Website security: weekly review (02.11.2026)
A short review of freshly disclosed vulnerabilities in popular systems (WordPress, Joomla) from the last few days. If you use any of the plugins or versions listed below, treat it as a signal to update.
WordPress File Upload: arbitrary file upload
WordPress File Upload · CVSS 7.1 · threat: High
Arbitrary file upload in the WordPress File Upload component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-66570.
PDF Invoice for WooCommerce + Drag and Drop Template Builder: insecure deserialization
PDF Invoice for WooCommerce + Drag and Drop Template Builder · CVSS 9.8 · threat: Critical
Insecure deserialization in the PDF Invoice for WooCommerce + Drag and Drop Template Builder component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-109220.
Project Manager - AI Powered Project Management, Task Management, Kanban Board & Time Tracker: remote code execution (RCE)
Project Manager - AI Powered Project Management, Task Management, Kanban Board & Time Tracker · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Project Manager - AI Powered Project Management, Task Management, Kanban Board & Time Tracker component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-116512.
Uncanny Toolkit for LearnDash: authentication bypass
Uncanny Toolkit for LearnDash · CVSS 9.8 · threat: Critical
Authentication bypass in the Uncanny Toolkit for LearnDash component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-119096.
SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications: remote code execution (RCE)
SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-118235.
WP Booking System - Booking Calendar: security vulnerability
WP Booking System - Booking Calendar · CVSS 9.1 · threat: Critical
Security vulnerability in the WP Booking System - Booking Calendar component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-116557.
Popup Builder - Create highly converting, mobile friendly marketing popups.: security vulnerability
Popup Builder - Create highly converting, mobile friendly marketing popups. · CVSS 9.1 · threat: Critical
Security vulnerability in the Popup Builder - Create highly converting, mobile friendly marketing popups. component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-89270.
Acadlix LMS - AI Quiz Maker, Online Exam & Course: remote code execution (RCE)
Acadlix LMS - AI Quiz Maker, Online Exam & Course · CVSS 9.1 · threat: Critical
Remote code execution (RCE) in the Acadlix LMS - AI Quiz Maker, Online Exam & Course component. Threat level: Critical (CVSS 9.1).
Details and what to do: CVE-2026-103882.
Rox Appointment Booking - Appointment Booking Scheduling Solution: account takeover
Rox Appointment Booking - Appointment Booking Scheduling Solution · CVSS 8.8 · threat: High
Account takeover in the Rox Appointment Booking - Appointment Booking Scheduling Solution component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-104012.
User Frontend - Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission: privilege escalation
User Frontend - Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission · CVSS 8.8 · threat: High
Privilege escalation in the User Frontend - Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-120070.
Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery: remote code execution (RCE)
Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery · CVSS 8.8 · threat: High
Remote code execution (RCE) in the Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-76010.
WordPress: remote code execution (RCE)
WordPress · CVSS 8.1 · threat: High
Remote code execution (RCE) in the WordPress component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-119977.
Wp Social Login and Register Social Counter: authentication bypass
Wp Social Login and Register Social Counter · CVSS 8.1 · threat: High
Authentication bypass in the Wp Social Login and Register Social Counter component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-103898.
FunnelKit Automations - Email Marketing Automation and CRM for WordPress & WooCommerce: SQL injection
FunnelKit Automations - Email Marketing Automation and CRM for WordPress & WooCommerce · CVSS 7.5 · threat: High
SQL injection in the FunnelKit Automations - Email Marketing Automation and CRM for WordPress & WooCommerce component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-119163.
Mail logging & Catcher: sensitive data disclosure
Mail logging & Catcher · CVSS 7.5 · threat: High
Sensitive data disclosure in the Mail logging & Catcher component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-120040.
WP Directory Kit: SQL injection
WP Directory Kit · CVSS 7.5 · threat: High
SQL injection in the WP Directory Kit component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-109197.
Security Optimizer WordPress: security vulnerability
Security Optimizer WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Security Optimizer WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-118185.
Mapster WP Maps WordPress: security vulnerability
Mapster WP Maps WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Mapster WP Maps WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-118638.
Meow Lightbox: cross-site scripting (XSS)
Meow Lightbox · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Meow Lightbox component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109234.
Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: cross-site scripting (XSS)
Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109997.
PPWP - Password Protect Pages: cross-site scripting (XSS)
PPWP - Password Protect Pages · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the PPWP - Password Protect Pages component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-116520.
SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments: cross-site scripting (XSS)
SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107653.
PDF Invoices & Packing Slips for WooCommerce: cross-site scripting (XSS)
PDF Invoices & Packing Slips for WooCommerce · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the PDF Invoices & Packing Slips for WooCommerce component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107750.
