members | tc-team-members |
| Team – Team Members Showcase Plugin | tlp-team |
| Template Kit – Import | template-kit-import |
| Testimonials Widget | testimonials-widget |
| Text Styler | text-styler |
| The Events Calendar | the-events-calendar |
| The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates | the-plus-addons-for-elementor-page-builder |
| The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid | the-post-grid |
| ThemeREX Addons | trx_addons |
| Themify Builder | themify-builder |
| ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More | image-sizes |
| Translate WordPress with GTranslate | gtranslate |
| TranslatePress – Translate Multilingual sites with AI Translation | translatepress-multilingual |
| TrustedLogin Connector | trustedlogin-connector |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultimate FAQ Accordion Plugin | ultimate-faqs |
| Ultimeter – the Ultimate Progress and Goals Meter | ultimeter |
| Ultra Addons for Contact Form 7 | ultimate-addons-for-contact-form-7 |
| UpdraftPlus: WP Backup & Migration Plugin | updraftplus |
| User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | wp-user-frontend |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| Verge3D Publishing and E-Commerce | verge3d |
| Visual Composer Website Builder | visualcomposer |
| W4 Post List | w4-post-list |
| WC Fields Factory | wc-fields-factory |
WebFacing – Email Accounts management for cPanel® |
wf-cpanel-email-accounts |
| WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | wp-data-access |
| WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) | delicious-recipes |
| WP Directory Kit | wpdirectorykit |
| WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings | wp-google-map-plugin |
| WP Multilang – Translation and Multilingual Plugin | wp-multilang |
| WP OAuth Server ( Login with WordPress ) | miniorange-oauth-20-server |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Recipe Maker | wp-recipe-maker |
| WP Review Slider Pro | wp-review-slider-pro |
| WP Statistics – Simple, privacy-friendly Google Analytics alternative | wp-statistics |
| WP Store Locator | wp-store-locator |
| WP Table Builder – Drag & Drop Table Builder | wp-table-builder |
| WP Travel Engine – Tour Booking Plugin – Tour Operator Software | wp-travel-engine |
| WP Ultimate Review | wp-ultimate-review |
| WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory | wp-user-manager |
| WP Verify API | wp-verify-api |
| WP Yelp Review Slider | wp-yelp-review-slider |
| WP YouTube Lyte | wp-youtube-lyte |
| WP-CRM System – Manage Clients and Projects | wp-crm-system |
| WPC Product Bundles for WooCommerce | woo-product-bundle |
| WPC Smart Compare for WooCommerce | woo-smart-compare |
| WPeMatico RSS Feed Fetcher | wpematico |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| wpForo Forum | wpforo |
| WPS Limit Login | wps-limit-login |
| WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent | wsp-mcp-ai-agents-connector |
| YAHMAN Add-ons | yahman-add-ons |
| YITH Request a Quote for WooCommerce | yith-woocommerce-request-a-quote |
| YITH WooCommerce Ajax Search | yith-woocommerce-ajax-search |
| YOP Poll | yop-poll |
| Zero Spam for WordPress | zero-spam |
| Zportals | zportals |
| پارسی دیت – Parsi Date | wp-parsidate |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code [automation-web-platform]
Researcher
Affected Software
Give Tributes [give-tributes]
Researcher
Affected Software
Meta Box User Profile [mb-user-profile]
Researcher
Affected Software
Meta Box AIO [meta-box-aio]
Researcher
Affected Software
Meta Box Frontend Submission [mb-frontend-submission]
Researcher
Affected Software
Meta Box AIO [meta-box-aio]
Meta Box Frontend Submission [mb-frontend-submission]
Meta Box User Profile [mb-user-profile]
Researcher
Affected Software
miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]
Researcher
Affected Software
Researcher
Affected Software
Request a Quote for WooCommerce [woocommerce-request-a-quote]
Researcher
Affected Software
Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]
Researcher
Affected Software
Visual Composer Website Builder [visualcomposer]
Researchers
Affected Software
YAHMAN Add-ons [yahman-add-ons]
Researcher
Affected Software
Customer Reviews for WooCommerce [customer-reviews-woocommerce]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
BM Content Builder [bm-builder]
Researcher
Affected Software
Researcher
Affected Software
Researchers
Affected Software
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Knit Pay <= 9.6.1.0 – Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
8.8
Affected Software
Researcher
Affected Software
WP OAuth Server ( Login with WordPress ) [miniorange-oauth-20-server]
Researcher
Affected Software
Researcher
Affected Software
YOP Poll [yop-poll]
Researcher
Affected Software
EthPress – Web3 Login [ethpress]
Researcher
Affected Software
HUSKY – Products Filter for WooCommerce Professional [woocommerce-products-filter]
Researcher
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WebFacing
– Email Accounts management for cPanel® [wf-cpanel-email-accounts]
– Email Accounts management for cPanel® [wf-cpanel-email-accounts]
