Back Wordfence

Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026)

Wordfence •Chloe Chamberland • November 12, 2026

Last week, there were 497 vulnerabilities disclosed in 312 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface , vulnerability API , and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free .

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium , Care , and Response customers last week:

WAF-RULE-976 – Data redacted while we work with the vendor on a patch.

Wordfence Premium , Care , and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Total Vulnerabilities by CVSS Severity Last Week

Total Vulnerabilities by CWE Type Last Week

Researchers That Contributed to WordPress Security Last Week

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program . Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

WordPress Themes with Reported Vulnerabilities Last Week

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration , which is completely free to utilize.

BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

Confection 0.4.0 - 0.4.7 - Unauthenticated Remote Code Execution

Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload

Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload

EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Credential Exposure

Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover visa Brute Force

Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated Remote Code Execution

Grand Job <= 1.2.1 - Unauthenticated Privilege Escalation via Account Takeover

Libre Form <= 1.5.0.1 - Unauthenticated Remote Code Execution

Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization

OAuth Single Sign On – SSO (OAuth Client) <= 7.1.3 - Unauthenticated Privilege Escalation

payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter

Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout

s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

Static Snapshot <= 0.2.1 - Unauthenticated Remote Code Execution

Ultra Addons for Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

Wurdey <= 1.0.0 - Unauthenticated Administrator Account Takeover

Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter

Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter

Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save

Komfortkasse for WooCommerce <= 1.4.8 - Cross-Site Request Forgery to Administrator Account Creation

QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters

LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching

Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters

All In One Login 2.4.0 - 2.4.1 - Unauthenticated Privilege Escalation via OTP Brute Force

Ever Accounting <= 2.3.2 - Authenticated (Accounting Manager+) Arbitrary File Deletion

Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter

Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.20 - Unauthenticated PHP Object Injection

WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert

WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter

Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter

Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys

AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option

Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint

FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter

GS JWT Authentication <= 1.0.0 - Unauthenticated SQL Injection

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Denial of Service

IVPAY payments <= 1.0.8 - Unauthenticated SQL Injection

Mail Mage <= 0.0.25 - Unauthenticated SQL Injection

Productive Commerce <= 1.1.53 - Unauthenticated SQL Injection

SAML Single Sign On – SSO Login <= 6.1.0 - Unauthenticated Denial of Service

Travelly – Tour & Travel Booking Manager for WooCommerce <= 2.3.8 - Authenticated (Author+) Local File Inclusion

Travelly – Tour & Travel Booking Manager for WooCommerce <= 2.3.8 - Authenticated (Contributor+) Local File Inclusion

wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter

wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter

WPSyncSheets For Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()

ACF Frontend Admin by DynamiApps <= 3.30.1 - Unauthenticated Privilege Escalation

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Unauthenticated Privilege Escalation

Melapress Role Editor <= 1.3.0 - Unauthenticated Privilege Escalation

ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content <= 4.17.7 - Unauthenticated Arbitrary Shortcode Execution

Real Estate Website Builder <= 1.4.3 - Unauthenticated Privilege Escalation

Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation

Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Privilege Escalation

Userplace <= 1.2.0 - Unauthenticated Privilege Escalation

WHIZZ <= 1.1.8 - Unauthenticated Privilege Escalation

WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.17 - Unauthenticated Privilege Escalation

ACF Frontend Admin by DynamiApps <= 3.30.1 - Unauthenticated Stored Cross-Site Scripting

Advanced Custom Fields (ACF®) <= 6.8.10 - Unauthenticated Stored Cross-Site Scripting

AgenWebsite Shipping <= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup Wizard

Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Stored Cross-Site Scripting

Checkout Files Upload for WooCommerce <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting

Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter

Cloud Blocks <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting

– wpDiscuz <= 7.6.73 - Unauthenticated Stored Cross-Site Scripting

Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]

Elementor Website Builder – more than just a page builder <= 4.3.5 - Unauthenticated Stored Cross-Site Scripting