W3 Total Cache: cross-site scripting (XSS)
W3 Total Cache · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the W3 Total Cache component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-111254.
VikRentCar Car Rental Management System: cross-site scripting (XSS)
VikRentCar Car Rental Management System · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the VikRentCar Car Rental Management System component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-115840.
Relevanssi - A Better Search: cross-site scripting (XSS)
Relevanssi - A Better Search · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Relevanssi - A Better Search component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-116522.
VikRentCar Car Rental Management System: cross-site scripting (XSS)
VikRentCar Car Rental Management System · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the VikRentCar Car Rental Management System component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-116548.
Welcart e-Commerce: cross-site scripting (XSS)
Welcart e-Commerce · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Welcart e-Commerce component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-118070.
Shipping Zones by Drawing for WooCommerce: cross-site scripting (XSS)
Shipping Zones by Drawing for WooCommerce · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Shipping Zones by Drawing for WooCommerce component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-119065.
ThirstyAffiliates - Affiliate Links, Link Branding, Link Tracking & Marketing Plugin: cross-site scripting (XSS)
ThirstyAffiliates - Affiliate Links, Link Branding, Link Tracking & Marketing Plugin · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the ThirstyAffiliates - Affiliate Links, Link Branding, Link Tracking & Marketing Plugin component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-119089.
User Submitted Posts - Enable Users to Submit Posts from the Front End: cross-site scripting (XSS)
User Submitted Posts - Enable Users to Submit Posts from the Front End · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the User Submitted Posts - Enable Users to Submit Posts from the Front End component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-119162.
WPO365 | MICROSOFT 365 GRAPH MAILER: cross-site scripting (XSS)
WPO365 | MICROSOFT 365 GRAPH MAILER · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WPO365 | MICROSOFT 365 GRAPH MAILER component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107759.
Shield Security - Smart Bot Blocking, Brute-Force Login Protection & File Scanning: cross-site scripting (XSS)
Shield Security - Smart Bot Blocking, Brute-Force Login Protection & File Scanning · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Shield Security - Smart Bot Blocking, Brute-Force Login Protection & File Scanning component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-118057.
FeedWordPress: cross-site scripting (XSS)
FeedWordPress · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the FeedWordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-110530.
WP Activity Log: cross-site scripting (XSS)
WP Activity Log · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the WP Activity Log component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-120075.
Debug Log Manager - Conveniently Monitor and Inspect Errors: cross-site scripting (XSS)
Debug Log Manager - Conveniently Monitor and Inspect Errors · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Debug Log Manager - Conveniently Monitor and Inspect Errors component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-120114.
Bulk Media Register WordPress: security vulnerability
Bulk Media Register WordPress · CVSS 7.2 · threat: High
Security vulnerability in the Bulk Media Register WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-118043.
Gravity Forms: remote code execution (RCE)
Gravity Forms · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Gravity Forms component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-103039.
Export and Import Users and Customers: privilege escalation
Export and Import Users and Customers · CVSS 8.8 · threat: High
Privilege escalation in the Export and Import Users and Customers component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-104368.
WP Visitor Statistics (Real Time Traffic) WordPress: security vulnerability
WP Visitor Statistics (Real Time Traffic) WordPress · CVSS 8.8 · threat: High
Security vulnerability in the WP Visitor Statistics (Real Time Traffic) WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-117571.
Formidable Forms - WordPress Form Builder for Contact Forms, Calculators, Quizzes & More: security vulnerability
Formidable Forms - WordPress Form Builder for Contact Forms, Calculators, Quizzes & More · CVSS 8.8 · threat: High
Security vulnerability in the Formidable Forms - WordPress Form Builder for Contact Forms, Calculators, Quizzes & More component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-89435.
Ak Framework: privilege escalation
Ak Framework · CVSS 8.8 · threat: High
Privilege escalation in the Ak Framework component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-105894.
Database Cleaner: security vulnerability
Database Cleaner · CVSS 8.7 · threat: High
Security vulnerability in the Database Cleaner component. Threat level: High (CVSS 8.7).
Details and what to do: CVE-2025-8574.
Avada | Website Builder For WordPress & WooCommerce: remote code execution (RCE)
Avada | Website Builder For WordPress & WooCommerce · CVSS 8.1 · threat: High
Remote code execution (RCE) in the Avada | Website Builder For WordPress & WooCommerce component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-115346.
Kirki: security vulnerability
Kirki · CVSS 7.6 · threat: High
Security vulnerability in the Kirki component. Threat level: High (CVSS 7.6).
