Last week, there were 358 vulnerabilities disclosed in 243 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 184 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-957 – Data redacted while we work with the vendor on a patch.
- WordPress Core <= 7.1 – Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 311 |
| Unpatched | 47 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 4 |
| Medium Severity | 262 |
| High Severity | 74 |
| Critical Severity | 18 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 94 |
| Missing Authorization | 68 |
| Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 35 |
| Authorization Bypass Through User-Controlled Key | 27 |
| Exposure of Sensitive Information to an Unauthorized Actor | 26 |
| Improper Privilege Management | 19 |
| Improper Control of Generation of Code (‘Code Injection’) | 13 |
| Unrestricted Upload of File with Dangerous Type | 12 |
| Cross-Site Request Forgery (CSRF) | 8 |
| Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 8 |
| Client-Side Enforcement of Server-Side Security | 7 |
| Server-Side Request Forgery (SSRF) | 6 |
| Deserialization of Untrusted Data | 4 |
| Improper Authentication | 4 |
| Incorrect Authorization | 3 |
| Protection Mechanism Failure | 3 |
| URL Redirection to Untrusted Site (‘Open Redirect’) | 3 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Improper Input Validation | 2 |
| Insufficient Verification of Data Authenticity | 2 |
| Uncontrolled Resource Consumption | 2 |
| Authentication Bypass by Spoofing | 1 |
| Embedded Malicious Code | 1 |
| External Control of File Name or Path | 1 |
| Guessable CAPTCHA | 1 |
| Improper Authorization | 1 |
| Improper Encoding or Escaping of Output | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) | 1 |
| Improper Restriction of Rendered UI Layers or Frames | 1 |
| Improper Verification of Cryptographic Signature | 1 |
| Insufficiently Protected Credentials | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 25 | |
| 17 | |
| 13 | |
| 12 | |
| 11 | |
| 11 | |
| 11 | |
| 8 | |
| 7 | |
| 6 | |
| 6 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery | interactive-3d-flipbook-powered-physics-engine |
| Active Woot Products Tables for WooCommerce. 100% FREE | profit-products-tables-for-woocommerce |
| Ad Inserter – Ad Manager & AdSense Ads | ad-inserter |
| Add User Autocomplete | add-user-autocomplete |
| Admin Menu Editor Pro | admin-menu-editor-pro |
| Advanced Custom Fields: Extended PRO | acf-extended-pro |
| Advanced Popups | advanced-popups |
| AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing | af-companion |
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | ai-engine |
| Album Cover Finder | album-cover-finder |
| All Bootstrap Blocks | all-bootstrap-blocks |
| All-in-One WP Migration and Backup | all-in-one-wp-migration |
| AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) | appmysite |
| Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | latepoint |
| Appointment Hour Booking – Booking Calendar | appointment-hour-booking |
| Asset CleanUp: Page Speed Booster | wp-asset-clean-up |
| Auto Upload Images | auto-upload-images |
| Autopay | platnosci-online-blue-media |
| aVideo | avideo |
| BE REST Endpoints | be-rest-endpoints |
| BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript | searchpro |
| Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | bp-better-messages |
| BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for News, Magazine & Blogs | blockspare |
| Blog2Social: Social Media Auto Post & Scheduler | blog2social |
| Bold Page Builder | bold-page-builder |
| Booking Calendar | booking |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Bookit — Booking & Appointment Calendar | bookit |
| Botiga Pro | botiga-pro |
| Bread | bread |
| Breeze Cache | breeze |
| Brizy – Page Builder | brizy |
| Business Name Generator | designbro-business-name-generator |
| Checkout Field Manager (Checkout Manager) for WooCommerce | woocommerce-checkout-manager |
| Choose User Role at Registration for WooCommerce | choose-user-role-at-registration |
| Clean Login | clean-login |
| Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors | publishpress-authors |
| Comments Import & Export | comments-import-export-woocommerce |
| Complianz GDPR/CCPA Cookie Consent Banner | complianz-gdpr |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| Cooked – Recipe Management | cooked |
| Create | mediavine-create |
| CSS & JavaScript Toolbox | css-javascript-toolbox |
| Custom Field Template | custom-field-template |