Featured Image from URL (FIFU) <= 6.1.4 - Unauthenticated Stored Cross-Site Scripting

Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting

Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Content

Form Maker by 10Web – Mobile-Friendly Drag & Drop Form Builder < 1.15.51 - Unauthenticated Stored Cross-Site Scripting

Form Maker by 10Web – Mobile-Friendly Drag & Drop Form Builder <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting

Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value

FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting

FV Player <= 7.5.57.7211 - Unauthenticated Stored Cross-Site Scripting

Gallery for Social Photo <= 1.0.0.41 - Unauthenticated Server-Side Request Forgery

GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content

Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings

Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter

Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header

Invoice Gateway for WooCommerce – Invoice Payment Gateway <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting

Iptanus File Upload <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting

iubenda <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Content via IUB-COOKIE-BLOCK Marker

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting

JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source

JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta

Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter

MCB Stats <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting

MDTF <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter

Noptin – , New Post Notifications & Email Automation <= 4.4.2 - Unauthenticated Stored Cross-Site Scripting

Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Content via Backslash-Escaped Unicode in URL Replacer

Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Content

Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor

Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.15 - Unauthenticated Stored Cross-Site Scripting

Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Avatar

Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter

Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Field via Regex-Mangled Output Buffer

RSVP and Event Management <= 2.7.17 - Unauthenticated Stored Cross-Site Scripting

Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Form 'Website' Field

Stape Conversion Tracking < 2.3.11 - Unauthenticated Server-Side Request Forgery

Strong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameter

TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting

TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Attribute via trp-ajax.php Dictionary Endpoint

TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass

Turisbook Booking System <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting

Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting

Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget

User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input

VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Unauthenticated Stored Cross-Site Scripting

Welcart e-Commerce <= 2.12.6 - Unauthenticated Stored Cross-Site Scripting

WP Booking System – Booking Calendar <= 2.1.0.6 - Unauthenticated Stored Cross-Site Scripting

WP Customer Area <= 8.4.1 - Unauthenticated Stored Cross-Site Scripting

WP Photo Album Plus <= 9.3.05.003 - Unauthenticated Stored Cross-Site Scripting

WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter

WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters

WPForms – AI Form Builder for WordPress – Forms, Payment Forms, Survey Form, Quiz & More <= 2.0.3 - Unauthenticated Stored Cross-Site Scripting

WPvivid — Backup, Migration & Staging 0.9.117 - 0.9.136 - Authenticated (Administrator+) Arbitrary File Upload

WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value

Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.6 - Unauthenticated Arbitrary Shortcode Execution

Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id' Parameters

Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint

CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.3.0 - Unauthenticated Arbitrary Shortcode Execution

CatFolders <= 2.5.6 - Authenticated (Author+) SQL Injection

Cool FormKit Lite – Advanced Form Builder for Elementor <= 2.7.10 - Unauthenticated Arbitrary Shortcode Execution

Customize WordPress Emails and Alerts – Better Notifications for WP <= 1.10.1 - Unauthenticated Arbitrary Shortcode Execution

Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Content via do_shortcode() over rendered template buffer

Event Tickets with Ticket Scanner <= 3.2.8 - Authenticated (Custom+) SQL Injection

Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.8 - Unauthenticated Arbitrary Shortcode Execution

MC4WP: Mailchimp for WordPress <= 4.14.0 - Unauthenticated Arbitrary Shortcode Execution

Media Library Assistant <= 3.43 - Unauthenticated Arbitrary Shortcode Execution

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar <= 3.3.6 - Unauthenticated Arbitrary Shortcode Execution

Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter

Site Reviews <= 8.3.6 - Unauthenticated Arbitrary Shortcode Execution

The Events Calendar <= 6.18.3 - Unauthenticated Arbitrary Shortcode Execution

Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen

Welcart e-Commerce <= 2.12.6 - Unauthenticated Arbitrary Shortcode Execution

aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute

Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute

Add From Server Reloaded <= 5.0.0 - Authenticated (Author+) Stored Cross-Site Scripting

