Wordfence: Protege tu WordPress con el informe de vulnerabilidades semanal
Este es un resumen del artículo. Si necesitas contexto adicional, aquí tienes el enlace original: https://www.wordfence.com/blog/2026/07/wordfence-intelligence-weekly-wordpress-vulnerability-report-july-20-2026-to-july-26-2026/
Last week, there were 223 vulnerabilities disclosed in 175 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 88 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 155 |
| Unpatched | 68 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 172 |
| High Severity | 42 |
| Critical Severity | 9 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 70 |
| Missing Authorization | 59 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 25 |
| Exposure of Sensitive Information to an Unauthorized Actor | 13 |
| Cross-Site Request Forgery (CSRF) | 11 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 8 |
| Server-Side Request Forgery (SSRF) | 7 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Authorization Bypass Through User-Controlled Key | 4 |
| Deserialization of Untrusted Data | 4 |
| Improper Authentication | 3 |
| Improper Control of Generation of Code ('Code Injection') | 3 |
| Improper Privilege Management | 3 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 2 |
| Improper Input Validation | 2 |
| Incorrect Privilege Assignment | 2 |
| Incorrect Authorization | 1 |
| Relative Path Traversal | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 49 | |
| 28 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Abandoned Cart Lite for WooCommerce | woocommerce-abandoned-cart |
| Accept Donations with PayPal & Stripe | easy-paypal-donation |
| Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… | acf-views |
| AffiliateWP | affiliate-wp |
| AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking | affiliatex |
| AI Copilot – Content Generator | ai-copilot-content-generator |
| Appointment Hour Booking – Booking Calendar | appointment-hour-booking |
| ARforms | arforms |
| Avada Core | fusion-core |
| Avada Custom Branding | fusion-white-label-branding |
| AWP Classifieds | another-wordpress-classifieds-plugin |
| BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot | betterdocs |
| Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | booking-and-rental-manager-for-woocommerce |
| Brands for WooCommerce | brands-for-woocommerce |
| Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP | videowhisper-live-streaming-integration |
| BSK PDF Manager | bsk-pdf-manager |
| Bulk Page Generator – LPagery | lpagery |
| Byteflows Travel & Hotel Booking | byteflows-travel-hotel-booking |
| Checkout Field Editor for WooCommerce (Pro) | woocommerce-checkout-field-editor-pro |
| Civi Framework | civi-framework |
| CoCart – Headless REST API for WooCommerce | cart-rest-api-for-woocommerce |
| Complianz – GDPR/CCPA Cookie Consent | complianz-gdpr |
| Contact Form 7 – Dynamic Text Extension | contact-form-7-dynamic-text-extension |
| Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More | content-control |
| Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates | cozy-addons |
| Create | mediavine-create |
| Custom links in Elementor Image Carousel | custom-links-in-elementor-image-carousel |
| Customer Support Ticket System & Helpdesk | wp-ticket |
| Cyr to Lat Reloaded – Transliteration of Links and File Names | cyr-and-lat |
| Directory Listings WordPress plugin – uListing | ulisting |
| Ditty – Responsive News Tickers, Sliders, and Lists | ditty-news-ticker |
| Dokan Pro | dokan-pro |
| Dynamic Pricing With Discount Rules for WooCommerce | aco-woo-dynamic-pricing |
| Easy Appointments | easy-appointments |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| Easy Form Builder by WhiteStudio – Drag & Drop Form Builder | easy-form-builder |
| Ebook Store | ebook-store |
| Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance | accessibility-checker |
| eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eroom-zoom-meetings-webinar |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Post | event-post |
| Event Tickets and Registration | event-tickets |
| EventON Action User | eventon-action-user |
| Events Made Easy | events-made-easy |
| Falcon – WordPress Optimizations & Tweaks | falcon |
| Firelight Lightbox | easy-fancybox |
| Flipbook PDF Viewer & Embedder | pdf-embed-viewer |
| Fluent Forms Pro Add On Pack | fluentformpro |
| Fluent Support – Helpdesk & Customer Support Ticket System | fluent-support |
