Website security: weekly review (19.10.2026)
A short review of freshly disclosed vulnerabilities in popular systems (WordPress, Joomla) from the last few days. If you use any of the plugins or versions listed below, treat it as a signal to update.
Modern Events Calendar Lite WordPress: SQL injection
Modern Events Calendar Lite WordPress · CVSS 7.7 · threat: High
SQL injection in the Modern Events Calendar Lite WordPress component. Threat level: High (CVSS 7.7).
Details and what to do: CVE-2026-96534.
Salon Booking System WordPress: security vulnerability
Salon Booking System WordPress · CVSS 7.2 · threat: High
Security vulnerability in the Salon Booking System WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-110031.
WP Photo Album Plus WordPress: security vulnerability
WP Photo Album Plus WordPress · CVSS 7.1 · threat: High
Security vulnerability in the WP Photo Album Plus WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-110981.
LearnPress: insecure deserialization
LearnPress · CVSS 9.8 · threat: Critical
Insecure deserialization in the LearnPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-104736.
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress: authentication bypass
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress · CVSS 9.1 · threat: Critical
Authentication bypass in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-110653.
User Registration & Membership: remote code execution (RCE)
User Registration & Membership · CVSS 8.1 · threat: High
Remote code execution (RCE) in the User Registration & Membership component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-92798.
Kirki - Freeform Page Builder, Website Builder & Customizer: security vulnerability
Kirki - Freeform Page Builder, Website Builder & Customizer · CVSS 7.5 · threat: High
Security vulnerability in the Kirki - Freeform Page Builder, Website Builder & Customizer component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-107762.
WP Booking System - Booking Calendar: security vulnerability
WP Booking System - Booking Calendar · CVSS 7.5 · threat: High
Security vulnerability in the WP Booking System - Booking Calendar component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-108123.
Kirki - Freeform Page Builder, Website Builder & Customizer: insecure deserialization
Kirki - Freeform Page Builder, Website Builder & Customizer · CVSS 7.2 · threat: High
Insecure deserialization in the Kirki - Freeform Page Builder, Website Builder & Customizer component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-104734.
LearnPress - WordPress LMS Plugin for Create and Sell Online Courses: cross-site scripting (XSS)
LearnPress - WordPress LMS Plugin for Create and Sell Online Courses · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the LearnPress - WordPress LMS Plugin for Create and Sell Online Courses component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109208.
EU VAT Assistant for WooCommerce: privilege escalation
EU VAT Assistant for WooCommerce · CVSS 7.2 · threat: High
Privilege escalation in the EU VAT Assistant for WooCommerce component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-103899.
User Registration & Membership - Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder: cross-site scripting (XSS)
User Registration & Membership - Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the User Registration & Membership - Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96660.
European VAT Compliance Assistant for WooCommerce: cross-site scripting (XSS)
European VAT Compliance Assistant for WooCommerce · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the European VAT Compliance Assistant for WooCommerce component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-100316.
Payment forms, Buy now buttons, and Invoicing System | GetPaid: cross-site scripting (XSS)
Payment forms, Buy now buttons, and Invoicing System | GetPaid · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Payment forms, Buy now buttons, and Invoicing System | GetPaid component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-111110.
Fancy Comments WordPress: cross-site scripting (XSS)
Fancy Comments WordPress · CVSS 7.1 · threat: High
Cross-site scripting (XSS) in the Fancy Comments WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-110384.
My Calendar - Accessible Event Manager: privilege escalation
My Calendar - Accessible Event Manager · CVSS 9.8 · threat: Critical
Privilege escalation in the My Calendar - Accessible Event Manager component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-104798.
Mang Board: remote code execution (RCE)
Mang Board · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Mang Board component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-109219.
MailOptin - Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.: privilege escalation
MailOptin - Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. · CVSS 9.8 · threat: Critical
Privilege escalation in the MailOptin - Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-109515.
