CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submissionUser Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter8.8 High
- pluginever content pilot – autoblogging & affiliate marketing suiteContent Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`5.4 Medium
- wpo365 | microsoft 365 graph mailerWPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail7.2 High
- roxnor wp social login and register social counterWp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback8.1 High
- wedevs project manager – ai powered project management, task management, kanban board & time trackerProject Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection9.8 Critical
- davidanderson redux frameworkRedux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript6.5 Medium
- wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submissionUser Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter6.1 Medium
- tobias conrad wp2leads | wordpress und klicktipp einfach verbinden – woocommerce und klicktipp einfach verbindenWP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter6.5 Medium
- tigroumeow perfect images: regenerate thumbnails, image sizes, webp & avifPerfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement4.3 Medium
- uncanny owl toolkit for learndash, uncannyowl uncanny toolkit for learndash +1 moreUncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter9.8 Critical
- rainbowgeek seopress – ai seo plugin & on-site seoSEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag6.4 Medium
- paultgoodchild shield security – smart bot blocking, brute-force login protection & file scanningShield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log7.2 High
- publishpress co-authors, multiple authors and guest authors in an author box with publishpress authorsCo-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author…6.4 Medium
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter5.9 Medium
- roxnor rox appointment booking – event, calendar & appointment schedulingRox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint8.8 High
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter5.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter5.3 Medium
- arosoft shipping zones by drawing for woocommerceShipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter7.2 High
- wpmudev hustle – email marketing, lead generation, optins, popupsHustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX…4.3 Medium
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter7.2 High
- villatheme revopic – photo reviews for woocommercePhoto Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter5.4 Medium
- wpovernight pdf invoices & packing slips for woocommercePDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache5.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter7.2 High
- murgroland wp booking system – booking calendarWP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action9.1 Critical
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter6.1 Medium
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter7.2 High
- wpovernight pdf invoices & packing slips for woocommercePDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout7.2 High
- seraphinitesoft seraphinite acceleratorSeraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory5.3 Medium
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash6.5 Medium
- specialk user submitted posts – enable users to submit posts from the front endUser Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting7.2 High
- wardee mail logging & catcherMail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure7.5 High
- marketingfire discussion board – wordpress forum pluginDiscussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field6.4 Medium
- supercleanse thirstyaffiliates – affiliate links, link branding, link tracking & marketing pluginThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag7.2 High
- wpjobportal wp job portal – ai-powered recruitment system for company or job board websiteWP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter6.4 Medium
- comesio relevanssi – a better searchRelevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode7.2 High
- boldgrid w3 total cacheW3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder5.4 Medium
- amans2k funnelkit automations – email marketing automation and crm for wordpress & woocommerceFunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter7.5 High
- surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & paymentsSureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments7.2 High
- popupbuilder popup builder – create highly converting, mobile friendly marketing popups.Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters9.1 Critical
- pfefferle webmentionWebmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag6.1 Medium
- addonsorg pdf invoice for woocommerce + drag and drop template builderPDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field9.8 Critical
- boldgrid w3 total cacheW3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry7.2 High
- unknown payable payment gateway for woocommercePAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback5.3 Medium
- fullworks quick event managerQuick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download5.3 Medium
- mapster wp maps, unknown mapster wp maps +1 moreMapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route7.5 High
- plugins360 all-in-one video galleryAll-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure5.3 Medium
- firelightwp firelight lightboxFirelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute6.8 Medium
- themekraft buddyformsBuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion3.7 Low
- unknown security optimizerSecurity Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting7.5 High
- shahjada premium packagesPremium Packages < 7.2.2 - Unauthenticated Order Total Manipulation5.3 Medium
- Show moreLoading…