Vulnerability alerts
When a vulnerability is disclosed in a widely used plugin or theme, this page explains what it means and what to do about it. Updated daily.
An entry is listed when it affects 10,000 or more sites, or is estimated likely to be exploited (EPSS 1% or higher), or is known to be exploited (listed in the CISA KEV catalog).
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments — CVE-2026-120574
- WPML Multilingual & Multicurrency for WooCommerce — CVE-2026-120563
- JetFormBuilder — Dynamic Blocks Form Builder — CVE-2026-120561
- Advanced Shipment Tracking for WooCommerce — CVE-2026-120558
- WP Compress – Instant Performance & Speed Optimization — CVE-2026-120551
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy — CVE-2026-120538
- WP Fastest Cache – WordPress Cache Plugin — CVE-2026-111464
- Welcart e-Commerce — CVE-2026-120597
- s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions — CVE-2026-86596
- Ultra Addons for Contact Form 7 — CVE-2026-102435
- Product Gallery Slider, Additional Variation Images for WooCommerce — CVE-2026-120318
- Iptanus File Upload — CVE-2026-66570
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery — CVE-2026-76010
- Debug Log Manager – Conveniently Monitor and Inspect Errors — CVE-2026-120114
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-116752
- Germanized for WooCommerce — CVE-2026-109231
- Ninja Forms – The Contact Form Builder That Grows With You — CVE-2026-100151
- Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News — CVE-2026-119160
- All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) — CVE-2026-109367
- Booking for Appointments and Events Calendar – Amelia — CVE-2026-103915
- User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission — CVE-2026-120070
- Uncanny Toolkit for LearnDash — CVE-2026-119096
- Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning — CVE-2026-118057
- SEOPress – AI SEO Plugin & On-site SEO — CVE-2026-116535
- Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors — CVE-2026-111592
- WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards — CVE-2026-110023
- WPO365 | MICROSOFT 365 GRAPH MAILER — CVE-2026-107759
- Redux Framework — CVE-2026-103997
- User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission — CVE-2026-103962
- Wp Social Login and Register Social Counter — CVE-2026-103898
- Seraphinite Accelerator — CVE-2026-90960
- Popup Builder – Create highly converting, mobile friendly marketing popups. — CVE-2026-89270
- Mail logging – WP Mail Catcher — CVE-2026-120040
- W3 Total Cache — CVE-2026-120019
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP — CVE-2026-119980
- Welcart e-Commerce — CVE-2026-119166
- FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce — CVE-2026-119163
- User Submitted Posts – Enable Users to Submit Posts from the Front End — CVE-2026-119162
- ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin — CVE-2026-119089
- Welcart e-Commerce — CVE-2026-118070
- WP Booking System – Booking Calendar — CVE-2026-116557
- Relevanssi – A Better Search — CVE-2026-116522
- W3 Total Cache — CVE-2026-111254
- Photo Reviews for WooCommerce — CVE-2026-110251
- Hustle – Email Marketing, Lead Generation, Optins, Popups — CVE-2026-109386
- PDF Invoices & Packing Slips for WooCommerce — CVE-2026-109217
- PDF Invoices & Packing Slips for WooCommerce — CVE-2026-107750
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments — CVE-2026-107653
- Spectra Legacy – Gutenberg Blocks — CVE-2026-92294
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery — CVE-2026-116563
- PPWP – Password Protect Pages — CVE-2026-116520
- Ninja Forms – The Contact Form Builder That Grows With You — CVE-2026-109997
- Meow Lightbox — CVE-2026-109234
- Ninja Forms – The Contact Form Builder That Grows With You — CVE-2026-101326
- Ninja Forms – The Contact Form Builder That Grows With You — CVE-2026-100155
- Meow Gallery — CVE-2026-9239
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — CVE-2026-97638
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery — CVE-2026-76012
- Meow Gallery — CVE-2026-13747
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-119113
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-118635
- Essential Addons for Elementor – Popular Elementor Templates & Widgets — CVE-2026-118205
- FV Flowplayer Video Player — CVE-2026-110533
- Advanced Custom Fields: Extended — CVE-2026-110305
- FV Flowplayer Video Player — CVE-2026-110001
- FV Flowplayer Video Player — CVE-2026-109984
- Email Templates Customizer and Designer for WordPress and WooCommerce — CVE-2026-107630
- Redux Framework — CVE-2026-102918
- Ad Inserter – Ad Manager & AdSense Ads — CVE-2026-102905
- Database Cleaner — CVE-2025-8574
- Kirki – Freeform Page Builder, Website Builder & Customizer — CVE-2026-112348
- Kirki – Freeform Page Builder, Website Builder & Customizer — CVE-2026-112347
- Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More — CVE-2026-89435
- AI Engine – The Chatbot, AI Framework & MCP for WordPress — CVE-2026-110732
- Content Egg – Affiliate Product Importer & Price Comparison — CVE-2026-119087
- Content Egg – Affiliate Product Importer & Price Comparison — CVE-2026-119059
- Cool FormKit Lite – Advanced Form Builder for Elementor — CVE-2026-118500
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — CVE-2026-5461
- Export and Import Users and Customers — CVE-2026-104368
- WP Activity Log — CVE-2026-120075
- Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF — CVE-2025-11455
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy — WF-f4250328-6d6c-4eb1-9ef2-334774c1d337
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments — WF-dffdcaa2-5100-48f5-9b82-e22075fd87e5
- MasterStudy LMS WordPress Plugin – for Online Courses and Education — CVE-2026-80069
- MasterStudy LMS WordPress Plugin – for Online Courses and Education — CVE-2026-80067
- MW WP Form — CVE-2026-92086
- Meta Box — CVE-2026-109216
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI — CVE-2026-91153
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI — CVE-2026-91152
- LiteSpeed Cache — CVE-2026-116763
- HT Mega Addons for Elementor – Elementor Widgets & Template Builder — CVE-2026-111318
- RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator — CVE-2026-110707
- LiteSpeed Cache — CVE-2026-109215
- Greenshift – animation and page builder blocks — CVE-2026-107629
- Greenshift – animation and page builder blocks — CVE-2026-107627
- Media Library Assistant — CVE-2026-103875
- DSGVO All in one for WP — CVE-2026-96741
- Ninja Forms – The Contact Form Builder That Grows With You — CVE-2026-67187
- Filter Everything — WordPress & WooCommerce Filters — CVE-2026-116390
- Smart Popup by Supsystic — CVE-2026-115223