ELEX WordPress HelpDesk & Customer Ticketing System: remote code execution (RCE)
ELEX WordPress HelpDesk & Customer Ticketing System · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the ELEX WordPress HelpDesk & Customer Ticketing System component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-103768.
Theme My Login: account takeover
Theme My Login · CVSS 9.8 · threat: Critical
Account takeover in the Theme My Login component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-89079.
Sunshine Photo Cart - Client Photo Gallery & Photo Proofing for Photographers: insecure deserialization
Sunshine Photo Cart - Client Photo Gallery & Photo Proofing for Photographers · CVSS 9.8 · threat: Critical
Insecure deserialization in the Sunshine Photo Cart - Client Photo Gallery & Photo Proofing for Photographers component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-104730.
PilotPress: account takeover
PilotPress · CVSS 8.8 · threat: High
Account takeover in the PilotPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-85659.
Salon Booking System WordPress: security vulnerability
Salon Booking System WordPress · CVSS 8.8 · threat: High
Security vulnerability in the Salon Booking System WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-110015.
WP Photo Album Plus: remote code execution (RCE)
WP Photo Album Plus · CVSS 8.8 · threat: High
Remote code execution (RCE) in the WP Photo Album Plus component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-92115.
YaySMTP - WP Mail SMTP with Email Logs, Tracking & Reports: remote code execution (RCE)
YaySMTP - WP Mail SMTP with Email Logs, Tracking & Reports · CVSS 8.8 · threat: High
Remote code execution (RCE) in the YaySMTP - WP Mail SMTP with Email Logs, Tracking & Reports component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-92553.
DoubleScale | All-in-One CRM - Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More: remote code execution (RCE)
DoubleScale | All-in-One CRM - Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More · CVSS 8.8 · threat: High
Remote code execution (RCE) in the DoubleScale | All-in-One CRM - Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-111311.
Customer Email Verification for WooCommerce: privilege escalation
Customer Email Verification for WooCommerce · CVSS 8.1 · threat: High
Privilege escalation in the Customer Email Verification for WooCommerce component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-104745.
miniOrange OTP Login, Verification and SMS Notifications: authentication bypass
miniOrange OTP Login, Verification and SMS Notifications · CVSS 8.1 · threat: High
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-103895.
Groundhogg: CRM, Newsletters, and Marketing Automation: remote code execution (RCE)
Groundhogg: CRM, Newsletters, and Marketing Automation · CVSS 8.1 · threat: High
Remote code execution (RCE) in the Groundhogg: CRM, Newsletters, and Marketing Automation component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-109221.
User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor: privilege escalation
User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 8.1 · threat: High
Privilege escalation in the User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-109447.
Vulnity Security: authentication bypass
Vulnity Security · CVSS 8.1 · threat: High
Authentication bypass in the Vulnity Security component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-75903.
Backuply - Backup, Restore, Migrate and Clone: SQL injection
Backuply - Backup, Restore, Migrate and Clone · CVSS 8 · threat: High
SQL injection in the Backuply - Backup, Restore, Migrate and Clone component. Threat level: High (CVSS 8).
Details and what to do: CVE-2026-93953.
Search Regex: insecure deserialization
Search Regex · CVSS 8 · threat: High
Insecure deserialization in the Search Regex component. Threat level: High (CVSS 8).
Details and what to do: CVE-2026-104932.
FluentCart A New Era of eCommerce - Faster, Lighter, and Simpler: security vulnerability
FluentCart A New Era of eCommerce - Faster, Lighter, and Simpler · CVSS 7.5 · threat: High
Security vulnerability in the FluentCart A New Era of eCommerce - Faster, Lighter, and Simpler component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-103525.
Modula Image Gallery - Photo Grid & Video Gallery: sensitive data disclosure
Modula Image Gallery - Photo Grid & Video Gallery · CVSS 7.5 · threat: High
Sensitive data disclosure in the Modula Image Gallery - Photo Grid & Video Gallery component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-107659.