| Custom Twitter Feeds – A Tweets Widget or X Feed Widget | custom-twitter-feeds |
| Datalogics Ecommerce Delivery – Datalogics | datalogics |
| design-scuole-wordpress-theme | design-scuole-wordpress-theme |
| Dewa Kirim – WooCommerce Gojek / Gosend | dewa-kirim-woocommerce-gojek |
| Dictionary | dictionary |
| Divi Essentials | divi-essential |
| Download Manager | download-manager |
| DS Ad Rotator | ds-adrotator |
| Easy Appointments | easy-appointments |
| Easy Form Builder by WhiteStudio – Drag & Drop Form Builder | easy-form-builder |
| Easy Invoice – Invoice Generator, PDF Quotes & Payments | easy-invoice |
| EduAdmin Booking | eduadmin-booking |
| Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | embedpress |
| Empik for Woocommerce | empik-for-woocommerce |
| Estatik Real Estate Plugin | estatik |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| EWWW Image Optimizer | ewww-image-optimizer |
| Export & Import WPBakery Page Builder | vc-templates-import-export |
| FileBird – WordPress Media Library Folders & File Manager | filebird |
| Filter Gallery | filter-gallery |
| Flex Import | flex-import |
| FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login | fluent-security |
| FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration | fluent-boards |
| Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More | formidable |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Foxtool All-in-One: Contact chat button, Custom login, Media optimize images | foxtool |
| Generate PDF using Contact Form 7 | generate-pdf-using-contact-form-7 |
| GenieWords | geniewords |
| Geo Mashup | geo-mashup |
| Getwid – Gutenberg Blocks | getwid |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| GoPay for WooCommerce | gopay-gateway |
| GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI | gptranslate |
| Gravity Forms | gravityforms |
| Gum Addon for Elementor | gum-elementor-addon |
| Headless SSO Plugin for WP | headless-single-sign-on |
| Hide My WP Ghost – Security & Firewall | hide-my-wp |
| Hoo Companion | hoo-companion |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| Hydra Booking — Appointment Scheduling & Booking Calendar | hydra-booking |
| Ibtana – Ecommerce Product Addons | ibtana-ecommerce-product-addons |
| IDB Ecommerce (wpStoreCart 5) | wpstorecart |
| iGMS Direct Booking | igms-direct-booking |
| Import and export users and customers | import-users-from-csv-with-meta |
| InfiniteWP Client | iwp-client |
| Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms | gdpr-compliant-recaptcha-for-all-forms |
| Issues and Series for Newspapers, Magazines, Publishers, Writers | organize-series |
| Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | jeg-elementor-kit |
| JetBlocks for Elementor | jet-blocks |
| JetBlog | jet-blog |
| JetElements | jet-elements |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| JetSearch | jet-search |
| JetTabs | jet-tabs |
| Job Postings | job-postings |
| JWT Authentication for WP REST APIs | wp-rest-api-authentication |
| kboard | kboard |
| King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder | king-addons |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Kubio AI Page Builder | kubio |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| LiteSpeed Cache | litespeed-cache |
| Location Manager | geodir_location_manager |
| Login with QR | login-with-qr |
| Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid | magazine-blocks |
| Mailchimp for WooCommerce | mailchimp-for-woocommerce |
| Mapster WP Maps | mapster-wp-maps |
| Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | master-addons |
| Master Blocks – Ultimate Blocks for Marketers | ultimate-blocks-for-gutenberg |
| Master Slider – Responsive Touch Slider | master-slider |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| MC4WP: Mailchimp for WordPress | mailchimp-for-wp |
| Meow Gallery | meow-gallery |
| MgoSync – European dropshipping and suppliers | megamo |
| Migratico Lite | migratico-lite |
| MoreConvert Wishlist for WooCommerce | smart-wishlist-for-more-convert |
| MotoPress Hotel Booking | motopress-hotel-booking-lite |
| Motors – Car Dealership & Classified Listings Plugin | motors-car-dealership-classified-listings |
| Multi Uploader for Gravity Forms | gf-multi-uploader |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| Newsletter | newsletter-email-mailing-list |
| Newsletter – Send awesome emails from WordPress | newsletter |
