Website security: weekly review (26.10.2026)
A short review of freshly disclosed vulnerabilities in popular systems (WordPress, Joomla) from the last few days. If you use any of the plugins or versions listed below, treat it as a signal to update.
Prime Mover - Backup and Migration: insecure deserialization
Prime Mover - Backup and Migration · CVSS 9.8 · threat: Critical
Insecure deserialization in the Prime Mover - Backup and Migration component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-115806.
asVereinbase WordPress: security vulnerability
asVereinbase WordPress · CVSS 9.8 · threat: Critical
Security vulnerability in the asVereinbase WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-110956.
aBlocks - Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: privilege escalation
aBlocks - Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder · CVSS 8.8 · threat: High
Privilege escalation in the aBlocks - Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-110018.
GeoDirectory WordPress: remote code execution (RCE)
GeoDirectory WordPress · CVSS 7.2 · threat: High
Remote code execution (RCE) in the GeoDirectory WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-113673.
User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor: privilege escalation
User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 7.1 · threat: High
Privilege escalation in the User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-115807.
Download Monitor WordPress: security vulnerability
Download Monitor WordPress · CVSS 7.1 · threat: High
Security vulnerability in the Download Monitor WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-112207.
Advanced Custom Fields: Extended WordPress: remote code execution (RCE)
Advanced Custom Fields: Extended WordPress · CVSS 9 · threat: Critical
Remote code execution (RCE) in the Advanced Custom Fields: Extended WordPress component. Threat level: Critical (CVSS 9).
Details and what to do: CVE-2026-94267.
GTM Server Side: security vulnerability
GTM Server Side · CVSS 8.7 · threat: High
Security vulnerability in the GTM Server Side component. Threat level: High (CVSS 8.7).
Details and what to do: CVE-2026-55826.
Joomla: cross-site scripting (XSS)
Joomla · CVSS 8.6 · threat: High
Cross-site scripting (XSS) in the Joomla component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-102786.
Advanced Custom Fields: Extended WordPress: security vulnerability
Advanced Custom Fields: Extended WordPress · CVSS 8.1 · threat: High
Security vulnerability in the Advanced Custom Fields: Extended WordPress component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-94262.
Advanced Custom Fields: Extended WordPress: security vulnerability
Advanced Custom Fields: Extended WordPress · CVSS 8.1 · threat: High
Security vulnerability in the Advanced Custom Fields: Extended WordPress component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-94268.
Music Store - WordPress eCommerce: directory traversal
Music Store - WordPress eCommerce · CVSS 7.5 · threat: High
Directory traversal in the Music Store - WordPress eCommerce component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-115497.
Otter Blocks WordPress: cross-site scripting (XSS)
Otter Blocks WordPress · CVSS 7.5 · threat: High
Cross-site scripting (XSS) in the Otter Blocks WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-109936.
LiteSpeed Cache WordPress: security vulnerability
LiteSpeed Cache WordPress · CVSS 7.5 · threat: High
Security vulnerability in the LiteSpeed Cache WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-113499.
LiteSpeed Cache WordPress: security vulnerability
LiteSpeed Cache WordPress · CVSS 7.5 · threat: High
Security vulnerability in the LiteSpeed Cache WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-113500.
Anti-Spam by CleanTalk - Spam Protection Without CAPTCHA: cross-site scripting (XSS)
Anti-Spam by CleanTalk - Spam Protection Without CAPTCHA · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Anti-Spam by CleanTalk - Spam Protection Without CAPTCHA component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109198.
User Profile Builder WordPress: security vulnerability
User Profile Builder WordPress · CVSS 7.2 · threat: High
Security vulnerability in the User Profile Builder WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-111982.
Joomla: remote code execution (RCE)
Joomla · CVSS 10 · threat: Critical
Remote code execution (RCE) in the Joomla component. Threat level: Critical (CVSS 10).
Details and what to do: CVE-2026-102785.
Royal MCP WordPress: security vulnerability
Royal MCP WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Royal MCP WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-111958.
WebP Express WordPress: cross-site scripting (XSS)
WebP Express WordPress · CVSS 7.5 · threat: High
Cross-site scripting (XSS) in the WebP Express WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-97328.
HIPAA Forms WordPress: security vulnerability
HIPAA Forms WordPress · CVSS 7.2 · threat: High
Security vulnerability in the HIPAA Forms WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109927.
