Website security: weekly review (12.10.2026)
A short review of freshly disclosed vulnerabilities in popular systems (WordPress, Joomla) from the last few days. If you use any of the plugins or versions listed below, treat it as a signal to update.
Anton Extensions WordPress: remote code execution (RCE)
Anton Extensions WordPress · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Anton Extensions WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-104028.
click5 CRM add-on to Ninja Forms WordPress: CSRF (request forgery)
click5 CRM add-on to Ninja Forms WordPress · CVSS 9.8 · threat: Critical
CSRF (request forgery) in the click5 CRM add-on to Ninja Forms WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-84251.
click5 CRM add-on to WPForms WordPress: CSRF (request forgery)
click5 CRM add-on to WPForms WordPress · CVSS 9.8 · threat: Critical
CSRF (request forgery) in the click5 CRM add-on to WPForms WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-84252.
click5 CRM add-on to Gravity Forms WordPress: CSRF (request forgery)
click5 CRM add-on to Gravity Forms WordPress · CVSS 9.8 · threat: Critical
CSRF (request forgery) in the click5 CRM add-on to Gravity Forms WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-84253.
click5 CRM add-on to Contact Form 7 WordPress: CSRF (request forgery)
click5 CRM add-on to Contact Form 7 WordPress · CVSS 9.8 · threat: Critical
CSRF (request forgery) in the click5 CRM add-on to Contact Form 7 WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-84254.
Mindstien Quick Login WordPress: security vulnerability
Mindstien Quick Login WordPress · CVSS 9.8 · threat: Critical
Security vulnerability in the Mindstien Quick Login WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-84734.
Freeton WP WordPress: security vulnerability
Freeton WP WordPress · CVSS 9.8 · threat: Critical
Security vulnerability in the Freeton WP WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-84737.
AI Content Generator Marketing WordPress: security vulnerability
AI Content Generator Marketing WordPress · CVSS 9.8 · threat: Critical
Security vulnerability in the AI Content Generator Marketing WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-85118.
Fundiin cho WooCommerce WordPress: cross-site scripting (XSS)
Fundiin cho WooCommerce WordPress · CVSS 9.1 · threat: Critical
Cross-site scripting (XSS) in the Fundiin cho WooCommerce WordPress component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-81649.
Insurify WordPress: security vulnerability
Insurify WordPress · CVSS 9.1 · threat: Critical
Security vulnerability in the Insurify WordPress component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-85121.
Quick quotes WordPress: security vulnerability
Quick quotes WordPress · CVSS 9.1 · threat: Critical
Security vulnerability in the Quick quotes WordPress component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-86706.
Insurify WordPress: security vulnerability
Insurify WordPress · CVSS 9.1 · threat: Critical
Security vulnerability in the Insurify WordPress component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-86717.
Prenotazioni WordPress: cross-site scripting (XSS)
Prenotazioni WordPress · CVSS 8.8 · threat: High
Cross-site scripting (XSS) in the Prenotazioni WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-103305.
Mobile builder WordPress: security vulnerability
Mobile builder WordPress · CVSS 8.8 · threat: High
Security vulnerability in the Mobile builder WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-103694.
click5 CRM add-on to Ninja Forms WordPress: cross-site scripting (XSS)
click5 CRM add-on to Ninja Forms WordPress · CVSS 8.8 · threat: High
Cross-site scripting (XSS) in the click5 CRM add-on to Ninja Forms WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-84258.
click5 CRM add-on to WPForms WordPress: cross-site scripting (XSS)
click5 CRM add-on to WPForms WordPress · CVSS 8.8 · threat: High
Cross-site scripting (XSS) in the click5 CRM add-on to WPForms WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-84259.
click5 CRM add-on to Gravity Forms WordPress: cross-site scripting (XSS)
click5 CRM add-on to Gravity Forms WordPress · CVSS 8.8 · threat: High
Cross-site scripting (XSS) in the click5 CRM add-on to Gravity Forms WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-84260.
click5 CRM add-on to Contact Form 7 WordPress: cross-site scripting (XSS)
click5 CRM add-on to Contact Form 7 WordPress · CVSS 8.8 · threat: High
Cross-site scripting (XSS) in the click5 CRM add-on to Contact Form 7 WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-84261.