| Newsletters | newsletters-lite |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard | ni-woocommerce-sales-report |
| Nimble Page Builder | nimble-builder |
| Online Scheduling and Appointment Booking System – Bookly | bookly-responsive-appointment-booking-tool |
| Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | optimole-wp |
| OTP Login & Register Woocommerce | mobile-login-woocommerce |
| Paid Downloads | paid-downloads |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Partial Shipment for WooCommerce | wc-partial-shipment |
| Payment Gateway for PayPal on WooCommerce | woo-paypal-gateway |
| Payment Gateway of Stripe for WooCommerce | payment-gateway-stripe-and-woocommerce-integration |
| PDF Builder for WooCommerce. Create invoices,packing slips and more | woo-pdf-invoice-builder |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | nextgen-gallery |
| Pochipp | pochipp |
| Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | popup-maker |
| Price Drop Alert for Woo Commerce | woo-price-drop-alert |
| Printcart Store – Web to Print Product Designer for WooCommerce | printcart-integration |
| Private Feed Key | private-feed-key |
| Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels | best-woocommerce-feed |
| Product Question and Answer | product-question-and-answer |
| Property Hive | propertyhive |
| PuppyFW | puppyfw |
| Qi Addons For Elementor | qi-addons-for-elementor |
| Quill Forms | Conversational Multi Step Forms, Surveys & quizzes | quillforms |
| Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder | real3d-flipbook-lite |
| Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | really-simple-ssl |
| Realtyna Organic IDX plugin + WPL Real Estate | real-estate-listing-realtyna-wpl |
| Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit | woo-rede |
| Redux Framework | redux-framework |
| RestroPress – Online Food Ordering System | restropress |
| Robokassa payment gateway for Woocommerce | robokassa |
| Rox Appointment Booking – Appointment Booking Scheduling Solution | rox-appointment-booking |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg | rt-mega-menu |
| SAML Single Sign On – SSO Login | miniorange-saml-20-single-sign-on |
| SAMO Forms | samo-forms |
| Save as PDF Plugin by PDFCrowd | save-as-pdf-by-pdfcrowd |
| Schema & Structured Data for WP & AMP | schema-and-structured-data-for-wp |
| Search Atlas SEO – OTTO AI SEO Automation for WordPress | metasync |
| Secure Custom Fields | secure-custom-fields |
| SEO Booster | seo-booster |
| Seraphinite Accelerator | seraphinite-accelerator |
| Share-one-Drive | OneDrive & SharePoint plugin for WordPress | shareonedrive-onedrive-plugin-for-wordpress |
| ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets | shopengine |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | shortpixel-image-optimiser |
| Sign-up Sheets | sign-up-sheets |
| Simple Membership | simple-membership |
| SKT Addons for Elementor | skt-addons-for-elementor |
| SSL Zen — SSL Certificate Installer & HTTPS Redirects | ssl-zen |
| Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers | woocommerce-exporter |
| Strong Testimonials | strong-testimonials |
| Subscriptions for WooCommerce | subscriptions-for-woocommerce |
| The Pressengine | the-pressengine |
| The Welcomizer | the-welcomizer |
| TikTok | tiktok-for-business |
| To Do List Member | todo-lists-for-membership-sites |
| Tripzzy – Travel Engine System | tripzzy |
| TrueBooker – Appointment Booking and Scheduler System | truebooker-appointment-booking |
| Tutor LMS – eLearning and online course solution | tutor |
| Tz Weekly Radio Schedule | tz-wrs-core |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| Ultra Addons for Contact Form 7 | ultimate-addons-for-contact-form-7 |
| Unbounce Landing Pages | unbounce |
| Unlimited Elements For Elementor | unlimited-elements-for-elementor |
| UpsellWP – Upsell and Related Products Offers for WooCommerce | checkout-upsell-and-order-bumps |
| Use-your-Drive | Google Drive plugin for WordPress | use-your-drive |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| UsersWP – Social Login | userswp-social-login |
| VikBooking Hotel Booking Engine & PMS | vikbooking |
| VikRentItems Flexible Rental Management System | vikrentitems |
| Visitor Traffic Real Time Statistics pro | visitors-traffic-real-time-statistics-pro |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| VK All in One Expansion Unit | vk-all-in-one-expansion-unit |
| WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors | wc-vendors |