Details and what to do: CVE-2026-112347.
Enable Media Replace WordPress: remote code execution (RCE)
Enable Media Replace WordPress · CVSS 7.5 · threat: High
Remote code execution (RCE) in the Enable Media Replace WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-114422.
Security: security vulnerability
Security · CVSS 7.5 · threat: High
Security vulnerability in the Security component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-114443.
AI Engine - The Chatbot, AI Framework & MCP for WordPress: security vulnerability
AI Engine - The Chatbot, AI Framework & MCP for WordPress · CVSS 7.5 · threat: High
Security vulnerability in the AI Engine - The Chatbot, AI Framework & MCP for WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-110732.
Email Templates Customizer and Designer for WordPress and WooCommerce: security vulnerability
Email Templates Customizer and Designer for WordPress and WooCommerce · CVSS 7.5 · threat: High
Security vulnerability in the Email Templates Customizer and Designer for WordPress and WooCommerce component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-107630.
Advanced Custom Fields: Extended: sensitive data disclosure
Advanced Custom Fields: Extended · CVSS 7.5 · threat: High
Sensitive data disclosure in the Advanced Custom Fields: Extended component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-110305.
Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery: remote code execution (RCE)
Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery · CVSS 7.5 · threat: High
Remote code execution (RCE) in the Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-76012.
Forminator Forms - Contact Form, Payment Form & Custom Form Builder: security vulnerability
Forminator Forms - Contact Form, Payment Form & Custom Form Builder · CVSS 7.5 · threat: High
Security vulnerability in the Forminator Forms - Contact Form, Payment Form & Custom Form Builder component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-97638.
PDF Invoices & Packing Slips for WooCommerce WordPress: cross-site scripting (XSS)
PDF Invoices & Packing Slips for WooCommerce WordPress · CVSS 7.5 · threat: High
Cross-site scripting (XSS) in the PDF Invoices & Packing Slips for WooCommerce WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-111578.
Essential Addons for Elementor - Popular Elementor Templates & Widgets: privilege escalation
Essential Addons for Elementor - Popular Elementor Templates & Widgets · CVSS 7.4 · threat: High
Privilege escalation in the Essential Addons for Elementor - Popular Elementor Templates & Widgets component. Threat level: High (CVSS 7.4).
Details and what to do: CVE-2026-118205.
Food Store - Online Food Delivery & Pickup: cross-site scripting (XSS)
Food Store - Online Food Delivery & Pickup · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Food Store - Online Food Delivery & Pickup component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-116622.
Gravity Forms: cross-site scripting (XSS)
Gravity Forms · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Gravity Forms component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-90437.
Gravity Forms: cross-site scripting (XSS)
Gravity Forms · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Gravity Forms component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-97645.
Independent Analytics Pro: cross-site scripting (XSS)
Independent Analytics Pro · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Independent Analytics Pro component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-104744.
easy.jobs - AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution: cross-site scripting (XSS)
easy.jobs - AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the easy.jobs - AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-112365.
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: cross-site scripting (XSS)
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96894.
Automated Import Products to Cart WordPress: security vulnerability
Automated Import Products to Cart WordPress · CVSS 9.9 · threat: Critical
Security vulnerability in the Automated Import Products to Cart WordPress component. Threat level: Critical (CVSS 9.9).
Details and what to do: CVE-2026-113617.
Bot for Telegram on WooCommerce: authentication bypass
Bot for Telegram on WooCommerce · CVSS 9.8 · threat: Critical
Authentication bypass in the Bot for Telegram on WooCommerce component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-109516.
LogixFast Auth WordPress: security vulnerability
LogixFast Auth WordPress · CVSS 9.8 · threat: Critical
Security vulnerability in the LogixFast Auth WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-113616.
Chat AI with Dispatcher WordPress: remote code execution (RCE)
Chat AI with Dispatcher WordPress · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Chat AI with Dispatcher WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-115245.
WordPress: PHP object injection
WordPress · CVSS 9.8 · threat: Critical
PHP object injection in the WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-61992.
Frontend Dashboard WordPress: remote code execution (RCE)
Frontend Dashboard WordPress · CVSS 9 · threat: Critical
Remote code execution (RCE) in the Frontend Dashboard WordPress component. Threat level: Critical (CVSS 9).
Details and what to do: CVE-2026-103693.
Community Events WordPress: security vulnerability
Community Events WordPress · CVSS 8.8 · threat: High
Security vulnerability in the Community Events WordPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-86794.