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos < 5.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Blocks for ShopEngine <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) < 3.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute

Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.71 - Authenticated (Contributor+) Stored Cross-Site Scripting

Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Easy Social Icons <= 4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Elementor Website Builder – more than just a page builder <= 4.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Enable Media Replace < 4.2.3 - Authenticated (Author+) Stored Cross-Site Scripting

Everest Forms – Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

EWWW Image Optimizer 8.7.4 - 8.9.0 - Authenticated (Author+) Stored Cross-Site Scripting

Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter

FV Player <= 7.5.56.7211 - Authenticated (Contributor+) Server-Side Request Forgery

FV Player <= 7.5.56.7211 - Authenticated (Contributor+) Stored Cross-Site Scripting

GutenKit 2.5.0 - 2.5.4 - Authenticated (Author+) Stored Cross-Site Scripting

HTML5 Video Player – embed fast, responsive videos with ease <= 2.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

JetEngine <= 3.9.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Kali Forms <= 2.4.28 - Authenticated (Author+) Stored Cross-Site Scripting

Live Composer <= 2.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

Meta Box – A Framework for Dynamic Websites <= 5.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter

MoreConvert Wishlist for WooCommerce <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

PageNavi Style <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug

Post Fields for Form 7 <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Posts Table with & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

Posts Table with & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

PowerPack Addons for Elementor: Widgets, Form Styler and Templates 2.10.0 - 3.1.2 - Authenticated (Contributor+) Server-Side Request Forgery

Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile

SEOPress – AI SEO Plugin & On-site SEO < 10.4 - Authenticated (Custom Role+) Stored Cross-Site Scripting

ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets <= 4.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN <= 4.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Spectra Legacy – Gutenberg Blocks <= 2.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Stackable <= 3.19.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameter

Text Typing – grab attention with animated typing headlines < 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Events Calendar <= 6.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Unlimited Elements for Elementor <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting

UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute

Vidplex – Ultimate Video Gallery Block for YouTube in Gutenberg <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

VikWidgetsLoader – Collection of Widgets < 1.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

WCFM – Frontend Manager for WooCommerce <= 6.8.1 - Authenticated (Customer+) Stored Cross-Site Scripting

WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.3 - Authenticated (Vendor+) Stored Cross-Site Scripting

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute

WP Customer Area <= 8.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Wp Parsidate <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute

WP Recipe Maker <= 10.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1234 - Authenticated (Technician+) Privilege Escalation

Surfer <= 1.8.1.758 - Authenticated (Contributor+) Privilege Escalation

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 45.1 - Authentication Bypass via SAML Relay

Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.14 - Reflected Cross-Site Scripting

Duplicator < 5.1.0 - Reflected Cross-Site Scripting

Elementor Website Builder – more than just a page builder <= 4.3.5 - Reflected Cross-Site Scripting

If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.3 - Reflected Cross-Site Scripting

Mang Board <= 2.4.7 - Reflected Cross-Site Scripting

QODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie

SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.4 - Reflected Cross-Site Scripting

WP Inventory Manager <= 2.5.9 - Reflected Cross-Site Scripting

Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter

Vanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parameter

WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field

BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion

Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter

FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Content

Greenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Author URL via Interaction Layer attach-attribute to Counter data-prefix

JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property

Jupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta

MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint

Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain

Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter

RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title

Smart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Content via Bundled Simple HTML DOM Noise Restoration

2Way VideoCalls and Random Chat – HTML5 Webcam Videochat <= 6.1.9 - Missing Authorization

Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.15 - Unauthenticated Information Exposure