FunnelKit - Funnel Builder for WooCommerce Checkout: security vulnerability
FunnelKit - Funnel Builder for WooCommerce Checkout · CVSS 7.5 · threat: High
Security vulnerability in the FunnelKit - Funnel Builder for WooCommerce Checkout component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-107746.
InstaWP Connect - 1-click WP Staging & Migration: privilege escalation
InstaWP Connect - 1-click WP Staging & Migration · CVSS 7.5 · threat: High
Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-109400.
Klarna for WooCommerce: security vulnerability
Klarna for WooCommerce · CVSS 7.5 · threat: High
Security vulnerability in the Klarna for WooCommerce component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-110590.
Nexter Extension - Security, Performance, Code Snippets & Site Toolkit: privilege escalation
Nexter Extension - Security, Performance, Code Snippets & Site Toolkit · CVSS 7.5 · threat: High
Privilege escalation in the Nexter Extension - Security, Performance, Code Snippets & Site Toolkit component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-111114.
10Web Booster - Website speed optimization, Cache & Page Speed optimizer: remote code execution (RCE)
10Web Booster - Website speed optimization, Cache & Page Speed optimizer · CVSS 7.5 · threat: High
Remote code execution (RCE) in the 10Web Booster - Website speed optimization, Cache & Page Speed optimizer component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-103896.
Vitepos - Point of Sale (POS) for WooCommerce: SQL injection
Vitepos - Point of Sale (POS) for WooCommerce · CVSS 7.5 · threat: High
SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-92766.
OTP Login & Register Woocommerce WordPress: security vulnerability
OTP Login & Register Woocommerce WordPress · CVSS 7.4 · threat: High
Security vulnerability in the OTP Login & Register Woocommerce WordPress component. Threat level: High (CVSS 7.4).
Details and what to do: CVE-2026-110135.
Colibri Page Builder: cross-site scripting (XSS)
Colibri Page Builder · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Colibri Page Builder component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107758.
RSS Aggregator by Feedzy - Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: cross-site scripting (XSS)
RSS Aggregator by Feedzy - Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the RSS Aggregator by Feedzy - Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109207.
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance: cross-site scripting (XSS)
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Flying Scripts: Delay JavaScript to Improve Site Speed & Performance component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109990.
Complianz GDPR/CCPA Cookie Consent Banner: cross-site scripting (XSS)
Complianz GDPR/CCPA Cookie Consent Banner · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Complianz GDPR/CCPA Cookie Consent Banner component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-97339.
Mang Board: cross-site scripting (XSS)
Mang Board · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Mang Board component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109998.
User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor: cross-site scripting (XSS)
User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-100186.
Ultra Addons for Contact Form 7: arbitrary file upload
Ultra Addons for Contact Form 7 · CVSS 7.2 · threat: High
Arbitrary file upload in the Ultra Addons for Contact Form 7 component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-103999.
Simply Schedule Appointments: cross-site scripting (XSS)
Simply Schedule Appointments · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Simply Schedule Appointments component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-104000.
SiteOrigin CSS: cross-site scripting (XSS)
SiteOrigin CSS · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the SiteOrigin CSS component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107764.
Salon Booking System - Appointment Booking for Salons, Barbershops & Spas: cross-site scripting (XSS)
Salon Booking System - Appointment Booking for Salons, Barbershops & Spas · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Salon Booking System - Appointment Booking for Salons, Barbershops & Spas component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109232.
NotificationX - FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar: cross-site scripting (XSS)
NotificationX - FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the NotificationX - FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109513.
SiteOrigin CSS: cross-site scripting (XSS)
SiteOrigin CSS · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the SiteOrigin CSS component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-111122.
WP Ghost (Hide My WP Ghost) - Security & Firewall: cross-site scripting (XSS)
WP Ghost (Hide My WP Ghost) - Security & Firewall · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WP Ghost (Hide My WP Ghost) - Security & Firewall component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-89051.
Opti-Behavior - Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights: cross-site scripting (XSS)
Opti-Behavior - Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Opti-Behavior - Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-95686.
