WordPress vulnerabilities worth acting on

Current advisories

• Known exploitedCVSS 8.1 (CVE record)CVE-2026-87902

  CVE-2026-87902 in WordPress

  An unauthenticated path traversal vulnerability in WordPress Core's page-template resolution allows attackers to include arbitrary local PHP files.

  Component

  WordPress

  Patch status

  Fixed in 4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2

• Known exploitedCVSS 10.0 (CVE record)CVE-2020-25213

  CVE-2020-25213 in File Manager

  WP File Manager 6.8 and earlier lets unauthenticated attackers upload and run PHP files. It has been exploited in the wild; update to 6.9 or later now.

  Component

  File Manager

  Patch status

  Fixed in 6.9

• Known exploitedCVSS 7.5 (CVE record)CVE-2020-11738

  CVE-2020-11738 in Duplicator and Duplicator Pro

  Duplicator before 1.3.28 and Duplicator Pro before 3.8.7.1 let unauthenticated attackers read any file on the server. It is being exploited; update now.

  Component

  Duplicator Pro and Duplicator

  Patch status

  Fixed in 3.8.7.1 (Duplicator Pro), 1.3.28 (Duplicator)

• Known exploitedCVSS 5.9 (CVE record)CVE-2026-60137

  CVE-2026-60137: SQL injection in WordPress

  An unauthenticated SQL Injection vulnerability in WordPress Core allows attackers to extract sensitive database information by manipulating the authornotin…

  Component

  WordPress

  Patch status

  Fixed in 6.8.6, 6.9.5, 7.0.2

• Known exploitedCVSS 9.8 (CVE record)CVE-2026-63030

  CVE-2026-63030 in WordPress

  WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 have a remote code execution flaw in the REST API batch route that is being exploited. Update to 6.9.5 or 7.0.2.

  Component

  WordPress

  Patch status

  Fixed in 6.9.5, 7.0.2

• CVSS 7.1 (CVE record)CVE-2026-110899

  CVE-2026-110899: Cross-site scripting in Ninja Forms

  An unauthenticated attacker can inject malicious web scripts into pages generated by the Ninja Forms plugin for WordPress, which are then stored and executed…

  Component

  Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

  Patch status

  Fixed in 3.15.6

  Installs still vulnerable

  at least 24.19% of installs not yet updated

• CVSS 9.8 (CVE record)CVE-2026-82901

  CVE-2026-82901 in Ultra Addons for Contact Form 7

  Ultra Addons for Contact Form 7 up to 3.5.50 lets unauthenticated visitors upload arbitrary files via a signature field. Update to 3.5.51 or later.

  Component

  Ultra Addons for Contact Form 7

  Patch status

  Fixed in 3.5.51

• CVSS 7.2 (CVE record)CVE-2026-109997

  CVE-2026-109997: Cross-site scripting in Ninja Forms

  Unauthenticated attackers can inject arbitrary web scripts into pages via the 'formData.extra' parameter in Ninja Forms, which execute when a user accesses an…

  Component

  Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

  Patch status

  Fixed in 3.15.6

  Installs still vulnerable

  at least 24.19% of installs not yet updated

• CVSS 7.5 (CVE record)CVE-2026-107746

  CVE-2026-107746 in FunnelKit

  An attacker can exploit this vulnerability by sending a specially crafted request to a vulnerable WordPress site running the FunnelKit plugin.

  Component

  FunnelKit – Funnel Builder Plugin for WooCommerce Checkout

  Patch status

  Fixed in 3.17.0

  Installs still vulnerable

  at least 35.25% of installs not yet updated

• CVSS 8.1 (CVE record)CVE-2026-120538

  CVE-2026-120538 in Easy Digital Downloads

  An attacker can take over an administrator's account on a WordPress site running the Easy Digital Downloads plugin by exploiting a flaw in how the plugin…

  Component

  Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

  Patch status

  Fixed in 3.7.3

• CVSS 8.1 (CVE record)CVE-2026-103898

  CVE-2026-103898

  An authentication bypass vulnerability in the Wp Social Login and Register Social Counter plugin allows unauthenticated attackers to gain full access to any…

  Component

  Wp Social Login and Register Social Counter

  Patch status

  Fixed in 3.2.3

• CVSS 6.5 (CVE record)CVE-2026-112311

  CVE-2026-112311 in Advanced Custom Fields: Extended

  An arbitrary file deletion vulnerability in the Advanced Custom Fields: Extended plugin for WordPress allows unauthenticated attackers to delete arbitrary…

  Component

  Advanced Custom Fields: Extended

  Patch status

  Fixed in 0.9.2.8

  Installs still vulnerable

  at least 12% of installs not yet updated

• CVSS 8.8 (CVE record)CVE-2026-75891

  CVE-2026-75891 in Kirki

  Authenticated attackers can exploit a PHP Object Injection vulnerability in the Kirki plugin for WordPress to overwrite an administrator's password and gain…

  Component

  Kirki – Freeform Page Builder, Website Builder & Customizer

  Patch status

  Fixed in 6.3.0

  Installs still vulnerable

  at least 37.11% of installs not yet updated

• CVSS 6.5 (CVE record)CVE-2026-84750

  CVE-2026-84750 in Ultra Addons for Contact Form 7

  Ultra Addons for Contact Form 7 3.2.4 to 3.5.50 lets unauthenticated visitors upload arbitrary files through a form field. Update to 3.5.51 or later.