| WCFM Marketplace – Multivendor Marketplace for WooCommerce | wc-multivendor-marketplace |
| Web to Print Online Designer | web-to-print-online-designer |
| WordLift – AI powered SEO – Schema | wordlift |
| Wow Elements Addons for Elementor | wow-elements-addons-for-elementor |
| WP Cloud Plugins – Box (Lets-Box) | lets-box |
| WP Cloud Plugins – Dropbox (Out-of-the-Box) | out-of-the-box |
| WP Component | wpcomponent |
| WP Composer – The Easiest Page Builder | page-builder-wp |
| WP Customer Reviews | wp-customer-reviews |
| WP Directory Kit | wpdirectorykit |
| WP Easy Pay – Payment and Donation Form Builder for Square | wp-easy-pay |
| WP images upload on piclect | wp-images-upload-on-piclect |
| WP Import Export Lite | wp-import-export-lite |
| WP Inventory Manager | wp-inventory-manager |
| WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings | wp-google-map-plugin |
| WP Mega Menu | wp-megamenu |
| WP Multi Store Locator Pro | wp-multi-store-locator-pro |
| WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals | wp-optimizer |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Recipe Maker | wp-recipe-maker |
| wp shortcut link and advertisement baner | wp-shortcut-link |
| WP-Lister Lite for eBay | wp-lister-for-ebay |
| WP2Social Auto Publish | facebook-auto-publish |
| WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services | chatbot |
| WPComplete | wpcomplete |
| WPGraphQL Smart Cache | wpgraphql-smart-cache |
| WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | gdpr-cookie-consent |
| WPMasterToolKit (WPMTK) – All in one plugin | wpmastertoolkit |
| wpShopGermany IT-RECHT KANZLEI | wpshopgermany-it-recht-kanzlei |
| Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility | xagio-seo |
| Xpro Addons — 150+ Widgets for Elementor | xpro-elementor-addons |
| YayPricing – WooCommerce Dynamic Pricing & Discounts | yaypricing |
| Yo | yo |
| Yogeta WP Cloud | yogeta-wp-cloud |
| YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin | youram-youtube-embed |
| YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress | ysleadgen |
| Zonify – Amazon Product Importer for WooCommerce | zonify |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Bridge – Creative Multipurpose WordPress Theme | bridge |
| Consulting – Business, Finance WordPress Theme | consulting |
| Divi | Divi |
| VW Writer Blog | vw-writer-blog |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Patch Status
Patched
Patched
Published
Sep 14, 2026
Sep 14, 2026
Affected Software
Advanced Custom Fields: Extended PRO [acf-extended-pro]
Researchers
Choose User Role at Registration for WooCommerce <= 1.3.2 – Unauthenticated Privilege Escalation
9.8
Affected Software
Choose User Role at Registration for WooCommerce [choose-user-role-at-registration]
Researcher
Affected Software
DS Ad Rotator [ds-adrotator]
Researcher
Affected Software
Gravity Forms [gravityforms]
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
Login with QR [login-with-qr]
Researcher
Affected Software
Migratico Lite [migratico-lite]
Researcher
Affected Software
Multi Uploader for Gravity Forms [gf-multi-uploader]
Researcher
Affected Software
Private Feed Key [private-feed-key]
Researcher
Affected Software
The Pressengine [the-pressengine]
Researcher
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]
Researcher
Affected Software
Web to Print Online Designer [web-to-print-online-designer]
Researcher
Affected Software
WP images upload on piclect [wp-images-upload-on-piclect]
Researcher
Affected Software
wpShopGermany IT-RECHT KANZLEI [wpshopgermany-it-recht-kanzlei]
Researcher
Affected Software
Researcher
WP Recipe Maker <= 10.8.1 – Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
9.1
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
Consulting – Business, Finance WordPress Theme [consulting]
Researcher
Contest Gallery <= 32.0.1 – Unauthenticated Arbitrary File Upload via ‘baseUrlForFacebook’ Parameter
8.8
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Affected Software
Mapster WP Maps [mapster-wp-maps]
Researcher
Affected Software
Save as PDF Plugin by PDFCrowd [save-as-pdf-by-pdfcrowd]
Researcher
Affected Software
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]
Researcher
Affected Software
The Welcomizer [the-welcomizer]
Researcher
Affected Software
Share-one-Drive | OneDrive & SharePoint plugin for WordPress [shareonedrive-onedrive-plugin-for-wordpress]
Use-your-Drive | Google Drive plugin for WordPress [use-your-drive]
WP Cloud Plugins – Box (Lets-Box) [lets-box]
WP Cloud Plugins – Dropbox (Out-of-the-Box) [out-of-the-box]