Opti-Behavior - Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights: cross-site scripting (XSS)
Opti-Behavior - Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Opti-Behavior - Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-95809.
Schema & Structured Data for WP & AMP: cross-site scripting (XSS)
Schema & Structured Data for WP & AMP · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Schema & Structured Data for WP & AMP component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96570.
TranslatePress - Translate Multilingual sites with AI Translation: cross-site scripting (XSS)
TranslatePress - Translate Multilingual sites with AI Translation · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the TranslatePress - Translate Multilingual sites with AI Translation component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107768.
HivePress - Business Directory, Listings & Classified Ads Plugin: cross-site scripting (XSS)
HivePress - Business Directory, Listings & Classified Ads Plugin · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the HivePress - Business Directory, Listings & Classified Ads Plugin component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109193.
CP Multi View Events Calendar: cross-site scripting (XSS)
CP Multi View Events Calendar · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the CP Multi View Events Calendar component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-110701.
WPConsent - Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice): cross-site scripting (XSS)
WPConsent - Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WPConsent - Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-97640.
User Registration PRO - Custom Registration Form, Login Form, and User Profile WordPress Plugin: cross-site scripting (XSS)
User Registration PRO - Custom Registration Form, Login Form, and User Profile WordPress Plugin · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the User Registration PRO - Custom Registration Form, Login Form, and User Profile WordPress Plugin component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-87111.
SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments: cross-site scripting (XSS)
SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109224.
GoSMTP Pro: cross-site scripting (XSS)
GoSMTP Pro · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the GoSMTP Pro component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96768.
WP Sessions Time Monitoring Full Automatic: cross-site scripting (XSS)
WP Sessions Time Monitoring Full Automatic · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WP Sessions Time Monitoring Full Automatic component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107648.
10Web Booster - Website speed optimization, Cache & Page Speed optimizer: remote code execution (RCE)
10Web Booster - Website speed optimization, Cache & Page Speed optimizer · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the 10Web Booster - Website speed optimization, Cache & Page Speed optimizer component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-108587.
User Rights Access Manager WordPress: security vulnerability
User Rights Access Manager WordPress · CVSS 9.8 · threat: Critical
Security vulnerability in the User Rights Access Manager WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-109145.
Email Customizer for WooCommerce (Pro): remote code execution (RCE)
Email Customizer for WooCommerce (Pro) · CVSS 8.8 · threat: High
Remote code execution (RCE) in the Email Customizer for WooCommerce (Pro) component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-81534.
Checkout Field Manager (Checkout Manager) for WooCommerce: security vulnerability
Checkout Field Manager (Checkout Manager) for WooCommerce · CVSS 8.1 · threat: High
Security vulnerability in the Checkout Field Manager (Checkout Manager) for WooCommerce component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-17031.
Link Library: SQL injection
Link Library · CVSS 7.5 · threat: High
SQL injection in the Link Library component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-15090.
Tutor LMS WordPress: security vulnerability
Tutor LMS WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Tutor LMS WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-96537.
PhastPress: SSRF (server-side request forgery)
PhastPress · CVSS 7.3 · threat: High
SSRF (server-side request forgery) in the PhastPress component. Threat level: High (CVSS 7.3).
Details and what to do: CVE-2026-3712.
Groundhogg: CRM, Newsletters, and Marketing Automation: cross-site scripting (XSS)
Groundhogg: CRM, Newsletters, and Marketing Automation · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Groundhogg: CRM, Newsletters, and Marketing Automation component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-18548.
Premium Packages - Sell Digital Products Securely: cross-site scripting (XSS)
Premium Packages - Sell Digital Products Securely · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Premium Packages - Sell Digital Products Securely component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-18586.
Mang Board WP: cross-site scripting (XSS)
Mang Board WP · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Mang Board WP component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-88043.
Document Gallery WordPress: cross-site scripting (XSS)
Document Gallery WordPress · CVSS 7.1 · threat: High
Cross-site scripting (XSS) in the Document Gallery WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-74920.