  Component

  Ultra Addons for Contact Form 7

  Patch status

  Fixed in 3.5.51

• CVSS 7.1 (CVE record)CVE-2026-105077

  CVE-2026-105077: Cross-site scripting in Ad Inserter

  An attacker can inject malicious code into a website running the Ad Inserter plugin, which stores the code due to improper input handling. When a user visits…

  Component

  Ad Inserter – Ad Manager & AdSense Ads

  Patch status

  Fixed in 2.8.20

Older advisories

Published earlier. Several are still unpatched on a large share of installs, so “older” does not mean resolved.

• CVSS 7.2 (CVE record)CVE-2026-111254

  CVE-2026-111254: Cross-site scripting in W3 Total Cache

  Attackers can inject malicious web scripts into pages of WordPress sites using the W3 Total Cache plugin, which then execute when a user accesses an injected…

  Component

  W3 Total Cache

  Patch status

  Fixed in 2.11.0

  Installs still vulnerable

  at least 48.19% of installs not yet updated

• CVSS 7.2 (CVE record)CVE-2026-107750

  CVE-2026-107750

  Unauthenticated attackers can inject malicious scripts into customer order fields in the PDF Invoices & Packing Slips for WooCommerce plugin.

  Component

  PDF Invoices & Packing Slips for WooCommerce

  Patch status

  Fixed in 5.16.5

• CVSS 8.8 (CVE record)CVE-2026-76010

  CVE-2026-76010

  An authenticated attacker with custom-level access can achieve remote code execution in the NextGEN Gallery plugin for WordPress. This is due to unrestricted…

  Component

  Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

  Patch status

  Fixed in 4.5.0

  Installs still vulnerable

  at least 19.02% of installs not yet updated

• CVSS 7.5 (CVE record)CVE-2026-110732

  CVE-2026-110732: Access control flaw in AI Engine

  Unauthenticated attackers can register a malicious OAuth client with the AI Engine plugin due to a missing authorization check. This allows them to obtain…

  Component

  AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini

  Patch status

  Fixed in 3.8.7

  Installs still vulnerable

  at least 12.12% of installs not yet updated

• CVSS 7.5 (CVE record)CVE-2026-113499

  CVE-2026-113499: Cross-site scripting in LiteSpeed Cache

  An unauthenticated attacker can inject malicious web scripts into pages of a WordPress site running the LiteSpeed Cache plugin. These scripts execute in the…

  Component

  LiteSpeed Cache

  Patch status

  Fixed in 7.9.2

  Installs still vulnerable

  at least 16.45% of installs not yet updated

• CVSS 6.5 (CVE record)CVE-2026-19859

  CVE-2026-19859 in JetFormBuilder

  JetFormBuilder before 3.6.5.2 lets unauthenticated visitors run arbitrary shortcodes through its 'status' parameter. Update to version 3.6.5.2 or later.

  Component

  JetFormBuilder — Dynamic Blocks Form Builder

  Patch status

  Fixed in 3.6.5.2

  Installs still vulnerable

  at least 24.31% of installs not yet updated

• CVSS 9.1 (CVE record)CVE-2026-89270

  CVE-2026-89270: Access control flaw in Popup Builder

  An authorization bypass vulnerability in the Popup Builder plugin allows unauthenticated attackers to trash all published popups on a WordPress site.

  Component

  Popup Builder – Create highly converting, mobile friendly marketing popups.

  Patch status

  Fixed in 4.4.6

  Installs still vulnerable

  at least 18.08% of installs not yet updated

• CVSS 8.8 (CVE record)CVE-2026-107436

  CVE-2026-107436 in Strong Testimonials

  Authenticated attackers with subscriber-level access can inject a PHP Object into the Strong Testimonials plugin due to deserialization of untrusted input.

  Component

  Strong Testimonials

  Patch status

  Fixed in 3.3.13

  Installs still vulnerable

  at least 26.92% of installs not yet updated

• CVSS 9.0 (CVE record)CVE-2026-94267

  CVE-2026-94267

  Unauthenticated attackers can execute code on the server by exploiting a vulnerability in the Advanced Custom Fields: Extended WordPress plugin.

  Component

  Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO

  Patch status

  Fixed in 0.9.2.8 (Advanced Custom Fields: Extended), 0.9.2.8 (Advanced Custom Fields: Extended PRO)

  Installs still vulnerable

  at least 12% of installs not yet updated

• CVSS 5.3 (CVE record)CVE-2026-101301

  CVE-2026-101301: Access control flaw in WPCode

  An unauthenticated attacker can disable automatically inserted code snippets for their own requests by bypassing the login page check in the WPCode plugin.

  Component

  WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager

  Patch status

  Fixed in 2.4.0

  Installs still vulnerable

  at least 42.51% of installs not yet updated

• CVSS 7.5 (CVE record)CVE-2026-109936

  CVE-2026-109936: Cross-site scripting in Otter Blocks

  An unauthenticated attacker can inject malicious web scripts into pages using the Otter Blocks plugin due to insufficient input sanitization and output…

  Component

  Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

  Patch status

  Fixed in 3.2.8

  Installs still vulnerable

  at least 24.05% of installs not yet updated

• CVSS 8.8 (CVE record)CVE-2026-1928

  CVE-2026-1928 in Rank Math SEO

  Authenticated attackers with Contributor-level access can exploit a PHP Object Injection vulnerability in the Rank Math SEO plugin by sending crafted data to…

  Component

  Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

  Patch status

  Fixed in 1.0.277

• CVSS 7.5 (CVE record)CVE-2026-97328

  CVE-2026-97328: Cross-site scripting in WebP Express

  Unauthenticated attackers can inject malicious scripts into pages via the WebP Express plugin's HTML parser when a non-default image delivery mode is active.

  Component

  WebP Express

  Patch status

  Fixed in 0.25.16

Subscribe by RSS