| FormCraft | formcraft3 |
| GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress | gamipress |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more | godam |
| Graphina – Charts and Graphs For Elementor | graphina-elementor-charts-and-graphs |
| Grid/List View for WooCommerce | gridlist-view-for-woocommerce |
| GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | gutenkit-blocks-addon |
| HashThemes Demo Importer | hashthemes-demo-importer |
| Header Footer Script Adder | header-and-footer-script-adder |
| Hubbub Lite – Fast, free social sharing and follow buttons | social-pug |
| JetBooking | jet-booking |
| JetElements | jet-elements |
| JetEngine | jet-engine |
| Kali Forms — Contact Form & Drag-and-Drop Builder | kali-forms |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages | convertkit |
| Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | knit-pay |
| Kwayy HTML Sitemap | kwayy-html-sitemap |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| License Manager for WooCommerce | license-manager-for-woocommerce |
| LIQUID SPEECH BALLOON | liquid-speech-balloon |
| ListingPro Plugin | listingpro-plugin |
| Machete | machete |
| MailPoet – Newsletters, Email Marketing, and Automation | mailpoet |
| Mailster WordPress Newsletter Plugin | mailster |
| MapPress – Google Maps, OpenStreetMap & Leaflet | mappress-google-maps-for-wordpress |
| MapSVG | mapsvg |
| MapSVG – Vector maps, Image maps, Google Maps | mapsvg-lite-interactive-vector-maps |
| MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | marketking-multivendor-marketplace-for-woocommerce |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MDJM Event Management | mobile-dj-manager |
| Mediavine Control Panel | mediavine-control-panel |
| miniOrange Discord Integration | miniorange-discord-integration |
| miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon | miniorange-login-openid |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| MountDev AI MCP Connector for WordPress | mountdev-ai-mcp-connector |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder | the-plus-addons-for-block-editor |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| Ninja Tables – Easy Data Table Builder | ninja-tables |
| Open User Map – Interactive Leaflet Maps | open-user-map |
| Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | themeisle-companion |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Participants Database | participants-database |
| Payment Gateway for PayPal on WooCommerce | woo-paypal-gateway |
| Payment Plugins for Stripe WooCommerce | woo-stripe-payment |
| PayU India | payu-india |
| PeproDev Ultimate Invoice | pepro-ultimate-invoice |
| Photo Block – A Modern Image Block With Lightbox and Caption Support | photo-block |
| Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery | gt3-photo-video-gallery |
| Photo Gallery – Responsive Image Galleries by Supsystic | gallery-by-supsystic |
| Picture Gallery – Frontend Image Uploads, AJAX Photo List | picture-gallery |
| PiWeb Product Enquiry or product catalog for WooCommerce | enquiry-quotation-for-woocommerce |
| Polylang | polylang |
| Popup for CF7 with Sweet Alert | cf7-sweet-alert-popup |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Post My CF7 Form | post-my-contact-form-7 |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Product Designer for WooCommerce WordPress | Lumise | lumise |
| Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces | best-woocommerce-feed |
| Product Slider, Product Grid, Product Masonry | woocommerce-products-slider |
| Qubely – Advanced Gutenberg Blocks | qubely |
| Query Wrangler | query-wrangler |
| QuickCal | quickcal |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Real Estate Manager Pro | real-estate-manager-pro |
| Really Simple CSV Importer | really-simple-csv-importer |
| Registrations for the Events Calendar – Event Registration Plugin | registrations-for-the-events-calendar |
| Relevanssi Light | relevanssi-light |
| reviewer | reviewer |
| Rich Showcase for Google Reviews | widget-google-reviews |
| rtMedia for WordPress, BuddyPress and bbPress | buddypress-media |
| SAML Single Sign On – SSO Login | miniorange-saml-20-single-sign-on |
| Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce | sender-net-automated-emails |
| Shiptastic for WooCommerce | shiptastic-for-woocommerce |
| ShipTime: Discount Shipping | shiptime-discount-shipping |
| Slider Pro | sliderpro |
| Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management | smart-manager-for-wp-e-commerce |
| Smart SEO Tool – SEO优化插件 | smart-seo-tool |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Spectra Legacy – Gutenberg Blocks | ultimate-addons-for-gutenberg |
| Style Kits for Elementor | analogwp-templates |
| SUMO Reward Points for WooCommerce | rewardsystem |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| SureDash – Community, Courses & Member Dashboard | suredash |
| Tabs Responsive – With WooCommerce Product Tabs Extension | tabs-responsive |
| TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder | templatespare |
| Thrive Quiz Builder | thrive-quiz-builder |
| Thrive Themes – Product Manager | thrive-product-manager |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| TinyMCE Templates | tinymce-templates |
| Tonda Core | tonda-core |
| Tutor LMS Elementor Addons | tutor-lms-elementor-addons |
| Ultimate Addons for Elementor | header-footer-elementor |
| Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor | ultimate-store-kit |
| Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | uncanny-automator |
| Video Player for YouTube – embed videos your visitors will love to watch | yt-player |
| VikBooking Hotel Booking Engine & PMS | vikbooking |
| Virtue/Ascend/Pinnacle Toolkit | virtue-toolkit |
| Visual Composer Website Builder | visualcomposer |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| WCPOS – Point of Sale (POS) plugin for WooCommerce | woocommerce-pos |
| Web Push Notifications – Webpushr | webpushr-web-push-notifications |
| WP Accessibility Helper (WAH) | wp-accessibility-helper |
| WP Activity Log | wp-security-audit-log |
| WP BASE Booking of Appointments, Services and Events | wp-base-booking-of-appointments-services-and-events |
| WP Easy Pay – Payment and Donation Form Builder for Square | wp-easy-pay |
| WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security | wp-letsencrypt-ssl |
| WP Fast Total Search – The Power of Indexed Search | fulltext-search |
| WP Foodbakery | wp-foodbakery |
| WP Ghost (Hide My WP Ghost) – Security & Firewall | hide-my-wp |
| WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | wp-google-maps |
| WP Hotel Booking | wp-hotel-booking |
| WP Shortcode by MyThemeShop | wp-shortcode |
| WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets | wp-social-reviews |
| WP-Polls | wp-polls |
| WPForms Pro | wpforms |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce | wpify-woo |
| WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | wpo365-login |
| Yoast SEO – Advanced SEO with real-time guidance and built-in AI | wordpress-seo |
| Ziina | ziina |
| ЮKassa для WooCommerce | yookassa |
| افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری | persian-woocommerce-shipping |
| افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce) | zarinpal-woocommerce-payment-gateway |
| افزونه پیامک ووکامرس Persian WooCommerce SMS | persian-woocommerce-sms |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Civi – Job Board & Freelance Marketplace WordPress Theme | civi |
| Grand Photography WordPress | grandphotography |
| Manual – Documentation, Knowledge Base & Education WordPress Theme | manual |
| photography | photography |
| TheGem | thegem |
| Vino – A Refined Winery, Wine Bar and Vineyard WordPress Theme | vino |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Customer Support Ticket System & Helpdesk [wp-ticket]
Researcher
Affected Software
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]
Researcher
Affected Software
Researcher
Affected Software
MountDev AI MCP Connector for WordPress [mountdev-ai-mcp-connector]
Researcher
Affected Software
SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]
Researcher
Affected Software
Researcher
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
Affected Software
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Affected Software
MDJM Event Management [mobile-dj-manager]
Researcher
Affected Software
Researcher
Affected Software
Easy Appointments [easy-appointments]
Researcher
Affected Software
Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]
Researcher
Affected Software
Picture Gallery – Frontend Image Uploads, AJAX Photo List [picture-gallery]
Researcher
Affected Software
Thrive Quiz Builder [thrive-quiz-builder]
Researcher
Affected Software
WP Foodbakery [wp-foodbakery]
Researcher
Affected Software
WPForms Pro [wpforms]
Researcher
Affected Software
Researcher
Affected Software
AWP Classifieds [another-wordpress-classifieds-plugin]
