Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)

Last week, there were 268 vulnerabilities disclosed in 182 WordPress Plugins and 15 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 124 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface , vulnerability API , and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free .

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium , Care , and Response customers last week:

UpdraftPlus <= 1.26.11 – UDRPC key compromise

UpdraftPlus <= 1.26.11 – UDRPC key compromise

Wordfence Premium , Care , and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Total Vulnerabilities by CVSS Severity Last Week

Total Vulnerabilities by CWE Type Last Week

Researchers That Contributed to WordPress Security Last Week

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program . Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

WordPress Themes with Reported Vulnerabilities Last Week

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration , which is completely free to utilize.

Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Remote Code Execution

Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Privilege Escalation via Account Takeover

Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded during Migration -and-Replace

WP Mailster <= 1.9.1.0 - Unauthenticated Arbitrary File Upload

YOOtheme Pro 5.0.0 - 5.0.52 - Unauthenticated Arbitrary File Upload

Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary File Deletion

weForms – Easy Drag & Drop Form Builder For WordPress <= 1.6.28 - Unauthenticated Arbitrary File Deletion

aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute

CM HIPAA Forms <= 3.3.1 - Authenticated (hipaa_forms+) Privilege Escalation

Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1068 - Authenticated (Contributor+) Remote Code Execution

Uncanny Toolkit for LearnDash < 3.8.2 - Cross-Site Request Forgery

Academist Core <= 1.4.1 - Unauthenticated Local File Inclusion

Hallelujah <= 1.1.1 - Unauthenticated PHP Object Injection

Helion | Personal Portfolio & Agency WordPress Theme <= 1.1.12 - Unauthenticated PHP Object Injection

Holistic Center <= 1.2.6 - Unauthenticated PHP Object Injection

Hostme v2 - Responsive WordPress Theme <= 7.0 - Unauthenticated PHP Object Injection

HotLock | Locksmith & Security Systems WordPress Theme + RTL <= 1.3.9 - Unauthenticated PHP Object Injection

Little Birdies | Multipurpose Children PSD Template <= 1.3.16 - Unauthenticated PHP Object Injection

Newsletters <= 4.18.1 - Unauthenticated PHP Object Injection

Participants Database <= 2.7.8.5 - Unauthenticated PHP Object Injection

Paytium: Mollie payment forms & donations <= 5.0.5 - Unauthenticated PHP Object Injection

Redy <= 1.3.5 - Unauthenticated PHP Object Injection

Reprizo - Jewelry & Watch Store Shopify Theme <= 1.0.8 - Unauthenticated PHP Object Injection

Rhodos - Business Portfolio Elementor Blocks & Template Kit <= 1.3.3 - Unauthenticated PHP Object Injection

Rootblox – Header & Footer Builder for Full Site Editing (FSE) <= 1.0.6 - Unauthenticated Local File Inclusion

Save Life | Non-Profit, Charity & Donations WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection

Vagabonds - Travel Blog Elementor Template Kit <= 1.3.10 - Unauthenticated PHP Object Injection

Your Dress <= 1.4.1 - Unauthenticated Local File Inclusion

ZenSoul <= 1.13 - Unauthenticated PHP Object Injection

Ajax Lite – Live & Filter <= 4.14.6 - Unauthenticated SQL Injection

Booking for Appointments and Events Calendar – Amelia <= 2.4.11 - Unauthenticated SQL Injection

Click n Chat <= 1.1.2 - Unauthenticated SQL Injection

Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQL Injection

Formidable Forms – Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder < 7.0 - Unauthenticated Denial of Service

GS Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets <= 1.9.2 - Authenticated (Contributor+) PHP Object Injection

Newsletters <= 4.18.1 - Unauthenticated SQL Injection

Participants Database <= 2.7.8.5 - Unauthenticated SQL Injection

Product Filter for WooCommerce by WBW <= 3.4.6 - Unauthenticated SQL Injection

Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP < 1.5.7 - Authentication Bypass

Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More <= 2.8.2 - Authenticated (Contributor+) PHP Object Injection

WP Mailster <= 1.9.1.0 - Authenticated (Contributor+) Local File Inclusion

Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Arbitrary Non-Admin Account Takeover

Datawiza Proxy Auth <= 1.1.0 - Unauthenticated Privilege Escalation

User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation

Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Stored Cross-Site Scripting

Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting

Form Email <= 1.3.68 - Unauthenticated Stored Cross-Site Scripting

Depicter — Popup & Slider Builder 4.0.5 - 4.8.1 - Authenticated (Editor+) Arbitrary File Upload

