Threat monitoring

Current WordPress and Joomla threats

We track the most dangerous, actively exploited vulnerabilities so we can react before they reach your site. Here is the list worth keeping an eye on. Want to check whether any of them affects your site? Use the My site vulnerabilities tool.

Last updated: October 22, 2026 1 714WordPress and Joomla vulnerabilities in our database, see flaw types, the most frequently vulnerable plugins and trends Full statistics →
WordPress High · 7.7 CVE-2026-102499 October 21, 2026

Modern Events Calendar Lite WordPress: security vulnerability

Modern Events Calendar Lite WordPress

Security vulnerability in the Modern Events Calendar Lite WordPress component. Threat level: High (CVSS 7.7).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 8 CVE-2026-105262 October 21, 2026

Falang multilanguage for WordPress: cross-site scripting (XSS)

Falang multilanguage for WordPress

Cross-site scripting (XSS) in the Falang multilanguage for WordPress component. Threat level: High (CVSS 8).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 7.5 CVE-2026-107127 October 21, 2026

Uncanny Toolkit for LearnDash WordPress: account takeover

Uncanny Toolkit for LearnDash WordPress

Account takeover in the Uncanny Toolkit for LearnDash WordPress component. Threat level: High (CVSS 7.5).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 8.2 CVE-2026-107237 October 21, 2026

Backup and Staging by WP Time Capsule WordPress: security vulnerability

Backup and Staging by WP Time Capsule WordPress

Security vulnerability in the Backup and Staging by WP Time Capsule WordPress component. Threat level: High (CVSS 8.2).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 7.1 CVE-2026-109147 October 21, 2026

WP Booking System WordPress: cross-site scripting (XSS)

WP Booking System WordPress

Cross-site scripting (XSS) in the WP Booking System WordPress component. Threat level: High (CVSS 7.1).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 7.5 CVE-2026-111574 October 21, 2026

Redirection for Contact Form 7 WordPress: security vulnerability

Redirection for Contact Form 7 WordPress

Security vulnerability in the Redirection for Contact Form 7 WordPress component. Threat level: High (CVSS 7.5).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 7.1 CVE-2026-111948 October 21, 2026

User Profile Builder WordPress: cross-site scripting (XSS)

User Profile Builder WordPress

Cross-site scripting (XSS) in the User Profile Builder WordPress component. Threat level: High (CVSS 7.1).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 7.1 CVE-2026-79627 October 21, 2026

Advanced File Manager WordPress: security vulnerability

Advanced File Manager WordPress

Security vulnerability in the Advanced File Manager WordPress component. Threat level: High (CVSS 7.1).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 7.5 CVE-2026-88784 October 21, 2026

Translate WordPress with Weglot 2.0 WordPress: security vulnerability

Translate WordPress with Weglot 2.0 WordPress

Security vulnerability in the Translate WordPress with Weglot 2.0 WordPress component. Threat level: High (CVSS 7.5).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 8.6 CVE-2026-92997 October 21, 2026

Click n Chat (Chat Widget Integration) WordPress: SQL injection

Click n Chat (Chat Widget Integration) WordPress

SQL injection in the Click n Chat (Chat Widget Integration) WordPress component. Threat level: High (CVSS 8.6).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 8.6 CVE-2026-92998 October 21, 2026

Click n Chat (Chat Widget Integration) WordPress: SQL injection

Click n Chat (Chat Widget Integration) WordPress

SQL injection in the Click n Chat (Chat Widget Integration) WordPress component. Threat level: High (CVSS 8.6).

Vulnerability details → Scan your site → Source (NVD) ↗
WordPress High · 8.8 CVE-2026-110369 October 21, 2026

WordPress Team Members – GS Plugins: insecure deserialization

WordPress Team Members – GS Plugins

Insecure deserialization in the WordPress Team Members – GS Plugins component. Threat level: High (CVSS 8.8).

Vulnerability details → Scan your site → Source (NVD) ↗

Data comes from the public NVD (NIST) vulnerability catalog and is refreshed automatically. This list does not replace a full audit of your site.

Do not guess, check

Does any of these flaws affect your site?

We will run a free audit: we check versions, plugins, and configuration, and tell you plainly whether you are safe.

Request a free audit →
Plugin security Guide: WordPress Guide: Joomla Quick site scanner My site vulnerabilities

Security newsletter

Once a week we send a review of the most important WordPress and Joomla vulnerabilities. No spam, one-click unsubscribe.