HootBoard WordPress: security vulnerability
HootBoard WordPress · CVSS 8.8 · threat: High
Security vulnerability in the HootBoard WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-86798.
Web Vitals Tracking WordPress: cross-site scripting (XSS)
Web Vitals Tracking WordPress · CVSS 8.8 · threat: High
Cross-site scripting (XSS) in the Web Vitals Tracking WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-87760.
Adwised Web Push Notification WordPress: security vulnerability
Adwised Web Push Notification WordPress · CVSS 8.8 · threat: High
Security vulnerability in the Adwised Web Push Notification WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-87762.
BuddyPress Instant Chat WordPress: security vulnerability
BuddyPress Instant Chat WordPress · CVSS 8.8 · threat: High
Security vulnerability in the BuddyPress Instant Chat WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-87764.
SmugMug Embed WordPress: CSRF (request forgery)
SmugMug Embed WordPress · CVSS 8.8 · threat: High
CSRF (request forgery) in the SmugMug Embed WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-88826.
Disable Users WordPress: security vulnerability
Disable Users WordPress · CVSS 8.8 · threat: High
Security vulnerability in the Disable Users WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-88827.
Topcontent WordPress: security vulnerability
Topcontent WordPress · CVSS 8.8 · threat: High
Security vulnerability in the Topcontent WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-88903.
KeyWord Collector WordPress: security vulnerability
KeyWord Collector WordPress · CVSS 8.8 · threat: High
Security vulnerability in the KeyWord Collector WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-88905.
Piotnet Forms WordPress: cross-site scripting (XSS)
Piotnet Forms WordPress · CVSS 8.8 · threat: High
Cross-site scripting (XSS) in the Piotnet Forms WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-96227.
Mobile builder WordPress: SQL injection
Mobile builder WordPress · CVSS 8.6 · threat: High
SQL injection in the Mobile builder WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-103695.
Tcard WP WordPress: SQL injection
Tcard WP WordPress · CVSS 8.6 · threat: High
SQL injection in the Tcard WP WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-81420.
Social Web Suite WordPress: SQL injection
Social Web Suite WordPress · CVSS 8.6 · threat: High
SQL injection in the Social Web Suite WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-88930.
Site Setup Wizard WordPress: SQL injection
Site Setup Wizard WordPress · CVSS 8.6 · threat: High
SQL injection in the Site Setup Wizard WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89195.
Llavero.io WordPress: SQL injection
Llavero.io WordPress · CVSS 8.6 · threat: High
SQL injection in the Llavero.io WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89213.
WpCues Basic Quiz WordPress: SQL injection
WpCues Basic Quiz WordPress · CVSS 8.6 · threat: High
SQL injection in the WpCues Basic Quiz WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89214.
Recordbrowser WordPress: sensitive data disclosure
Recordbrowser WordPress · CVSS 8.6 · threat: High
Sensitive data disclosure in the Recordbrowser WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89232.
WP-Partner WordPress: sensitive data disclosure
WP-Partner WordPress · CVSS 8.6 · threat: High
Sensitive data disclosure in the WP-Partner WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89234.
WP Posts Password Batch Manager WordPress: security vulnerability
WP Posts Password Batch Manager WordPress · CVSS 8.6 · threat: High
Security vulnerability in the WP Posts Password Batch Manager WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89283.
Datalist it WordPress: SQL injection
Datalist it WordPress · CVSS 8.6 · threat: High
SQL injection in the Datalist it WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89285.
ASPL Product Quotation WordPress: SQL injection
ASPL Product Quotation WordPress · CVSS 8.6 · threat: High
SQL injection in the ASPL Product Quotation WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89287.
Loja Automática WordPress: SQL injection
Loja Automática WordPress · CVSS 8.6 · threat: High
SQL injection in the Loja Automática WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89297.
WP Verify API WordPress: SQL injection
WP Verify API WordPress · CVSS 8.6 · threat: High
SQL injection in the WP Verify API WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89299.