PixelYourSite WordPress: cross-site scripting (XSS)
PixelYourSite WordPress · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the PixelYourSite WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109987.
JetBackup: remote code execution (RCE)
JetBackup · CVSS 7.2 · threat: High
Remote code execution (RCE) in the JetBackup component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-104068.
WordPress: remote code execution (RCE)
WordPress · CVSS 8.8 · threat: High
Remote code execution (RCE) in the WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-82814.
Jane Menu WordPress: security vulnerability
Jane Menu WordPress · CVSS 8.8 · threat: High
Security vulnerability in the Jane Menu WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-85683.
WordPress Team Members - GS Plugins: insecure deserialization
WordPress Team Members - GS Plugins · CVSS 8.8 · threat: High
Insecure deserialization in the WordPress Team Members - GS Plugins component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-110369.
Click n Chat (Chat Widget Integration) WordPress: SQL injection
Click n Chat (Chat Widget Integration) WordPress · CVSS 8.6 · threat: High
SQL injection in the Click n Chat (Chat Widget Integration) WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-92997.
Click n Chat (Chat Widget Integration) WordPress: SQL injection
Click n Chat (Chat Widget Integration) WordPress · CVSS 8.6 · threat: High
SQL injection in the Click n Chat (Chat Widget Integration) WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-92998.
Backup and Staging by WP Time Capsule WordPress: security vulnerability
Backup and Staging by WP Time Capsule WordPress · CVSS 8.2 · threat: High
Security vulnerability in the Backup and Staging by WP Time Capsule WordPress component. Threat level: High (CVSS 8.2).
Details and what to do: CVE-2026-107237.
WP User Manager WordPress: security vulnerability
WP User Manager WordPress · CVSS 8.1 · threat: High
Security vulnerability in the WP User Manager WordPress component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-110523.
Falang multilanguage for WordPress: cross-site scripting (XSS)
Falang multilanguage for WordPress · CVSS 8 · threat: High
Cross-site scripting (XSS) in the Falang multilanguage for WordPress component. Threat level: High (CVSS 8).
Details and what to do: CVE-2026-105262.
Modern Events Calendar Lite WordPress: security vulnerability
Modern Events Calendar Lite WordPress · CVSS 7.7 · threat: High
Security vulnerability in the Modern Events Calendar Lite WordPress component. Threat level: High (CVSS 7.7).
Details and what to do: CVE-2026-102499.
Uncanny Toolkit for LearnDash WordPress: account takeover
Uncanny Toolkit for LearnDash WordPress · CVSS 7.5 · threat: High
Account takeover in the Uncanny Toolkit for LearnDash WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-107127.
Simple Banner WordPress: security vulnerability
Simple Banner WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Simple Banner WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-107506.
Redirection for Contact Form 7 WordPress: security vulnerability
Redirection for Contact Form 7 WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Redirection for Contact Form 7 WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-111574.
miniOrange 2FA WordPress: security vulnerability
miniOrange 2FA WordPress · CVSS 7.5 · threat: High
Security vulnerability in the miniOrange 2FA WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-111949.
Formidable Forms WordPress: security vulnerability
Formidable Forms WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Formidable Forms WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-85642.
Translate WordPress with Weglot 2.0 WordPress: security vulnerability
Translate WordPress with Weglot 2.0 WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Translate WordPress with Weglot 2.0 WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-88784.
WP Booking System WordPress: cross-site scripting (XSS)
WP Booking System WordPress · CVSS 7.1 · threat: High
Cross-site scripting (XSS) in the WP Booking System WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-109147.
User Profile Builder WordPress: cross-site scripting (XSS)
User Profile Builder WordPress · CVSS 7.1 · threat: High
Cross-site scripting (XSS) in the User Profile Builder WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-111948.
Advanced File Manager WordPress: security vulnerability
Advanced File Manager WordPress · CVSS 7.1 · threat: High
Security vulnerability in the Advanced File Manager WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-79627.
EventON - Subscriber: SQL injection
EventON - Subscriber · CVSS 7.5 · threat: High
SQL injection in the EventON - Subscriber component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-93300.
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected: security vulnerability
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected · CVSS 9.8 · threat: Critical
Security vulnerability in the Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-111862.
You will find the full, continuously updated list on the Current threats page.
Not sure whether your website is safe? Request a free audit and we will check it against these and other threats.