Duplicator <= 1.5.17 - Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Unauthenticated Stored Cross-Site Scripting

GeoDirectory <= 2.8.193 - Authenticated (Administrator+) Remote Code Execution

Hostme v2 - Responsive WordPress Theme <= 7.0 - Unauthenticated Stored Cross-Site Scripting

Jane <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting

KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme <= 4.25.0 - Unauthenticated Stored Cross-Site Scripting

LiteSpeed Cache < 7.9.2 - Unauthenticated Stored Cross-Site Scripting

LiteSpeed Cache < 7.9.2 - Unauthenticated Stored Cross-Site Scripting

Ninja Forms – Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Unauthenticated Stored Cross-Site Scripting

PixelYourSite (Pro + Free) – Your smart PIXEL (TAG) Manager (plugin) < 11.4.3 - Unauthenticated Stored Cross-Site Scripting

QA Assistants – Driven by data <= 5.3.0.1 - Unauthenticated Stored Cross-Site Scripting

Redirection for Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored Cross-Site Scripting

Strong Testimonials <= 3.3.12 - Unauthenticated Stored Cross-Site Scripting

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Stored Cross-Site Scripting

VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting

VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting

VOD Infomaniak <= 1.5.14 - Unauthenticated Stored Cross-Site Scripting

W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting

WebP Express <= 0.25.15 - Unauthenticated Stored Cross-Site Scripting

Weglot <= 6.4.2 - Unauthenticated Stored Cross-Site Scripting

WP Mailster <= 1.9.1.0 - Unauthenticated Stored Cross-Site Scripting

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute

Relevanssi – A Better <= 4.28.4 - Authenticated (Editor+) PHP Object Injection

Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution

GiveWP <= 4.19.0.0 - Authenticated (Give Manager+) Path Traversal

Swift Performance Lite <= 2.3.7.3 - Authenticated (Author+) SQL Injection

Ultimate Review <= 2.4.4 - Unauthenticated Arbitrary Shortcode Execution

Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution < 6.0.0 - Authenticated (Custom Role+) Stored Cross-Site Scripting

Brizy – Page Builder 2.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

E2Pdf – Export Pdf Tool for WordPress <= 1.32.57 - Authenticated (Contributor+) Stored Cross-Site Scripting

Elementor <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting

Elementor <= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 - Authenticated (Author+) Stored Cross-Site Scripting

Extensions for Leaflet Map <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting

GiveWP <= 4.19.0.0 - Authenticated (Give Worker+) Stored Cross-Site Scripting

Interactive Content – H5P <= 1.17.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

JetElements <= 2.9.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Job Openings <= 4.1.0 - Authenticated (Author+) Stored Cross-Site Scripting

Link Library <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

ND Shortcodes <= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Photo Engine <= 6.5.7 - Authenticated (Author+) Stored Cross-Site Scripting

Pixel Tag Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Restaurant – Food Ordering System – Table Reservation <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Rootblox – Header & Footer Builder for Full Site Editing (FSE) <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

VR 8.5.49 - 9.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

YITH WooCommerce Wishlist <= 4.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

HIPAA Forms < 3.3.2 - Authenticated (Custom Role+) Privilege Escalation

Qi Addons For Elementor <= 1.11.1 - Authenticated (Contributor+) Arbitrary HTML Injection

Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website < 3.3.3 - Authenticated (Custom Role+) Privilege Escalation

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.4 - Authenticated (Author+) Privilege Escalation

Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 - Reflected Cross-Site Scripting

Booking System <= 2.1.0.2 - Reflected Cross-Site Scripting

Download Monitor <= 5.3.3 - Reflected Cross-Site Scripting

Eventer - WordPress Event & Booking Manager Plugin <= 0.1.1 - Reflected Cross-Site Scripting

Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Reflected Cross-Site Scripting

Geo Mashup <= 1.13.22 - Reflected Cross-Site Scripting

Live Summary for Gravity Forms <= 1.2.10 - Reflected Cross-Site Scripting

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.14 - Reflected Cross-Site Scripting

Profile Builder <= 4.0.0 - Reflected Cross-Site Scripting

ThemeHunk Customizer <= 2.8.7 - Reflected Cross-Site Scripting

We’re Open! <= 2.6 - Reflected Cross-Site Scripting

Happyforms – Form Builder for WordPress: Drag & Drop Forms, Surveys, Payments & Multipurpose Forms < 1.26.15 - Unauthenticated HTML Injection

Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization

asVereinbase <= 1.1.7 - Two-Factor Authentication Bypass

BjornTech Swish for WooCommerce <= 3.7.8 - Missing Authorization

Booking Package < 1.7.31 - Unauthenticated Information Exposure

Booking Package <= 1.7.30 - Missing Authorization

Booking Package <= 1.7.30 - Unauthenticated Information Exposure

Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 - Missing Authorization

Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.7 - Missing Authorization

Bus Ticket Booking with Seat Reservation <= 5.9.7 - Missing Authorization

Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails < 2.2.0 - Unauthenticated Abandoned Cart Takeover

CCAvenue Payment Gateway for WooCommerce <= 3.1 - Missing Authorization

Chikkili Google Pay for WooCommerce <= 1.0.6 - Missing Authorization

Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Information Exposure

CMP – Coming Soon & Maintenance Plugin by NiteoThemes 4.1.19 - 4.1.20 - Missing Authorization to Unauthenticated Maintenance Mode Bypass

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe < 34.0.1 - Missing Authorization

Ettrick Escape Room Booking <= 1.3.0 - Missing Authorization

Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.7.8 - Missing Authorization

Falcon – Cache, Performance, Security, Cleanup, and Tweaks <= 2.12.0 - Missing Authorization

Fluent Forms – Customizable Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.15 - Missing Authorization

FluentCart <= 2.1.0 - Unauthenticated Insecure Direct Object Reference

Front End Users <= 3.2.35 - Missing Authorization

GeoDirectory <= 2.8.193 - Missing Authorization

GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure

GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure

GiveWP <= 4.19.0.0 - Unauthenticated Donation Amount Restriction Bypass

GiveWP <= 4.19.0.0 - Unauthenticated Information Exposure

iKhokha Payment Gateway <= 3.0.3 - Unauthenticated Payment Bypass

Infility Global <= 2.16.24 - Missing Authorization

Kliken: Ads + Pixel for Meta <= 1.2.2 - Unauthenticated Insecure Direct Object Reference

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.6.3.0 - Missing Authorization

LatePoint <= 5.7.4 - Unauthenticated Payment Bypass

LiteSpeed Cache <= 7.9 - Unauthenticated Information Exposure

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.1 - Missing Authorization

MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Missing Authorization

MetForm – Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.2 - Missing Authorization

Mintpay <= 2.2.3 - Missing Authorization

nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Bypass

OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Bypass

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Missing Authorization

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 3.1.1 - 3.2.7 - Missing Authorization

Page and Post Restriction <= 1.6.0 - Missing Authorization

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.2 - Missing Authorization

PayDunya WooCommerce Payment Gateway <= 1.1.6 - Unauthenticated Payment Bypass

Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Bypass

Payment Gateway for Idram < 2.1.6 - Unauthenticated Arbitrary Order Status Manipulation

Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Forgery

Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Bypass

Popup Builder – Create highly converting, mobile friendly marketing popups. < 4.4.6 - Missing Authorization

Seriously Simple Podcasting <= 3.17.0 - Missing Authorization

ShopMagic – email automation for WordPress <= 4.9.1 - Unauthenticated Information Exposure

Simple Shopping Cart <= 5.3.2 - Unauthenticated Payment Bypass

SmartyParcel <= 1.23.3 - Unauthenticated Insecure Direct Object Reference

Snap Finance <= 3.12.0 - Unauthenticated Payment Forgery

Social Feed Gallery <= 5.0.13 - Missing Authorization

Stripe Checkout <= 1.2.2.61 - Unauthenticated Payment Bypass

SUMIT Payment Gateway for WooCommerce < 4.0.0 - Missing Authorization

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.5 - Missing Authorization

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Missing Authorization

SureCart <= 4.9.4 - Unauthenticated Information Exposure

SureDash – Community, Courses & Member Dashboard <= 1.12.2 - Missing Authorization

SureDash – Community, Courses & Member Dashboard <= 1.12.2 - Missing Authorization

Synchrony Financing 1.0.5 - 1.1.1 - Missing Authorization

TI WooCommerce Wishlist <= 2.12.0 - Missing Authorization

TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery

Travelly – Tour & Travel Booking Manager for WooCommerce <= 2.3.5 - Missing Authorization

UPI QR Code Payment Gateway for WooCommerce <= 1.6.3 - Missing Authorization

Wava Payment 0.3.1 - 0.3.9 - Missing Authorization

Wava Payment 0.3.1 - 0.3.9 - Missing Authorization

WholesaleX – All-in-One B2B Solution with Wholesale Pricing < 3.0.9 - Unauthenticated Account Activation Bypass