Post Voting System WordPress: SQL injection
Post Voting System WordPress · CVSS 8.6 · threat: High
SQL injection in the Post Voting System WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89302.
Adwised Web Push Notification WordPress: cross-site scripting (XSS)
Adwised Web Push Notification WordPress · CVSS 8 · threat: High
Cross-site scripting (XSS) in the Adwised Web Push Notification WordPress component. Threat level: High (CVSS 8).
Details and what to do: CVE-2026-87761.
WeddingCity Lite WordPress: security vulnerability
WeddingCity Lite WordPress · CVSS 7.5 · threat: High
Security vulnerability in the WeddingCity Lite WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-106029.
WooCommerce Bookings WordPress: security vulnerability
WooCommerce Bookings WordPress · CVSS 7.5 · threat: High
Security vulnerability in the WooCommerce Bookings WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-14854.
Envira Gallery WordPress: security vulnerability
Envira Gallery WordPress · CVSS 7.2 · threat: High
Security vulnerability in the Envira Gallery WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-104680.
Crowdfundly WordPress: security vulnerability
Crowdfundly WordPress · CVSS 7.2 · threat: High
Security vulnerability in the Crowdfundly WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-85126.
MultiVendorX WordPress: security vulnerability
MultiVendorX WordPress · CVSS 7.1 · threat: High
Security vulnerability in the MultiVendorX WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-108695.
Subscribe to Comments WordPress: cross-site scripting (XSS)
Subscribe to Comments WordPress · CVSS 7.1 · threat: High
Cross-site scripting (XSS) in the Subscribe to Comments WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-91829.
Advanced IP Blocker: authentication bypass
Advanced IP Blocker · CVSS 9.8 · threat: Critical
Authentication bypass in the Advanced IP Blocker component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-104732.
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection): remote code execution (RCE)
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-94589.
3D Product configurator for WooCommerce: remote code execution (RCE)
3D Product configurator for WooCommerce · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the 3D Product configurator for WooCommerce component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-103889.
WPCOM Member: authentication bypass
WPCOM Member · CVSS 9.8 · threat: Critical
Authentication bypass in the WPCOM Member component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-104803.
rtMedia for WordPress: directory traversal
rtMedia for WordPress · CVSS 9.8 · threat: Critical
Directory traversal in the rtMedia for WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-105892.
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress: PHP object injection
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress · CVSS 9.8 · threat: Critical
PHP object injection in the Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-81797.
Blocksy Companion: privilege escalation
Blocksy Companion · CVSS 9.1 · threat: Critical
Privilege escalation in the Blocksy Companion component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-107645.
Avada (Fusion) Builder: security vulnerability
Avada (Fusion) Builder · CVSS 9.1 · threat: Critical
Security vulnerability in the Avada (Fusion) Builder component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-97670.
PPOM - Product Addons & Custom Fields for WooCommerce: remote code execution (RCE)
PPOM - Product Addons & Custom Fields for WooCommerce · CVSS 9.1 · threat: Critical
Remote code execution (RCE) in the PPOM - Product Addons & Custom Fields for WooCommerce component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-104801.
LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes: insecure deserialization
LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes · CVSS 8.8 · threat: High
Insecure deserialization in the LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-104723.
Groundhogg: CRM, Newsletters, and Marketing Automation: privilege escalation
Groundhogg: CRM, Newsletters, and Marketing Automation · CVSS 8.8 · threat: High
Privilege escalation in the Groundhogg: CRM, Newsletters, and Marketing Automation component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-104725.
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress: privilege escalation
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress · CVSS 8.8 · threat: High
Privilege escalation in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-104766.
FooSales - Point of Sale (POS) for WooCommerce: account takeover
FooSales - Point of Sale (POS) for WooCommerce · CVSS 8.8 · threat: High
Account takeover in the FooSales - Point of Sale (POS) for WooCommerce component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-77183.
FV Player 8: remote code execution (RCE)
FV Player 8 · CVSS 8.8 · threat: High
Remote code execution (RCE) in the FV Player 8 component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-83526.