Advanced Appointment Booking & Scheduling <= 2.6 - Missing Authorization

All-in-One Video Gallery <= 5.0.0 - Missing Authorization

All-in-One Video Gallery <= 5.1.0 - Unauthenticated Information Exposure

Antom Payments <= 2.0.11 - Unauthenticated Insecure Direct Object Reference

AutomatorWP <= 6.0.6 - Missing Authorization

Autopay dla WooCommerce <= 2.3.0 - Missing Authorization

Better – Relevant results for WordPress <= 4.5.2 - Missing Authorization

Booking Package < 1.7.34 - Unauthenticated Free Confirmed Booking Creation

Car Dealer <= 4.73 - Unauthenticated Information Exposure

CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.3.0 - Missing Authorization

ClickCease Click Fraud Protection <= 3.3.0 - Missing Authorization

Community Events <= 1.5.0 - Missing Authorization

Content Egg – Affiliate Product Importer & Price Comparison <= 12.0.0 - Unauthenticated Information Exposure

CURCY – Multi Currency for WooCommerce <= 2.2.20 - Missing Authorization

Dokan <= 5.3.2 - Missing Authorization

Dokan <= 5.3.2 - Unauthenticated Email Spoofing

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.3.2 - Missing Authorization

DOOFINDER and Discovery for WP & WooCommerce <= 2.17.2 - Unauthenticated Information Exposure

DT LMS – elearning, WordPress LMS Plugin <= 1.2 - Missing Authorization

Duplicator < 5.1.0 - Unauthenticated Full Path Disclosure

Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Missing Authorization

Essential Real Estate <= 5.3.4 - Missing Authorization

Essential Real Estate <= 5.3.4 - Unauthenticated Information Exposure

Event Manager 3.4.0 - 3.4.1 - Unauthenticated Insecure Direct Object Reference

Event Tickets Manager for WooCommerce <= 1.5.0 - Unauthenticated Insecure Direct Object Reference

Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Payment Bypass

EventPrime – Events Calendar, Bookings, Tickets & AI < 4.3.6.1 - Missing Authorization

Fiber Admin <= 4.0.0 - Missing Authorization

FloristPress for Woo – Customize your eCommerce store for your Florist <= 7.8.4 - Unauthenticated Information Exposure

Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.5.0 - Missing Authorization

Fluent Forms – Customizable Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.16 - Missing Authorization

Formidable Forms Signature Online Contract Automation <= 2.0.5 - Missing Authorization

Forminator Forms – Form, Payment Form & Custom Form Builder <= 1.58.3 - Missing Authorization

FOX – Currency Switcher Professional for WooCommerce <= 1.5.6 - Missing Authorization

FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Missing Authorization

GemBooking <= 1.7.0 - Unauthenticated Team Member Double-Booking

Greenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter

JetFormBuilder – Hierarchical Select <= 1.0.10 - Unauthenticated Insecure Direct Object Reference

JS Help Desk – AI-Powered Support & Ticketing System <= 5.0.3 - Missing Authorization

Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter

JWT Auth <= 3.0.2 - Unauthenticated Persistent Unauthorized Account Access

Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Information Exposure

MapSVG – Vector maps, Google Maps, Image maps – with AI assistant <= 8.16.3 - Missing Authorization

MC4WP: Mailchimp for WordPress <= 4.14.0 - Missing Authorization

MC4WP: Mailchimp for WordPress <= 4.14.1 - Missing Authorization

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Missing Authorization

Mollie Payments for WooCommerce < 8.2.0 - Missing Authorization

MoreConvert Wishlist for WooCommerce <= 2.0.3 - Missing Authorization

Order Tracking <= 3.5.0 - Unauthenticated Payment Bypass

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.3 - Missing Authorization

Pay with Vipps and MobilePay for WooCommerce 5.0.0 - 6.4.0 - [Fill this out]

Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Insecure Direct Object Reference

Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Payment Processing Bypass

Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint

Pie Register <= 3.8.4.15 - Missing Authorization

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 4.0.2 - Missing Authorization

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 4.0.2 - Unauthenticated Information Exposure

Premium Blocks – Gutenberg Blocks, Patterns & Templates <= 2.3.18 - Missing Authorization

Premium Packages – Sell Digital Products Securely < 7.3.1 - Unauthenticated Insecure Direct Object Reference