Researcher
WordPress Core <= 7.1.1 – Unauthenticated Local File Inclusion via locate_template() Path Traversal
8.1
Affected Software
WordPress [wordpress]
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]
Researcher
Affected Software
Bluff Post [bluff-post]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
eesy_ID2WP – Publish InDesign HTML5 [eesy-id2wp-publish-indesign-html5]
Researcher
Affected Software
Researcher
Affected Software
GEO Plugin by Squirrly SEO [squirrly-seo]
Researcher
Affected Software
Go Live Update Urls [go-live-update-urls]
Researcher
Affected Software
JetFormBuilder Stripe Gateway [jet-form-builder-stripe-gateway]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]
Researcher
Affected Software
Product Filter for WooCommerce by WBW [woo-product-filter]
Researcher
Affected Software
Rename wp-login.php to anything you want [rename-wp-loginphp-to-anything-you-want]
Researcher
Affected Software
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]
Researcher
Affected Software
SPS-Suite [sps-suite-121]
Affected Software
Researcher
Affected Software
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin]
Researcher
Affected Software
WP Store Locator [wp-store-locator]
Researcher
Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine]
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
Affected Software
Optima Express IDX [optima-express]
Researcher
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Affected Software
AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages]
Researcher
BA Book Everything <= 1.8.27 – Unauthenticated Stored Cross-Site Scripting via first_name Parameter
7.2
Affected Software
BA Book Everything [ba-book-everything]
Researcher
Affected Software
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]
Researcher
Affected Software
CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]
Researcher
Affected Software
Core Web Vitals & PageSpeed Booster [core-web-vitals-pagespeed-booster]
Researcher
Affected Software
Download Manager [downloadmanager]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Fancy Product Designer [fancy-product-designer]
Researcher
Affected Software
Fancy Product Designer [fancy-product-designer]
Researcher
Affected Software
Fancy Product Designer [fancy-product-designer]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
HT Contact Form – Drag & Drop Form Builder for WordPress [ht-contactform]
Researcher
Affected Software
LayerSlider [LayerSlider]
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
Mang Board [mangboard]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Product Table & List Builder for WooCommerce <= 5.6.7 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Product Table & List Builder for WooCommerce [wc-product-table-lite]
Researcher
Affected Software
Razorpay Payment Button Plugin [razorpay-payment-button]
Researcher
Affected Software
Repeater Fields for Elementor Forms [repeater-for-elementor]
Researcher
Affected Software
Restaurant Menu and Food Ordering [mp-restaurant-menu]
Researcher
Affected Software
Site Reviews [site-reviews]
Researcher
Affected Software
Testimonials Widget [testimonials-widget]
Researcher
Affected Software
ThemeREX Addons [trx_addons]
Researcher
Themify Builder <= 7.8.1 – Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
7.2
Affected Software
Themify Builder [themify-builder]
Researcher
Affected Software
TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]
Researcher
Affected Software
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
Researcher
Affected Software
WP Yelp Review Slider [wp-yelp-review-slider]
Researcher
Affected Software
WPC Product Bundles for WooCommerce [woo-product-bundle]
Researcher
Affected Software
WPS Limit Login [wps-limit-login]
Researcher
Affected Software
YITH WooCommerce Ajax Search [yith-woocommerce-ajax-search]
Researcher
Affected Software
Zero Spam for WordPress [zero-spam]
Researcher
Affected Software
پارسی دیت – Parsi Date [wp-parsidate]
Researcher
Affected Software
WP Table Builder – Drag & Drop Table Builder [wp-table-builder]
Researcher
Kadence WooCommerce Email Designer <= 1.5.19.1 – Authenticated (Shop Manager+) PHP Object Injection
6.6
Affected Software
Kadence WooCommerce Email Designer [kadence-woocommerce-email-designer]
Researcher
Affected Software
Reycob Product Import Export [reycob-product-import-export]
Researcher
Affected Software
Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]
Researcher
Affected Software
Advanced Contact form 7 DB [advanced-cf7-db]
Researcher
Affected Software
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]
Researcher
Affected Software
BM Content Builder [bm-builder]
Researcher
Affected Software
Researcher
Affected Software
Custom Thank You Page for WooCommerce [custom-thank-you-page]
Researcher
Affected Software
Researcher
Affected Software
Translate WordPress with GTranslate [gtranslate]
Researcher
Affected Software
Researcher
Affected Software
Malcure Malware Shield — Removal, Repair, Monitor [wp-malware-removal]
Researcher
Affected Software
Mollie Forms [mollie-forms]
Researcher
Affected Software
Ninja Tables – Easy Data Table Builder [ninja-tables]