File Upload to Order WordPress: arbitrary file upload
File Upload to Order WordPress · CVSS 10 · threat: Critical
Arbitrary file upload in the File Upload to Order WordPress component. Threat level: Critical (CVSS 10).
Details and what to do: CVE-2026-107594.
Snazzy Social Media Feed: remote code execution (RCE)
Snazzy Social Media Feed · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Snazzy Social Media Feed component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-110002.
Abandoned Cart Pro for WooCommerce: authentication bypass
Abandoned Cart Pro for WooCommerce · CVSS 9.8 · threat: Critical
Authentication bypass in the Abandoned Cart Pro for WooCommerce component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-97657.
Abandoned Cart Pro for WooCommerce: SQL injection
Abandoned Cart Pro for WooCommerce · CVSS 9.8 · threat: Critical
SQL injection in the Abandoned Cart Pro for WooCommerce component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-97668.
AGE-GATE: remote code execution (RCE)
AGE-GATE · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the AGE-GATE component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-104800.
JTL-Connector for WooCommerce: remote code execution (RCE)
JTL-Connector for WooCommerce · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the JTL-Connector for WooCommerce component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-87855.
SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications: privilege escalation
SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications · CVSS 9.8 · threat: Critical
Privilege escalation in the SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-104748.
Click to Chat for WhatsApp: remote code execution (RCE)
Click to Chat for WhatsApp · CVSS 9.1 · threat: Critical
Remote code execution (RCE) in the Click to Chat for WhatsApp component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-92097.
WP Booking System WordPress: cross-site scripting (XSS)
WP Booking System WordPress · CVSS 8.8 · threat: High
Cross-site scripting (XSS) in the WP Booking System WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-107126.
Forms WordPress: security vulnerability
Forms WordPress · CVSS 8.8 · threat: High
Security vulnerability in the Forms WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-86799.
FV Flowplayer Video Player: remote code execution (RCE)
FV Flowplayer Video Player · CVSS 8.8 · threat: High
Remote code execution (RCE) in the FV Flowplayer Video Player component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-86461.
Walletdoc Payment Gateway for WooCommerce WordPress: SQL injection
Walletdoc Payment Gateway for WooCommerce WordPress · CVSS 8.6 · threat: High
SQL injection in the Walletdoc Payment Gateway for WooCommerce WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-103307.
Ultimate Multisite WordPress: security vulnerability
Ultimate Multisite WordPress · CVSS 8.6 · threat: High
Security vulnerability in the Ultimate Multisite WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-107508.
Fast Courier WordPress: SQL injection
Fast Courier WordPress · CVSS 8.6 · threat: High
SQL injection in the Fast Courier WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89288.
BP Profile Search: remote code execution (RCE)
BP Profile Search · CVSS 8.1 · threat: High
Remote code execution (RCE) in the BP Profile Search component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-104995.
Directorist: AI-Powered Business Directory, Listings & Classified Ads: security vulnerability
Directorist: AI-Powered Business Directory, Listings & Classified Ads · CVSS 8.1 · threat: High
Security vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-17092.
ShopMagic - email automation for WordPress: remote code execution (RCE)
ShopMagic - email automation for WordPress · CVSS 8.1 · threat: High
Remote code execution (RCE) in the ShopMagic - email automation for WordPress component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-103367.
Mang Board: remote code execution (RCE)
Mang Board · CVSS 8.1 · threat: High
Remote code execution (RCE) in the Mang Board component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-104909.
Booking Package: CSRF (request forgery)
Booking Package · CVSS 7.5 · threat: High
CSRF (request forgery) in the Booking Package component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-103423.
Bit integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation: privilege escalation
Bit integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation · CVSS 7.5 · threat: High
Privilege escalation in the Bit integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-104749.
Membership & User Roles for WooCommerce (Automatic Role Changer): privilege escalation
Membership & User Roles for WooCommerce (Automatic Role Changer) · CVSS 7.5 · threat: High
Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-104767.