Pronamic Pay & Pronamic Pay doneren met Mollie <= 11.0.0 - Unauthenticated Information Exposure

Quick Event Manager 9.9.5 - 9.18 - Unauthenticated Unpaid Event Registration Confirmation

Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.20 - Missing Authorization

Razorpay for WooCommerce <= 4.8.8 - Missing Authorization

Razorpay for WooCommerce <= 4.8.8 - Unauthenticated Information Exposure

Recipe Maker <= 10.9.1 - Unauthenticated Information Exposure

Redirection for Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter

Simple CAPTCHA with Cloudflare Turnstile <= 1.44.1 - Unauthenticated CAPTCHA Protection Bypass

Simple CAPTCHA with Cloudflare Turnstile <= 1.44.4 - Unauthenticated CAPTCHA Protection Bypass on Login

Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Missing Authorization

SureForms – Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.0 - Missing Authorization

The Innovative Form Builder – IvyForms <= 1.5.1 - Missing Authorization

Tournamatch <= 4.7.0 - Unauthenticated Information Exposure

Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder <= 4.0.1 - Missing Authorization

Uncanny Automator – Claude & ChatGPT MCP Server with MCP for AI Automation <= 7.7.1 - Missing Authorization

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Missing Authorization

WATI Chat and Notification <= 1.1.8 - Unauthenticated Information Exposure

WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.2 - Missing Authorization

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Missing Authorization

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Missing Authorization

WP Remote Users Sync < 2.2.0 - Unauthenticated Information Exposure

WP Roster < 2.36 - Missing Authorization

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.10.4 - Missing Authorization

WP-Lister Lite for Amazon <= 2.9.2 - Missing Authorization

YITH WooCommerce Gift Cards <= 4.38.0 - Unauthenticated Gift Card Balance Double-Spending

YITH WooCommerce Subscription <= 4.22.0 - Unauthenticated Information Exposure

YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php

Razorpay for WooCommerce <= 4.8.8 - Authenticated (Administrator+) SQL Injection

WPvivid — Backup, Migration & Staging < 0.9.137 - Authenticated (Administrator+) Path Traversal

WPvivid — Backup, Migration & Staging < 0.9.138 - Authenticated (Administrator+) Path Traversal

YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter

Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter

Stop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter

Easy Social Icons <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Live Composer <= 2.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting

Secure Custom Fields <= 6.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode

Advanced Custom Fields <= 6.8.10 - Authenticated (Contributor+) Information Exposure

Advanced Custom Fields <= 6.8.10 - Missing Authorization

Advanced Custom Fields 6.2.0 - 6.8.10 - Authenticated (Contributor+) Insecure Direct Object Reference

AZEXO Store Locator <= 1.4 - Missing Authorization

CatFolders <= 2.5.6 - Missing Authorization

Contextual Related Posts <= 4.5.3 - Missing Authorization

Directorist <= 8.10 - Missing Authorization

Dokan <= 5.3.2 - Authenticated (Vendor+) Business Logic Flaw

Dropshipping XML Import for WooCommerce <= 1.7.4 - Missing Authorization

Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Authenticated (Contributor+) Information Exposure

Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Missing Authorization

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce < 1.17.11 - Missing Authorization

Essential Real Estate <= 5.3.4 - Authenticated (Customer+) Insecure Direct Object Reference

Essential Real Estate <= 5.3.4 - Missing Authorization

Event Tickets with Ticket Scanner <= 3.1.13 - Missing Authorization

Everest Forms – Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.3 - Missing Authorization

FloristPress for Woo – Customize your eCommerce store for your Florist <= 7.8.5 - Missing Authorization

Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.5.0 - Missing Authorization

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 2.2.2 - Missing Authorization

Fusion Page Builder <= 1.7.0 - Authenticated (Contributor+) Insecure Direct Object Reference

FV Flowplayer Video Player < 7.5.56.7212 - Authenticated (Contributor+) Insecure Direct Object Reference