Researcher
Affected Software
Filter Gallery [filter-gallery]
Researcher
Affected Software
IDB Ecommerce (wpStoreCart 5) [wpstorecart]
Researcher
Affected Software
Researcher
Affected Software
Paid Downloads [paid-downloads]
Researcher
Affected Software
Researcher
Affected Software
Album Cover Finder [album-cover-finder]
Researcher
Affected Software
All Bootstrap Blocks [all-bootstrap-blocks]
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Location Manager [geodir_location_manager]
Researcher
Affected Software
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard [ni-woocommerce-sales-report]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Price Drop Alert for Woo Commerce [woo-price-drop-alert]
Researcher
Affected Software
Printcart Store – Web to Print Product Designer for WooCommerce [printcart-integration]
Researcher
Affected Software
Product Question and Answer [product-question-and-answer]
Researcher
Affected Software
SAMO Forms [samo-forms]
Researcher
Affected Software
wp shortcut link and advertisement baner [wp-shortcut-link]
Researcher
Affected Software
Tz Weekly Radio Schedule [tz-wrs-core]
Researcher
Affected Software
Tz Weekly Radio Schedule [tz-wrs-core]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
VikRentItems Flexible Rental Management System [vikrentitems]
Affected Software
WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]
Researcher
Affected Software
WP Multi Store Locator Pro [wp-multi-store-locator-pro]
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
Yo [yo]
Researcher
Affected Software
Yogeta WP Cloud [yogeta-wp-cloud]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Headless SSO Plugin for WP [headless-single-sign-on]
Researcher
Affected Software
SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]
Researcher
Affected Software
UsersWP – Social Login [userswp-social-login]
Researcher
Affected Software
WP Component [wpcomponent]
Researcher
Affected Software
Researcher
Affected Software
Asset CleanUp: Page Speed Booster [wp-asset-clean-up]
Researcher
Affected Software
BE REST Endpoints [be-rest-endpoints]
Booking Calendar <= 11.8.2 – Authenticated (Editor+) Privilege Escalation to ‘data_name’ Parameter
7.2
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Complianz GDPR/CCPA Cookie Consent Banner [complianz-gdpr]
Researcher
Affected Software
Dewa Kirim – WooCommerce Gojek / Gosend [dewa-kirim-woocommerce-gojek]
Affected Software
Dictionary [dictionary]
Affected Software
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]
Researcher
Affected Software
Researcher
Affected Software
Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7]
Researcher
Affected Software
GenieWords [geniewords]
Affected Software
Hoo Companion [hoo-companion]
Researchers
Affected Software
iGMS Direct Booking [igms-direct-booking]
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Jeg Kit for Elementor <= 3.2.16 – Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
Affected Software
Researcher
Affected Software
Master Blocks – Ultimate Blocks for Marketers [ultimate-blocks-for-gutenberg]
Researcher
Affected Software
MotoPress Hotel Booking [motopress-hotel-booking-lite]
Researcher
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Royal Elementor Addons <= 1.7.1066 – Unauthenticated Arbitrary HTML Injection in Notification Emails
7.2
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
To Do List Member [todo-lists-for-membership-sites]
Affected Software
Researcher
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
Affected Software
Visitor Traffic Real Time Statistics pro [visitors-traffic-real-time-statistics-pro]
Researcher
Affected Software
WordPress [wordpress]
Researcher
Affected Software
WP Inventory Manager [wp-inventory-manager]
Researcher
Affected Software
WP-Lister Lite for eBay [wp-lister-for-ebay]
Researcher
Affected Software
Researcher
Affected Software
YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin [youram-youtube-embed]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]
Researcher
Affected Software
Create [mediavine-create]
Researcher
Affected Software
Create [mediavine-create]
Researcher
Custom Field Template <= 2.7.8 – Authenticated (Contributor+) SQL Injection via ‘post_ID’ Parameter
6.5
Affected Software
Custom Field Template [custom-field-template]
Researcher
Affected Software
Divi Essentials [divi-essential]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Easy Appointments [easy-appointments]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
InfiniteWP Client [iwp-client]