Ortto: security vulnerability
Ortto · CVSS 8.6 · threat: High
Security vulnerability in the Ortto component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-113387.
vTables WordPress: SQL injection
vTables WordPress · CVSS 8.6 · threat: High
SQL injection in the vTables WordPress component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-89216.
WordPress: authentication bypass
WordPress · CVSS 8.1 · threat: High
Authentication bypass in the WordPress component. Threat level: High (CVSS 8.1).
Details and what to do: CVE-2026-96228.
Wild Apricot Login: authentication bypass
Wild Apricot Login · CVSS 7.5 · threat: High
Authentication bypass in the Wild Apricot Login component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-93757.
SendPress Newsletters: SQL injection
SendPress Newsletters · CVSS 7.5 · threat: High
SQL injection in the SendPress Newsletters component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-93855.
Social Web Suite - Social Media Auto Post, Social Media Auto Publish: SQL injection
Social Web Suite - Social Media Auto Post, Social Media Auto Publish · CVSS 7.5 · threat: High
SQL injection in the Social Web Suite - Social Media Auto Post, Social Media Auto Publish component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-93904.
Two Factor Authentication WordPress: security vulnerability
Two Factor Authentication WordPress · CVSS 7.5 · threat: High
Security vulnerability in the Two Factor Authentication WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-111739.
GEO my WordPress: security vulnerability
GEO my WordPress · CVSS 7.5 · threat: High
Security vulnerability in the GEO my WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-114193.
Newsmatic: SQL injection
Newsmatic · CVSS 7.5 · threat: High
SQL injection in the Newsmatic component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-110184.
Bricks: security vulnerability
Bricks · CVSS 7.5 · threat: High
Security vulnerability in the Bricks component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-119325.
Schema App Structured Data: cross-site scripting (XSS)
Schema App Structured Data · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Schema App Structured Data component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96666.
Food Store - Online Food Delivery & Pickup: cross-site scripting (XSS)
Food Store - Online Food Delivery & Pickup · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Food Store - Online Food Delivery & Pickup component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96669.
DSGVO All in one for WP: cross-site scripting (XSS)
DSGVO All in one for WP · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the DSGVO All in one for WP component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96741.
Contact Form by Supsystic WordPress: security vulnerability
Contact Form by Supsystic WordPress · CVSS 7.2 · threat: High
Security vulnerability in the Contact Form by Supsystic WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-115301.
Mapster WP Maps: cross-site scripting (XSS)
Mapster WP Maps · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Mapster WP Maps component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-107743.
NewsmanApp: cross-site scripting (XSS)
NewsmanApp · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the NewsmanApp component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-115821.
NEX-Forms - Ultimate Forms: cross-site scripting (XSS)
NEX-Forms - Ultimate Forms · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the NEX-Forms - Ultimate Forms component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-96767.
Jupiter X Core: authentication bypass
Jupiter X Core · CVSS 9.8 · threat: Critical
Authentication bypass in the Jupiter X Core component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-106013.
Pie Register Premium: remote code execution (RCE)
Pie Register Premium · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Pie Register Premium component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-84999.
Checkout Files Upload for WooCommerce WordPress: remote code execution (RCE)
Checkout Files Upload for WooCommerce WordPress · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Checkout Files Upload for WooCommerce WordPress component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-103688.
Contact Manager: remote code execution (RCE)
Contact Manager · CVSS 9.8 · threat: Critical
Remote code execution (RCE) in the Contact Manager component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-109218.
Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: remote code execution (RCE)
Rank Math SEO - AI SEO Tools to Dominate SEO Rankings · CVSS 8.8 · threat: High
Remote code execution (RCE) in the Rank Math SEO - AI SEO Tools to Dominate SEO Rankings component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-1928.
The Innovative Form Builder - IvyForms: remote code execution (RCE)
The Innovative Form Builder - IvyForms · CVSS 8.8 · threat: High
Remote code execution (RCE) in the The Innovative Form Builder - IvyForms component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-109384.
VikRentCar Car Rental Management System: remote code execution (RCE)
VikRentCar Car Rental Management System · CVSS 8.8 · threat: High
Remote code execution (RCE) in the VikRentCar Car Rental Management System component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-111120.
MemberPress: account takeover
MemberPress · CVSS 8.8 · threat: High
Account takeover in the MemberPress component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-92797.
Joomla: cross-site scripting (XSS)
Joomla · CVSS 8.6 · threat: High
Cross-site scripting (XSS) in the Joomla component. Threat level: High (CVSS 8.6).