LTL Freight Quotes WordPress: cross-site scripting (XSS)
LTL Freight Quotes WordPress · CVSS 8.8 · threat: High
Cross-site scripting (XSS) in the LTL Freight Quotes WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-87780.
LTL Freight Quotes WordPress: SQL injection
LTL Freight Quotes WordPress · CVSS 8.6 · threat: High
SQL injection in the LTL Freight Quotes WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-87781.
Advanced Form Integration: Connect Forms to 300+ Apps: authentication bypass
Advanced Form Integration: Connect Forms to 300+ Apps · CVSS 8.1 · threat: High
Authentication bypass in the Advanced Form Integration: Connect Forms to 300+ Apps component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-104797.
GeoDirectory - WP Business Directory Plugin and Classified Listings Directory: remote code execution (RCE)
GeoDirectory - WP Business Directory Plugin and Classified Listings Directory · CVSS 8.1 · threat: High
Remote code execution (RCE) in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-104899.
Groundhogg: CRM, Newsletters, and Marketing Automation: privilege escalation
Groundhogg: CRM, Newsletters, and Marketing Automation · CVSS 8.1 · threat: High
Privilege escalation in the Groundhogg: CRM, Newsletters, and Marketing Automation component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-92975.
SMS Alert WordPress: security vulnerability
SMS Alert WordPress · CVSS 8.1 · threat: High
Security vulnerability in the SMS Alert WordPress component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-94256.
SMS Alert WordPress: security vulnerability
SMS Alert WordPress · CVSS 8.1 · threat: High
Security vulnerability in the SMS Alert WordPress component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-94257.
WP File Download: security vulnerability
WP File Download · CVSS 8.1 · threat: High
Security vulnerability in the WP File Download component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-94538.
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN): authentication bypass
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) · CVSS 8.1 · threat: High
Authentication bypass in the WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-104759.
rtMedia for WordPress, BuddyPress and bbPress: arbitrary file deletion
rtMedia for WordPress, BuddyPress and bbPress · CVSS 7.5 · threat: High
Arbitrary file deletion in the rtMedia for WordPress, BuddyPress and bbPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-89301.
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: security vulnerability
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels · CVSS 7.5 · threat: High
Security vulnerability in the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-93746.
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress: SQL injection
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress · CVSS 7.5 · threat: High
SQL injection in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-96662.
Divi Plus: remote code execution (RCE)
Divi Plus · CVSS 7.5 · threat: High
Remote code execution (RCE) in the Divi Plus component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-91136.
Fastcache by Host.it: security vulnerability
Fastcache by Host.it · CVSS 7.2 · threat: High
Security vulnerability in the Fastcache by Host.it component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-104021.
Rank Math SEO WordPress: remote code execution (RCE)
Rank Math SEO WordPress · CVSS 7.2 · threat: High
Remote code execution (RCE) in the Rank Math SEO WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-104752.
Easy Digital Downloads - eCommerce Payments and Subscriptions made easy: cross-site scripting (XSS)
Easy Digital Downloads - eCommerce Payments and Subscriptions made easy · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Easy Digital Downloads - eCommerce Payments and Subscriptions made easy component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-14335.
Podlove Podcast Publisher: cross-site scripting (XSS)
Podlove Podcast Publisher · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Podlove Podcast Publisher component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-93775.
Real Estate Manager - Property Listing and Agent Management: cross-site scripting (XSS)
Real Estate Manager - Property Listing and Agent Management · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Real Estate Manager - Property Listing and Agent Management component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96667.
Presto Player: cross-site scripting (XSS)
Presto Player · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Presto Player component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96682.
Photo Reviews for WooCommerce: cross-site scripting (XSS)
Photo Reviews for WooCommerce · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Photo Reviews for WooCommerce component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-100161.
LazyLoad Plugin - Lazy Load Images, Videos, and Iframes: cross-site scripting (XSS)
LazyLoad Plugin - Lazy Load Images, Videos, and Iframes · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the LazyLoad Plugin - Lazy Load Images, Videos, and Iframes component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-100196.