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Affected Software
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels [best-woocommerce-feed]
Researcher
Affected Software
Researcher
Affected Software
Wow Elements Addons for Elementor [wow-elements-addons-for-elementor]
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
WP Inventory Manager [wp-inventory-manager]
Researcher
Affected Software
Advanced Popups [advanced-popups]
Researcher
Affected Software
All Bootstrap Blocks [all-bootstrap-blocks]
Researcher
Affected Software
Researcher
Affected Software
Auto Upload Images [auto-upload-images]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Researcher
Affected Software
Brizy – Page Builder [brizy]
Affected Software
Custom Twitter Feeds – A Tweets Widget or X Feed Widget [custom-twitter-feeds]
Researcher
Affected Software
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
EWWW Image Optimizer [ewww-image-optimizer]
Researcher
Affected Software
Geo Mashup [geo-mashup]
Researcher
Affected Software
Getwid – Gutenberg Blocks [getwid]
Researcher
Affected Software
Gum Addon for Elementor [gum-elementor-addon]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Affected Software
Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]
Researcher
Affected Software
JetBlocks for Elementor [jet-blocks]
Researcher
Affected Software
JetElements [jet-elements]
Researcher
Affected Software
Job Postings [job-postings]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Kubio AI Page Builder [kubio]
Researcher
Affected Software
Researcher
Affected Software
Master Slider – Responsive Touch Slider [master-slider]
Researcher
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Affected Software
Researcher
Affected Software
Property Hive [propertyhive]
Researcher
Affected Software
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]
Researcher
Affected Software
Redux Framework [redux-framework]
Researcher
Affected Software
Redux Framework [redux-framework]
Researcher
Affected Software
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]
Researcher
Affected Software
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]
Researcher
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
Affected Software
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
VK All in One Expansion Unit [vk-all-in-one-expansion-unit]
Affected Software
WP Composer – The Easiest Page Builder [page-builder-wp]
Researcher
Affected Software
WPComplete [wpcomplete]
Researcher
Affected Software
Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
YayPricing – WooCommerce Dynamic Pricing & Discounts [yaypricing]
Researcher
Affected Software
Affected Software
Add User Autocomplete [add-user-autocomplete]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
PuppyFW [puppyfw]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Dictionary [dictionary]
Researcher
Affected Software
Researcher
Affected Software
Estatik Real Estate Plugin [estatik]
Researcher
Affected Software
Researcher
Affected Software
MC4WP: Mailchimp for WordPress [mailchimp-for-wp]
Researcher
Affected Software
Newsletter – Send awesome emails from WordPress [newsletter]
Researcher
Affected Software
Pochipp [pochipp]
Researcher
Affected Software
Qi Addons For Elementor [qi-addons-for-elementor]
Researcher
Affected Software
Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP Customer Reviews [wp-customer-reviews]
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Patch Status
Patched
Patched
Published
Sep 17, 2026
Sep 17, 2026
Affected Software
WordPress [wordpress]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors [publishpress-authors]
Researcher
Affected Software
Researcher
Affected Software
Newsletter [newsletter-email-mailing-list]
Researcher
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery [interactive-3d-flipbook-powered-physics-engine]
Researcher
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Affected Software
All-in-One WP Migration and Backup [all-in-one-wp-migration]
Researcher
Affected Software
Appointment Hour Booking – Booking Calendar [appointment-hour-booking]
Researcher
Affected Software
Researcher
Affected Software
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Botiga Pro [botiga-pro]
Researcher
Affected Software
Bread [bread]
Researcher
Affected Software
Breeze Cache [breeze]
Researcher
Affected Software
Clean Login [clean-login]
Researcher
Affected Software
Clean Login [clean-login]
Researcher
Affected Software
Divi [Divi]
Researcher
Affected Software
Easy Appointments [easy-appointments]