Details and what to do: CVE-2026-102790.
affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display: remote code execution (RCE)
affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display · CVSS 7.5 · threat: High
Remote code execution (RCE) in the affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-111255.
Animated Text Block: sensitive data disclosure
Animated Text Block · CVSS 7.5 · threat: High
Sensitive data disclosure in the Animated Text Block component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-116613.
Menu Cart for WooCommerce WordPress: cross-site scripting (XSS)
Menu Cart for WooCommerce WordPress · CVSS 7.5 · threat: High
Cross-site scripting (XSS) in the Menu Cart for WooCommerce WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-105972.
Product Designer for WooCommerce WordPress | Lumise: directory traversal
Product Designer for WooCommerce WordPress | Lumise · CVSS 7.5 · threat: High
Directory traversal in the Product Designer for WooCommerce WordPress | Lumise component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-15323.
WordPress: security vulnerability
WordPress · CVSS 7.5 · threat: High
Security vulnerability in the WordPress component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-118804.
AI Marketing Expert: AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot: cross-site scripting (XSS)
AI Marketing Expert: AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the AI Marketing Expert: AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109999.
affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display: cross-site scripting (XSS)
affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-111314.
AMP for WP - Accelerated Mobile Pages: cross-site scripting (XSS)
AMP for WP - Accelerated Mobile Pages · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the AMP for WP - Accelerated Mobile Pages component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-97019.
GoSMTP WordPress: account takeover
GoSMTP WordPress · CVSS 7.2 · threat: High
Account takeover in the GoSMTP WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-111577.
Mage Eventpress: privilege escalation
Mage Eventpress · CVSS 7.2 · threat: High
Privilege escalation in the Mage Eventpress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109381.
MxChat - AI Chatbot & Content Generation for WordPress: cross-site scripting (XSS)
MxChat - AI Chatbot & Content Generation for WordPress · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the MxChat - AI Chatbot & Content Generation for WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-110662.
Prime Slider - Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons: cross-site scripting (XSS)
Prime Slider - Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Prime Slider - Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-111111.
WordPress: insecure deserialization
WordPress · CVSS 7.2 · threat: High
Insecure deserialization in the WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-116390.
افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress: cross-site scripting (XSS)
افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress · CVSS 7.1 · threat: High
Cross-site scripting (XSS) in the افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-111021.
Ninja Forms: security vulnerability
Ninja Forms · CVSS 7.1 · threat: High
Security vulnerability in the Ninja Forms component. Threat level: High (CVSS 7.1).
Details and what to do: CVE-2026-67187.
Qode Membership: authentication bypass
Qode Membership · CVSS 9.8 · threat: Critical
Authentication bypass in the Qode Membership component. Threat level: Critical (CVSS 9.8).
Details and what to do: CVE-2026-92885.
Joomla: SQL injection
Joomla · CVSS 9.3 · threat: Critical
SQL injection in the Joomla component. Threat level: Critical (CVSS 9.3).
Details and what to do: CVE-2026-102788.
Joomla: security vulnerability
Joomla · CVSS 9.3 · threat: Critical
Security vulnerability in the Joomla component. Threat level: Critical (CVSS 9.3).
Details and what to do: CVE-2026-102789.
Kirki: privilege escalation
Kirki · CVSS 8.8 · threat: High
Privilege escalation in the Kirki component. Threat level: High (CVSS 8.8).
Details and what to do: CVE-2026-75891.
Joomla: cross-site scripting (XSS)
Joomla · CVSS 8.7 · threat: High
Cross-site scripting (XSS) in the Joomla component. Threat level: High (CVSS 8.7).
Details and what to do: CVE-2026-102800.
MembershipWorks: sensitive data disclosure
MembershipWorks · CVSS 7.5 · threat: High
Sensitive data disclosure in the MembershipWorks component. Threat level: High (CVSS 7.5).
Details and what to do: CVE-2026-112355.
Analytics Insights - Google Analytics Dashboard for WordPress: cross-site scripting (XSS)
Analytics Insights - Google Analytics Dashboard for WordPress · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Analytics Insights - Google Analytics Dashboard for WordPress component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-111820.
Advanced Views - Display Framework for Gutenberg & Elementor: cross-site scripting (XSS)
Advanced Views - Display Framework for Gutenberg & Elementor · CVSS 7.2 · threat: High
Cross-site scripting (XSS) in the Advanced Views - Display Framework for Gutenberg & Elementor component. Threat level: High (CVSS 7.2).
Details and what to do: CVE-2026-109995.
You will find the full, continuously updated list on the Current threats page.
Not sure whether your website is safe? Request a free audit and we will check it against these and other threats.