Researcher
Affected Software
Post Voting System [post-voting-system]
Researcher
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
WP Review Slider Pro [wp-review-slider-pro]
Researcher
Affected Software
Shopping Cart & eCommerce Store [wp-easycart]
Researcher
Affected Software
Tainacan [tainacan]
Researcher
Affected Software
Template Kit – Import [template-kit-import]
Researcher
Affected Software
Researcher
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Affected Software
Automatic.css [automatic-css]
Researcher
Affected Software
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]
Researcher
Affected Software
Contextual Related Posts [contextual-related-posts]
Affected Software
CSS & JavaScript Toolbox [css-javascript-toolbox]
Researcher
Affected Software
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) [delicious-recipes]
Researcher
Affected Software
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]
Researcher
Affected Software
Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]
Researcher
Affected Software
JSM Show Post Metadata [jsm-show-post-meta]
Researcher
Affected Software
Researcher
Affected Software
Live Composer – Free WordPress Website Builder [live-composer-page-builder]
Researcher
Affected Software
Ocean Extra [ocean-extra]
Researcher
Affected Software
Optima Express IDX [optima-express]
Researcher
Affected Software
Researcher
Affected Software
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing [woocommerce-google-adwords-conversion-tracking-tag]
Researcher
Affected Software
PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite]
Researcher
Affected Software
Podcast Importer SecondLine [podcast-importer-secondline]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Affected Software
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]
Researcher
Affected Software
Premium Blocks – Gutenberg Blocks, Patterns & Templates [premium-blocks-for-gutenberg]
Researcher
Affected Software
Real3D Flipbook [real3d-flipbook]
Researcher
Affected Software
WP Review Slider Pro [wp-review-slider-pro]
Researcher
Affected Software
WP Review Slider Pro [wp-review-slider-pro]
Researcher
Affected Software
Safe SVG [safe-svg]
Researcher
Affected Software
Researcher
Affected Software
Text Styler [text-styler]
Affected Software
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
ThemeREX Addons [trx_addons]
Researcher
Ultimate FAQ Accordion Plugin <= 2.4.14 – Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Ultimate FAQ Accordion Plugin [ultimate-faqs]
Researcher
Ultra Addons for Contact Form 7 <= 3.5.50 – Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin]
Researcher
Affected Software
WP Multilang – Translation and Multilingual Plugin [wp-multilang]
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
Affected Software
WP YouTube Lyte [wp-youtube-lyte]
Researcher
Affected Software
All-In-One Security (AIOS) – Security and Firewall [all-in-one-wp-security-and-firewall]
Researcher
Affected Software
Estatik Real Estate Plugin [estatik]
Researcher
Import and export users and customers <= 2.5.2 – Authenticated (Subscriber+) Privilege Escalation
6.3
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
File Manager Pro – Filester [filester]
FileOrganizer – WordPress File Manager [fileorganizer]
File Manager [wp-file-manager]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Asset CleanUp: Page Speed Booster [wp-asset-clean-up]
Researcher
Affected Software
Researcher
Affected Software
10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Blocksy Companion [blocksy-companion]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Captcha Code [captcha-code-authentication]
Researcher
Affected Software
Conekta Payment Gateway [conekta-payment-gateway]
Researcher
Affected Software
Customer Reviews for WooCommerce [customer-reviews-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Divi Dash [divi-dash]
Researcher
Affected Software
Easy Hide Login [easy-hide-login]
Researcher
Affected Software
Researcher
Affected Software
File Manager [wp-file-manager]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 – Unauthenticated User Impersonation
5.3
Affected Software
Researcher
Affected Software
Image Buzz [image-buzz]
Researcher
Affected Software
Mailchimp for WooCommerce [mailchimp-for-woocommerce]
Researcher
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.70 – Missing Authorization
5.3
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
Netgsm [netgsm]
Researcher
Affected Software
Newsletters [newsletters-lite]
Researcher
Affected Software
NP Quote Request for WooCommerce [woo-rfq-for-woocommerce]
Researcher
Affected Software
Online Booking & Scheduling Calendar by vcita [meeting-scheduler-by-vcita]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Optima Express IDX [optima-express]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
Researcher
Payment Plugins for PayPal WooCommerce <= 2.0.26 – Unauthenticated Insecure Direct Object Reference
5.3
Affected Software
Payment Plugins for PayPal WooCommerce [pymntpl-paypal-woocommerce]
Affected Software
Paymob for WooCommerce [paymob-for-woocommerce]
Researcher
Affected Software