Researcher
Affected Software
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
MapSVG [mapsvg]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Researcher
Affected Software
Relevanssi Light [relevanssi-light]
Researcher
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Affected Software
Tonda Core [tonda-core]
Researcher
Affected Software
Researcher
Affected Software
EventON Action User [eventon-action-user]
Researcher
Affected Software
Flipbook PDF Viewer & Embedder [pdf-embed-viewer]
Researcher
Affected Software
Researcher
Affected Software
ARforms [arforms]
Researcher
Affected Software
Dynamic Pricing With Discount Rules for WooCommerce [aco-woo-dynamic-pricing]
Researcher
Affected Software
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]
Researcher
FormCraft <= 3.9.14 – Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters
7.2
Affected Software
FormCraft [formcraft3]
Researcher
Affected Software
JetBooking [jet-booking]
Researcher
Affected Software
Mailster WordPress Newsletter Plugin [mailster]
Researcher
Affected Software
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
PeproDev Ultimate Invoice [pepro-ultimate-invoice]
Researcher
Affected Software
PeproDev Ultimate Invoice [pepro-ultimate-invoice]
Researcher
Affected Software
PiWeb Product Enquiry or product catalog for WooCommerce [enquiry-quotation-for-woocommerce]
Researcher
Affected Software
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces [best-woocommerce-feed]
Researcher
Affected Software
Really Simple CSV Importer [really-simple-csv-importer]
Researcher
Affected Software
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management [smart-manager-for-wp-e-commerce]
Researcher
Affected Software
SUMO Reward Points for WooCommerce [rewardsystem]
Researcher
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 – Authenticated (Administrator+) PHP Object Injection
6.6
Affected Software
Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr]
Researcher
Affected Software
AI Copilot – Content Generator [ai-copilot-content-generator]
Researcher
Affected Software
Checkout Field Editor for WooCommerce (Pro) [woocommerce-checkout-field-editor-pro]
Researcher
Contact Form 7 – Dynamic Text Extension <= 5.0.6 – Unauthenticated Arbitrary Shortcode Execution
6.5
Affected Software
Contact Form 7 – Dynamic Text Extension [contact-form-7-dynamic-text-extension]
Researcher
Affected Software
Create [mediavine-create]
Researcher
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 – Authenticated (Contributor+) SQL Injection
6.5
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
MapSVG [mapsvg]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Registrations for the Events Calendar – Event Registration Plugin [registrations-for-the-events-calendar]
Researcher
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 – Authenticated (Subscriber+) SQL Injection
6.5
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Tickera <= 3.6.0.1 – Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
6.5
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Affected Software
Researcher
Affected Software
WCPOS – Point of Sale (POS) plugin for WooCommerce [woocommerce-pos]
Researcher
Affected Software
Accept Donations with PayPal & Stripe [easy-paypal-donation]
Researcher
Affected Software
Appointment Hour Booking – Booking Calendar [appointment-hour-booking]
Researcher
Affected Software
Researcher
Affected Software
Brands for WooCommerce [brands-for-woocommerce]
Researcher
Affected Software
Brands for WooCommerce [brands-for-woocommerce]
Researcher
Affected Software
BSK PDF Manager [bsk-pdf-manager]
Researcher
Affected Software
Bulk Page Generator – LPagery [lpagery]
Researcher
Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 – Authenticated (Author+) Server-Side Request Forgery
6.4
Affected Software
Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Custom links in Elementor Image Carousel [custom-links-in-elementor-image-carousel]
Researcher
Affected Software
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance [accessibility-checker]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Firelight Lightbox [easy-fancybox]
Researcher
Affected Software
Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]
Researcher
Affected Software
Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]
Researcher
Affected Software
Grid/List View for WooCommerce [gridlist-view-for-woocommerce]
Researcher
Affected Software
HashThemes Demo Importer [hashthemes-demo-importer]