FV Flowplayer Video Player 7.4.44.727 - 7.5.56.7211 - Missing Authorization

FV Player <= 7.5.56.7211 - Missing Authorization

GemBooking <= 1.7.0 - Missing Authorization

Google Review Slider <= 18.10 - Cross-Site Request Forgery

HivePress – Business Directory, Listings & Classified Ads Plugin <= 1.8.1 - Missing Authorization

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.12 - Missing Authorization

Limit Login Attempts Reloaded <= 3.4.0 - Two-Factor Authentication Bypass

Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass

Media Library Assistant <= 3.43 - Missing Authorization

Melapress Role Editor <= 1.3.0 - Missing Authorization

Meta Box – A Framework for Dynamic Websites <= 5.15.3 - Missing Authorization

MetForm – Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.3 - Missing Authorization

Motors – Car Dealership & Classified Listings Plugin <= 1.4.128 - Missing Authorization

Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Missing Authorization

Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox <= 1.21.6 - Cross-Site Request Forgery

Pie Register <= 3.8.4.15 - Missing Authorization

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 4.0.2 - Missing Authorization

Polylang <= 3.9 - Missing Authorization

Post Duplicator < 3.0.17 - Missing Authorization

PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Cross-Site Request Forgery

PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Missing Authorization

Product Gallery Slider, Additional Variation Images for WooCommerce 2.3.23 - 2.3.25 - Missing Authorization

PublishPress Revisions <= 4.3.0 - Authenticated (Contributor+) Insecure Direct Object Reference

PublishPress Revisions 3.6.0 - 4.2.0 - Missing Authorization

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 4.2.0 - Missing Authorization

Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1068 - Missing Authorization

Secure Custom Fields <= 6.9.7 - Authenticated (Contributor+) Information Exposure

Secure Custom Fields <= 6.9.7 - Authenticated (Contributor+) Insecure Direct Object Reference

Secure Custom Fields <= 6.9.7 - Missing Authorization

Sender – , SMS and Email Marketing Automation for WooCommerce <= 2.11.2 - Missing Authorization

Simple Download Monitor < 4.1.3 - Missing Authorization

Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More <= 4.2.4 - Cross-Site Request Forgery

Sync Post With Other Site <= 1.9.3 - Missing Authorization

Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.6 - Missing Authorization

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.0 - Missing Authorization

Vigilant <= 2.10.0 - Two-Factor Authentication Bypass

VOD Infomaniak <= 1.5.15 - Missing Authorization

WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.3 - Missing Authorization

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Missing Authorization

wePOS – Point Of Sale (POS) for WooCommerce & Dokan 1.2.6 - 2.0.2 - Authenticated (Custom+) Payment Bypass

WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Insecure Storage of Password

WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.90 - Cross-Site Request Forgery

Wp Social Login and Register Social Counter <= 3.2.3 - Cross-Site Request Forgery

Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed

Directorist <= 8.10 - Missing Authorization

Post Duplicator <= 3.0.17 - Missing Authorization

weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce < 2.1.7 - Authenticated (Editor+) Information Exposure

weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce < 2.1.7 - Missing Authorization

WPvivid — Backup, Migration & Staging < 0.9.137 - Authenticated (Administrator+) Arbitrary Database Table Deletion

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program , and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Breaking WordPress Security Research in your inbox as it happens.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

497 Vulnerabilities Disclosed in WordPress Plugins and Themes From November 2 to November 8, 2026, a total of 497 vulnerabilities were disclosed across 312 WordPress plugins and one theme. The vulnerabilities were documented in the Wordfence Intelligence Vulnerability Database, with contributions from 218 security researchers. Wordfence has implemented new firewall rules to protect against these vulnerabilities, with immediate deployment for premium customers and a 30-day delay for free users. The report emphasizes the importance of staying updated on vulnerabilities to ensure site security. The vulnerabilities vary in severity, and site owners are encouraged to review the report to determine if their sites are affected. 2 sources 43

Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026)

The full story

Extracted Entities

CWE Weaknesses (5)

IP Addresses (13)

Vulnerabilities (7)