10Web Booster - Website speed optimization, Cache & Page Speed optimizer: cross-site scripting (XSS)
10Web Booster - Website speed optimization, Cache & Page Speed optimizer · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the 10Web Booster - Website speed optimization, Cache & Page Speed optimizer component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107742.
Online Scheduling and Appointment Booking System - Bookly: insecure deserialization
Online Scheduling and Appointment Booking System - Bookly · CVSS 7.2 · threat: High
Insecure deserialization in the Online Scheduling and Appointment Booking System - Bookly component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-12626.
VikBooking Hotel Booking Engine & PMS: cross-site scripting (XSS)
VikBooking Hotel Booking Engine & PMS · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the VikBooking Hotel Booking Engine & PMS component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-95684.
Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker: cross-site scripting (XSS)
Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96558.
WP Meteor Website Speed Optimization Addon: cross-site scripting (XSS)
WP Meteor Website Speed Optimization Addon · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WP Meteor Website Speed Optimization Addon component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96572.
Post Grid Gutenberg Blocks - PostX: cross-site scripting (XSS)
Post Grid Gutenberg Blocks - PostX · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Post Grid Gutenberg Blocks - PostX component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96840.
FunnelKit - Funnel Builder for WooCommerce Checkout: cross-site scripting (XSS)
FunnelKit - Funnel Builder for WooCommerce Checkout · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the FunnelKit - Funnel Builder for WooCommerce Checkout component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-100147.
WPAdverts - Classifieds Plugin: cross-site scripting (XSS)
WPAdverts - Classifieds Plugin · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WPAdverts - Classifieds Plugin component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-100178.
Molongui Authorship - Author Boxes, Guest Authors & Co-Authors for WordPress: cross-site scripting (XSS)
Molongui Authorship - Author Boxes, Guest Authors & Co-Authors for WordPress · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Molongui Authorship - Author Boxes, Guest Authors & Co-Authors for WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-101920.
WP Photo Album Plus: cross-site scripting (XSS)
WP Photo Album Plus · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WP Photo Album Plus component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96278.
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN): cross-site scripting (XSS)
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96765.
HivePress - Business Directory, Listings & Classified Ads Plugin: cross-site scripting (XSS)
HivePress - Business Directory, Listings & Classified Ads Plugin · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the HivePress - Business Directory, Listings & Classified Ads Plugin component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107657.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress: cross-site scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress · CVSS 7.1 · threat: High
Cross-site scripting (XSS) in the Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-57806.
AWP Classifieds WordPress: remote code execution (RCE)
AWP Classifieds WordPress · CVSS 8.8 · threat: High
Remote code execution (RCE) in the AWP Classifieds WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2025-15700.
FooSales WordPress: security vulnerability
FooSales WordPress · CVSS 8.8 · threat: High
Security vulnerability in the FooSales WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-93548.
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress: insecure deserialization
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress · CVSS 8.8 · threat: High
Insecure deserialization in the Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-94064.
WordPress: cross-site scripting (XSS)
WordPress · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-81929.
Ultimate Multisite WordPress: security vulnerability
Ultimate Multisite WordPress · CVSS 9.8 · threat: Critical
Security vulnerability in the Ultimate Multisite WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-103646.
Frontend Dashboard WordPress: security vulnerability
Frontend Dashboard WordPress · CVSS 9.8 · threat: Critical
Security vulnerability in the Frontend Dashboard WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-103692.
Bricksforge: arbitrary file upload
Bricksforge · CVSS 9.8 · threat: Critical
Arbitrary file upload in the Bricksforge component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-85097.
Super Forms - Drag & Drop Form Builder: security vulnerability
Super Forms - Drag & Drop Form Builder · CVSS 9.1 · threat: Critical
Security vulnerability in the Super Forms - Drag & Drop Form Builder component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-17609.
Super Forms - Drag & Drop Form Builder: remote code execution (RCE)
Super Forms - Drag & Drop Form Builder · CVSS 8.8 · threat: High
Remote code execution (RCE) in the Super Forms - Drag & Drop Form Builder component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-17196.