Researcher
Affected Software
Header Footer Script Adder [header-and-footer-script-adder]
Researcher
Affected Software
Researcher
Affected Software
JetElements [jet-elements]
Researcher
Affected Software
JetEngine [jet-engine]
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
Affected Software
LIQUID SPEECH BALLOON [liquid-speech-balloon]
Researcher
Affected Software
Machete [machete]
Researcher
Affected Software
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon [miniorange-login-openid]
Researcher
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Affected Software
Open User Map – Interactive Leaflet Maps [open-user-map]
Researcher
Affected Software
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion]
Researcher
Affected Software
Researcher
Affected Software
Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery [gt3-photo-video-gallery]
Researcher
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
Rich Showcase for Google Reviews [widget-google-reviews]
Researcher
Affected Software
Slider Pro [sliderpro]
Researcher
Affected Software
Smart SEO Tool – SEO优化插件 [smart-seo-tool]
Researcher
Affected Software
Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]
Researcher
Affected Software
Researcher
Affected Software
TheGem [thegem]
Researcher
Affected Software
Ultimate Addons for Elementor [header-footer-elementor]
Researcher
Affected Software
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit]
Researcher
Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 – Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Virtue/Ascend/Pinnacle Toolkit [virtue-toolkit]
Researcher
Affected Software
Researcher
Affected Software
Web Push Notifications – Webpushr [webpushr-web-push-notifications]
Researcher
Affected Software
WP Hotel Booking [wp-hotel-booking]
Researcher
Affected Software
WP Shortcode by MyThemeShop [wp-shortcode]
Researcher
Yoast SEO <= 28.0 – Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
6.4
Affected Software
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
AffiliateWP [affiliate-wp]
Researcher
Affected Software
Grand Photography WordPress [grandphotography]
Researcher
Affected Software
Real Estate Manager Pro [real-estate-manager-pro]
Researcher
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
Affected Software
AWP Classifieds [another-wordpress-classifieds-plugin]
Researcher
Affected Software
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment [booking-and-rental-manager-for-woocommerce]
Researcher
Affected Software
Byteflows Travel & Hotel Booking [byteflows-travel-hotel-booking]
Researcher
Affected Software
Researcher
Affected Software
Civi Framework [civi-framework]
Researcher
Affected Software
CoCart – Headless REST API for WooCommerce [cart-rest-api-for-woocommerce]
Researcher
Affected Software
Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr]
Researcher
Affected Software
Researcher
Affected Software
Create [mediavine-create]
Researcher
Affected Software
Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Event Post [event-post]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Events Made Easy [events-made-easy]
Researcher
Affected Software
Researcher
Affected Software
Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]
Researcher
Affected Software
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]
Researcher
Affected Software
JetBooking [jet-booking]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
Affected Software
Researcher
MapPress – Google Maps, OpenStreetMap & Leaflet <= 2.97.6 – Unauthenticated Information Exposure
5.3
Affected Software
MapPress – Google Maps, OpenStreetMap & Leaflet [mappress-google-maps-for-wordpress]
Researcher
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.40 – Missing Authorization
5.3
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
Affected Software
miniOrange Discord Integration [miniorange-discord-integration]
Researcher
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.12 – Missing Authorization
5.3
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
Ninja Tables – Easy Data Table Builder [ninja-tables]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Payment Gateway for PayPal on WooCommerce [woo-paypal-gateway]
Researcher
Affected Software
Payment Plugins for Stripe WooCommerce [woo-stripe-payment]
Researcher
Affected Software
Payment Plugins for Stripe WooCommerce [woo-stripe-payment]
Researcher
Affected Software
PayU India [payu-india]
Researcher
Affected Software