WholesaleX <= 3.0.8 - Unauthenticated Information Exposure

WPMobile.App – Android and iOS App Builder <= 11.86 - Missing Authorization

YITH WooCommerce Product Bundles <= 2.29.0 - Missing Authorization

ЮKassa для WooCommerce <= 2.17.3 - Missing Authorization

JetBackup – Backup, Restore & Migrate <= 3.1.24.9 - Authenticated (Admin+) Arbitrary File Write

Form by Supsystic <= 1.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Speed Optimizer – The All-In-One Performance-Boosting Plugin < 7.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

Advanced Twenty Seventeen <= 1.3.1 - Missing Authorization

Backup and Staging by WP Time Capsule <= 1.22.27 - Missing Authorization

Car Rental Manager – Online Vehicle Booking System <= 1.5.3 - Missing Authorization

Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery

Easy Pricing Tables <= 4.1.2 - Authenticated (Contributor+) Insecure Direct Object Reference

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization

Event Tickets and Registration <= 5.30.1 - Authenticated (Contributor+) Insecure Direct Object Reference

FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.11.0 - Missing Authorization

GiveWP <= 4.19.0.0 - Missing Authorization

GiveWP <= 4.19.0.0 - Missing Authorization

InstaWP Connect <= 0.1.4.1 - Missing Authorization

Interactive Content – H5P <= 1.17.9 - Authenticated (Contributor+) Insecure Direct Object Reference

LatePoint <= 5.7.4 - Authenticated (Agent+) Insecure Direct Object Reference

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.10 - Authenticated (Custom+) Insecure Direct Object Reference

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization

LiteSpeed Cache < 7.9.2 - Missing Authorization

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.72 - Missing Authorization

MAS Videos <= 1.3.4 - Missing Authorization

MasterStudy LMS WordPress Plugin – for Online Courses and Education 3.7.13 - 3.7.54 - Missing Authorization

MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Missing Authorization

Meta Box – A Framework for Dynamic Websites <= 5.15.2 - Missing Authorization

miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.9 - 6.3.0 - Two-Factor Authentication Bypass

Moloni <= 5.0.13 - Missing Authorization

News Kit Addons For Elementor <= 1.4.7 - Missing Authorization

News Kit Addons For Elementor <= 1.4.8 - Missing Authorization

Participants Database <= 2.7.8.5 - Authenticated (Contributor+) Insecure Direct Object Reference

Photo Engine <= 6.5.7 - Authenticated (Author+) Insecure Direct Object Reference

PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.0 - Missing Authorization

Productive Commerce <= 1.1.48 - Missing Authorization

SchedulePress – Auto Post & Publish, Auto Social , Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher < 5.3.5 - Missing Authorization

Sensei LMS – Online Courses, Quizzes, & Learning <= 4.26.3 - Missing Authorization

Sensei LMS – Online Courses, Quizzes, & Learning <= 4.26.3 - Missing Authorization

Simple Shopping Cart 5.1.3 - 5.3.2 - Authenticated (Contributor+) Payment Bypass

SmartyParcel (WC Ukr Shipping) <= 1.23.3 - Missing Authorization

Strong Testimonials <= 3.3.14 - Missing Authorization

SureDash – Community, Courses & Member Dashboard <= 1.12.2 - Missing Authorization

Surfer – WordPress Plugin <= 1.8.0.744 - Missing Authorization

Tailored Tools <= 3.0.3 - Cross-Site Request Forgery

VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery

VR 8.3.0 - 9.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference

VR 8.5.55 - 9.1.2 - Missing Authorization

VR 9.0.0 - 9.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.25 - Missing Authorization

WPZOOM Portfolio <= 1.4.33 - Authenticated (Contributor+) Insecure Direct Object Reference

Xpro Addons — 150+ Widgets for Elementor <= 1.7.10 - Cross-Site Request Forgery

AI Engine <= 3.8.5 - Missing Authorization

Download Monitor < 5.3.5 - Missing Authorization

Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 - Missing Authorization

Speed Optimizer – The All-In-One Performance-Boosting Plugin < 7.8.5 - Missing Authorization

Uncanny Toolkit for LearnDash <= 3.8.1 - Missing Authorization

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Missing Authorization

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program , and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Breaking WordPress Security Research in your inbox as it happens.