Joomla: CSRF (request forgery)
Joomla · CVSS 8.7 · threat: High
CSRF (request forgery) in the Joomla component. Threat level: High (CVSS 8.7).
Details and what to do: CVE-2026-102784.
Uncanny Automator - AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included: insecure deserialization
Uncanny Automator - AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included · CVSS 7.5 · threat: High
Insecure deserialization in the Uncanny Automator - AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-82627.
GPTranslate WordPress: cross-site scripting (XSS)
GPTranslate WordPress · CVSS 7.5 · threat: High
Cross-site scripting (XSS) in the GPTranslate WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-103309.
Joomla: SQL injection
Joomla · CVSS 9.3 · threat: Critical
SQL injection in the Joomla component. Threat level: Critical (CVSS 9.3).
Details and what to do: CVE-2026-102782.
Koinonia Link WordPress: security vulnerability
Koinonia Link WordPress · CVSS 8.8 · threat: High
Security vulnerability in the Koinonia Link WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-87782.
String locator WordPress: remote code execution (RCE)
String locator WordPress · CVSS 8.8 · threat: High
Remote code execution (RCE) in the String locator WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-97188.
Nexi XPay Build WordPress: security vulnerability
Nexi XPay Build WordPress · CVSS 8.2 · threat: High
Security vulnerability in the Nexi XPay Build WordPress component. Threat level: High (CVSS 8.2).
Details and what to do: CVE-2026-82211.
Nexi XPay Build WordPress: security vulnerability
Nexi XPay Build WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Nexi XPay Build WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-82212.
Kirki - Freeform Page Builder, Website Builder & Customizer: cross-site scripting (XSS)
Kirki - Freeform Page Builder, Website Builder & Customizer · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Kirki - Freeform Page Builder, Website Builder & Customizer component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-102173.
WP Coder WordPress: security vulnerability
WP Coder WordPress · CVSS 7.2 · threat: High
Security vulnerability in the WP Coder WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-104677.
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: cross-site scripting (XSS)
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-89417.
Magee Shortcodes WordPress: cross-site scripting (XSS)
Magee Shortcodes WordPress · CVSS 7.1 · threat: High
Cross-site scripting (XSS) in the Magee Shortcodes WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-105316.
If-So Dynamic Content WordPress: security vulnerability
If-So Dynamic Content WordPress · CVSS 7.1 · threat: High
Security vulnerability in the If-So Dynamic Content WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-87971.
WordPress: arbitrary file upload
WordPress · CVSS 10 · threat: Critical
Arbitrary file upload in the WordPress component. Threat level: Critical (CVSS 10).
Details and what to do: CVE-2026-32579.
ACPT (Premium): remote code execution (RCE)
ACPT (Premium) · CVSS 8.8 · threat: High
Remote code execution (RCE) in the ACPT (Premium) component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-105701.
Subscriber Privilege Escalation in JobZilla - Job Board WordPress: privilege escalation
Subscriber Privilege Escalation in JobZilla - Job Board WordPress · CVSS 8.8 · threat: High
Privilege escalation in the Subscriber Privilege Escalation in JobZilla - Job Board WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-39775.
WordPress: arbitrary file deletion
WordPress · CVSS 7.7 · threat: High
Arbitrary file deletion in the WordPress component. Threat level: High (CVSS 7.7).
Details and what to do: CVE-2026-39752.
WordPress: security vulnerability
WordPress · CVSS 7.5 · threat: High
Security vulnerability in the WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-41559.
Post SMTP - Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: cross-site scripting (XSS)
Post SMTP - Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Post SMTP - Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-75962.
Joomla: SQL injection
Joomla · CVSS 9.3 · threat: Critical
SQL injection in the Joomla component. Threat level: Critical (CVSS 9.3).
Details and what to do: CVE-2026-102428.
Joomla: security vulnerability
Joomla · CVSS 8.7 · threat: High
Security vulnerability in the Joomla component. Threat level: High (CVSS 8.7).
Details and what to do: CVE-2026-102775.
You will find the full, continuously updated list on the Current threats page.
Not sure whether your website is safe? Request a free audit and we will check it against these and other threats.