PeproDev Ultimate Invoice [pepro-ultimate-invoice]
Researcher
Affected Software
PeproDev Ultimate Invoice [pepro-ultimate-invoice]
Researcher
Affected Software
photography [photography]
Researcher
Affected Software
Post My CF7 Form [post-my-contact-form-7]
Researcher
Affected Software
Qubely – Advanced Gutenberg Blocks [qubely]
Researcher
Affected Software
Shiptastic for WooCommerce [shiptastic-for-woocommerce]
Researcher
Affected Software
Thrive Themes – Product Manager [thrive-product-manager]
Researcher
Affected Software
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit]
Researcher
Affected Software
WP Fast Total Search – The Power of Indexed Search [fulltext-search]
Researcher
Affected Software
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]
Researcher
Affected Software
WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets [wp-social-reviews]
Researcher
Affected Software
Researcher
Ninja Forms <= 3.14.9 – Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
4.9
Affected Software
Researcher
Affected Software
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce [sender-net-automated-emails]
Researcher
Affected Software
Researcher
Affected Software
Researcher
افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.2.2 – Authenticated (Shop manager+) SQL Injection
4.9
Affected Software
افزونه پیامک ووکامرس Persian WooCommerce SMS [persian-woocommerce-sms]
Researcher
Affected Software
Abandoned Cart Lite for WooCommerce [woocommerce-abandoned-cart]
Researcher
Affected Software
Brands for WooCommerce [brands-for-woocommerce]
Researcher
Affected Software
Photo Gallery – Responsive Image Galleries by Supsystic [gallery-by-supsystic]
Researcher
Affected Software
Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]
Researcher
Affected Software
Researcher
Affected Software
WP-Polls [wp-polls]
Researcher
Affected Software
Researcher
Affected Software
Avada Core [fusion-core]
Researcher
Affected Software
Avada Custom Branding [fusion-white-label-branding]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Affected Software
Researcher
Affected Software
Kwayy HTML Sitemap [kwayy-html-sitemap]
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
License Manager for WooCommerce <= 3.0.17 – Authenticated (Customer+) Arbitrary Content Deletion
4.3
Affected Software
License Manager for WooCommerce [license-manager-for-woocommerce]
Researcher
Affected Software
ListingPro Plugin [listingpro-plugin]
Researcher
MailPoet – Newsletters, Email Marketing, and Automation 5.30.0-5.33.0 – Cross-Site Request Forgery
4.3
Affected Software
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Mediavine Control Panel [mediavine-control-panel]
Researcher
Affected Software
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder [the-plus-addons-for-block-editor]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Polylang [polylang]
Researcher
Affected Software
Popup for CF7 with Sweet Alert [cf7-sweet-alert-popup]
Researcher
Affected Software
Product Slider, Product Grid, Product Masonry [woocommerce-products-slider]
Researcher
Affected Software
Query Wrangler [query-wrangler]
Researcher
Affected Software
ShipTime: Discount Shipping [shiptime-discount-shipping]
Researcher
Affected Software
Style Kits for Elementor [analogwp-templates]
Researcher
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
Researcher
Affected Software
TinyMCE Templates [tinymce-templates]
Researcher
Affected Software
Tutor LMS Elementor Addons [tutor-lms-elementor-addons]
Researcher
Affected Software
Visual Composer Website Builder [visualcomposer]
Researcher
Affected Software
WP Accessibility Helper (WAH) [wp-accessibility-helper]
Researcher
Affected Software
WP Activity Log [wp-security-audit-log]
Researcher
Affected Software
Researcher
Affected Software
WP Ghost (Hide My WP Ghost) – Security & Firewall [hide-my-wp]
Researcher
Affected Software
ЮKassa для WooCommerce [yookassa]
Researcher
Affected Software
افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce) [zarinpal-woocommerce-payment-gateway]
Researcher
افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری <= 4.4.5 – Cross-Site Request Forgery
4.3
Affected Software
افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری [persian-woocommerce-shipping]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026) appeared first on Wordfence.
Puedes consultar el artículo original aquí: https://www.wordfence.com/blog/2026/07/wordfence-intelligence-weekly-wordpress-vulnerability-report-july-20-2026-to-july-26-2026/