Abandoned Cart Pro for WooCommerce: SQL injection
Abandoned Cart Pro for WooCommerce · CVSS 7.5 · threat: High
SQL injection in the Abandoned Cart Pro for WooCommerce component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-102251.
JTL-Connector for WooCommerce: SQL injection
JTL-Connector for WooCommerce · CVSS 7.5 · threat: High
SQL injection in the JTL-Connector for WooCommerce component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-78193.
Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder: SQL injection
Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder · CVSS 7.5 · threat: High
SQL injection in the Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-95808.
Gmedia Photo Gallery: SQL injection
Gmedia Photo Gallery · CVSS 7.5 · threat: High
SQL injection in the Gmedia Photo Gallery component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-96661.
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress: security vulnerability
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-103366.
LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes: remote code execution (RCE)
LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes · CVSS 7.5 · threat: High
Remote code execution (RCE) in the LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-110284.
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress: authentication bypass
Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress · CVSS 7.4 · threat: High
Authentication bypass in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress component. Threat level: High (CVSS 7.4).
Details and what to do: CVE-2026-100163.
AnyComment: cross-site scripting (XSS)
AnyComment · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the AnyComment component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-103422.
NewStatPress: cross-site scripting (XSS)
NewStatPress · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the NewStatPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-100153.
Document Gallery: cross-site scripting (XSS)
Document Gallery · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Document Gallery component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-77114.
Contact Form DB for Enfold: cross-site scripting (XSS)
Contact Form DB for Enfold · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Contact Form DB for Enfold component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-83592.
Cryptocurrency Donation Box - Bitcoin & Crypto Donations: cross-site scripting (XSS)
Cryptocurrency Donation Box - Bitcoin & Crypto Donations · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Cryptocurrency Donation Box - Bitcoin & Crypto Donations component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-93885.
Verified Reviews (Avis Vérifiés): authentication bypass
Verified Reviews (Avis Vérifiés) · CVSS 7.2 · threat: High
Authentication bypass in the Verified Reviews (Avis Vérifiés) component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-94377.
Smart Forms - when you need more than just a contact form: cross-site scripting (XSS)
Smart Forms - when you need more than just a contact form · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Smart Forms - when you need more than just a contact form component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-95816.
FV Flowplayer Video Player: cross-site scripting (XSS)
FV Flowplayer Video Player · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the FV Flowplayer Video Player component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-97398.
NewStatPress: cross-site scripting (XSS)
NewStatPress · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the NewStatPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-101924.
affiliate-toolkit WordPress: security vulnerability
affiliate-toolkit WordPress · CVSS 7.2 · threat: High
Security vulnerability in the affiliate-toolkit WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-86787.
Post Export Import with Media: insecure deserialization
Post Export Import with Media · CVSS 7.2 · threat: High
Insecure deserialization in the Post Export Import with Media component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-104764.
Record of Consent Extension for Complianz: cross-site scripting (XSS)
Record of Consent Extension for Complianz · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Record of Consent Extension for Complianz component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107631.
Mang Board: cross-site scripting (XSS)
Mang Board · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Mang Board component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107751.
Bit integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation: cross-site scripting (XSS)
Bit integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Bit integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-102007.
AcyMailing: cross-site scripting (XSS)
AcyMailing · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the AcyMailing component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-102562.
Patreon WordPress: CSRF (request forgery)
Patreon WordPress · CVSS 8.1 · threat: High
CSRF (request forgery) in the Patreon WordPress component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-108479.
Patreon WordPress: CSRF (request forgery)
Patreon WordPress · CVSS 7.4 · threat: High
CSRF (request forgery) in the Patreon WordPress component. Threat level: High (CVSS 7.4).
Details and what to do: CVE-2026-108481.
You will find the full, continuously updated list on the Current threats page.
Not sure whether your website is safe? Request a free audit and we will check it against these and other threats.