Researcher
Affected Software
Easy Appointments [easy-appointments]
Researcher
Affected Software
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]
Researcher
Affected Software
Easy Invoice – Invoice Generator, PDF Quotes & Payments [easy-invoice]
Researcher
Affected Software
EduAdmin Booking [eduadmin-booking]
Researcher
Event Booking Manager for WooCommerce <= 5.3.7 – Unauthenticated Insecure Direct Object Reference
5.3
Affected Software
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Hide My WP Ghost – Security & Firewall [hide-my-wp]
Researcher
Affected Software
Hide My WP Ghost – Security & Firewall [hide-my-wp]
Researcher
Affected Software
Researcher
Affected Software
Ibtana – Ecommerce Product Addons [ibtana-ecommerce-product-addons]
Researcher
Affected Software
JWT Authentication for WP REST APIs [wp-rest-api-authentication]
Researcher
Affected Software
kboard [kboard]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Mailchimp for WooCommerce [mailchimp-for-woocommerce]
Researchers
Affected Software
Researcher
Affected Software
Meow Gallery [meow-gallery]
Researcher
Affected Software
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researchers
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Affected Software
Newsletter [newsletter-email-mailing-list]
Researcher
Affected Software
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard [ni-woocommerce-sales-report]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
Payment Gateway for PayPal on WooCommerce [woo-paypal-gateway]
Researcher
Affected Software
Payment Gateway of Stripe for WooCommerce [payment-gateway-stripe-and-woocommerce-integration]
Researcher
Affected Software
Researcher
Affected Software
Affected Software
RestroPress – Online Food Ordering System [restropress]
Researcher
Affected Software
RestroPress – Online Food Ordering System [restropress]
Researcher
Affected Software
Robokassa payment gateway for Woocommerce [robokassa]
Researcher
Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 – Missing Authorization
5.3
Affected Software
Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]
Researcher
Affected Software
Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]
Researcher
Affected Software
Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]
Researcher
Affected Software
Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]
Researcher
Schema & Structured Data for WP & AMP <= 1.65 – Unauthenticated Insecure Direct Object Reference
5.3
Affected Software
Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]
Researcher
Affected Software
Secure Custom Fields [secure-custom-fields]
Researcher
Affected Software
Subscriptions for WooCommerce [subscriptions-for-woocommerce]
Researcher
Affected Software
TikTok [tiktok-for-business]
Researcher
Affected Software
To Do List Member [todo-lists-for-membership-sites]
Affected Software
Tripzzy – Travel Engine System [tripzzy]
Affected Software
Tripzzy – Travel Engine System [tripzzy]
Affected Software
UpsellWP – Upsell and Related Products Offers for WooCommerce [checkout-upsell-and-order-bumps]
Researcher
Affected Software
Researcher
WordLift <= 3.54.10 – Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
5.3
Affected Software
WordLift – AI powered SEO – Schema [wordlift]
Researcher
Affected Software
WPGraphQL Smart Cache [wpgraphql-smart-cache]
Researcher
Affected Software
Affected Software
GoPay for WooCommerce [gopay-gateway]
Researcher
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Import Export Lite <= 3.9.32 – Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion
4.9
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Affected Software
Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]
Researcher
Affected Software
MoreConvert Wishlist for WooCommerce [smart-wishlist-for-more-convert]
Researcher
Affected Software
Newsletters [newsletters-lite]
Researcher
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Affected Software
SKT Addons for Elementor [skt-addons-for-elementor]
Researcher
Affected Software
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers [woocommerce-exporter]
Researcher
Affected Software
Researcher
Affected Software
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin]
Researcher
Affected Software
WP Mega Menu [wp-megamenu]
Researcher
Affected Software
WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals [wp-optimizer]
Researcher
Affected Software
WP-Lister Lite for eBay [wp-lister-for-ebay]
Researcher
WPMasterToolKit (WPMTK) – All in one plugin <= 2.22.0 – Authenticated (Administrator+) SQL Injection