Paymob for WooCommerce [paymob-for-woocommerce]
Researcher
Affected Software
PayPlus Payment Gateway [payplus-payment-gateway]
Researcher
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster [easy-sale-badges-for-woocommerce]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]
Researcher
Affected Software
Tangible: Loops & Logic [tangible-loops-and-logic]
Researcher
Affected Software
Team – Team Members Showcase Plugin [tlp-team]
Researcher
Affected Software
Team Members [tc-team-members]
Researcher
Affected Software
Testimonials Widget [testimonials-widget]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
TrustedLogin Connector [trustedlogin-connector]
Researcher
Affected Software
Researcher
Affected Software
Verge3D Publishing and E-Commerce [verge3d]
Researcher
Affected Software
Verge3D Publishing and E-Commerce [verge3d]
Affected Software
WP Verify API [wp-verify-api]
Researcher
Affected Software
Researcher
Affected Software
WPC Smart Compare for WooCommerce [woo-smart-compare]
Researcher
Affected Software
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
YITH Request a Quote for WooCommerce < 4.46.1 – Unauthenticated Insecure Direct Object Reference
5.3
Affected Software
YITH Request a Quote for WooCommerce [yith-woocommerce-request-a-quote]
Researcher
Affected Software
Admin Notices Manager [admin-notices-manager]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
Email Log [email-log]
Researcher
Affected Software
Estatik Real Estate Plugin [estatik]
Researcher
Affected Software
HashBar – Announcement, Notification Bar & Popup Campaign [hashbar-wp-notification-bar]
Researcher
Affected Software
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels [webappick-product-feed-for-woocommerce]
Researcher
Affected Software
Simple Discount Rules for Woocommerce [woo-product-category-discount]
Researcher
Affected Software
Researcher
Ultimeter – the Ultimate Progress and Goals Meter <= 3.0.8 – Authenticated (Editor+) SQL Injection
4.9
Affected Software
Researcher
Affected Software
W4 Post List [w4-post-list]
Researcher
Affected Software
Appointment Booking Plugin & Scheduling System – Webba Booking Calendar [webba-booking-lite]
Researcher
Affected Software
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification [wc-blacklist-manager]
Researcher
Affected Software
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification [wc-blacklist-manager]
Researcher
Affected Software
Blog2Social: Social Media Auto Post & Scheduler [blog2social]
Researcher
Affected Software
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Business Directory Plugin – Easy Listing & Member Directories for WordPress [business-directory-plugin]
Researcher
Affected Software
Custom Field Template [custom-field-template]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
Affected Software
Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
MailerLite – Signup forms (official) [official-mailerlite-sign-up-forms]
Researcher
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 – Missing Authorization
4.3
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 – Missing Authorization
4.3
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 – Missing Authorization
4.3
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP [ai-workflow-automation-ai-agent-hub]
Researcher
Affected Software
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP [ai-workflow-automation-ai-agent-hub]
Researcher
Affected Software
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP [ai-workflow-automation-ai-agent-hub]
Researcher
Affected Software
NextScripts: Social Networks Auto-Poster [social-networks-auto-poster-facebook-twitter-g]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Researcher
Affected Software
Paymob for WooCommerce [paymob-for-woocommerce]
Researcher
Affected Software
Points and Rewards for WooCommerce [points-and-rewards-for-woocommerce]
Researcher
Affected Software
PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced]
Researcher
Affected Software
Real3D Flipbook [real3d-flipbook]
Researcher
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
RW Elephant Rental Inventory [rw-elephant-rental-inventory]
Researcher
Affected Software
Safe SVG [safe-svg]
Researcher
Affected Software
Researcher
Affected Software
Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
UpdraftPlus: WP Backup & Migration Plugin [updraftplus]
Researcher
Affected Software
WC Fields Factory [wc-fields-factory]
Researcher
Affected Software
WC Fields Factory [wc-fields-factory]
Researcher
Affected Software
Researcher
Affected Software
WP-CRM System – Manage Clients and Projects [wp-crm-system]
Researcher
WPeMatico RSS Feed Fetcher <= 2.8.25 – Authenticated (Contributor+) Insecure Direct Object Reference
4.3
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
Affected Software
WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent [wsp-mcp-ai-agents-connector]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026) appeared first on Wordfence.
Puedes consultar el artículo original aquí: https://www.wordfence.com/blog/2026/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-21-2026-to-september-27-2026/