4.9
Affected Software
WPMasterToolKit (WPMTK) – All in one plugin [wpmastertoolkit]
Researcher
Affected Software
All-in-One WP Migration and Backup [all-in-one-wp-migration]
Researcher
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
WP Ghost (Hide My WP Ghost) <= 7.0.02 – Unauthenticated Open Redirect via ‘redirect_to’ Parameter
4.7
Affected Software
Hide My WP Ghost – Security & Firewall [hide-my-wp]
Researcher
Affected Software
Business Name Generator [designbro-business-name-generator]
Researcher
Affected Software
CSS & JavaScript Toolbox [css-javascript-toolbox]
Researcher
Affected Software
OTP Login & Register Woocommerce [mobile-login-woocommerce]
Researcher
Patch Status
Patched
Patched
Published
Sep 17, 2026
Sep 17, 2026
Affected Software
WordPress [wordpress]
Researcher
Affected Software
WP2Social Auto Publish [facebook-auto-publish]
Researcher
Affected Software
Active Woot Products Tables for WooCommerce. 100% FREE [profit-products-tables-for-woocommerce]
Researcher
Affected Software
Asset CleanUp: Page Speed Booster [wp-asset-clean-up]
Researcher
Affected Software
Researcher
Affected Software
Blog2Social: Social Media Auto Post & Scheduler [blog2social]
Researcher
Affected Software
Blog2Social: Social Media Auto Post & Scheduler [blog2social]
Researcher
Affected Software
Blog2Social: Social Media Auto Post & Scheduler [blog2social]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager]
Researchers
Affected Software
Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager]
Researcher
Affected Software
Comments Import & Export [comments-import-export-woocommerce]
Researcher
Cooked – Recipe Management <= 1.16.0 – Authenticated (Contributor+) Insecure Direct Object Reference
4.3
Affected Software
Cooked – Recipe Management [cooked]
Researcher
Affected Software
Datalogics Ecommerce Delivery – Datalogics [datalogics]
Researcher
Affected Software
Empik for Woocommerce [empik-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Export & Import WPBakery Page Builder [vc-templates-import-export]
Researcher
Affected Software
Filter Gallery [filter-gallery]
Researcher
Affected Software
Filter Gallery [filter-gallery]
Researcher
Affected Software
Flex Import [flex-import]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]
Researcher
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]
Researcher
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]
Researcher
Affected Software
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms [gdpr-compliant-recaptcha-for-all-forms]
Researcher
Affected Software
Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researchers
Affected Software
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
Meow Gallery [meow-gallery]
Researcher
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]
Researcher
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]
Researcher
Affected Software
Nimble Page Builder [nimble-builder]
Researcher
Affected Software
Partial Shipment for WooCommerce [wc-partial-shipment]
Researcher
Affected Software
PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder]
Researcher
Affected Software
Researcher
Affected Software
Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
SEO Booster [seo-booster]
Researcher
Seraphinite Accelerator <= 2.29.23 – Authenticated (Subscriber+) Full Admin Area Denial of Service
4.3
Affected Software
Seraphinite Accelerator [seraphinite-accelerator]
Researcher
Affected Software
Sign-up Sheets [sign-up-sheets]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Subscriptions for WooCommerce [subscriptions-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Unbounce Landing Pages [unbounce]
Researcher
VW Writer Blog <= 1.3.8 – Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset
4.3
Affected Software
VW Writer Blog [vw-writer-blog]
Researcher
Patch Status
Patched
Patched
Published
Sep 17, 2026
Sep 17, 2026
Affected Software
WordPress [wordpress]
Researcher
WP Easy Pay <= 4.5.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
4.3
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Patch Status
Patched
Patched
Published
Sep 17, 2026
Sep 17, 2026
Affected Software
WordPress [wordpress]
Researcher
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]
Researcher
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]
Researcher
Patch Status
Patched
Patched
Published
Sep 17, 2026
Sep 17, 2026
Affected Software
WordPress [wordpress]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026) appeared first on Wordfence.
