Vulnerability alerts
When a vulnerability is disclosed in a widely used plugin or theme, this page explains what it means and what to do about it. Updated daily.
An entry is listed when it affects 10,000 or more sites, or is estimated likely to be exploited (EPSS 1% or higher), or is known to be exploited (listed in the CISA KEV catalog).
- Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More — CVE-2026-82814
- Meta Box — CVE-2026-109700
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — WF-21931b7b-3c3d-4297-878e-bc0f187557a0
- weForms – Easy Drag & Drop Contact Form Builder For WordPress — CVE-2026-110253
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder — CVE-2026-96660
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder — CVE-2026-92978
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder — CVE-2026-92798
- Tutor LMS – eLearning and online course solution — CVE-2026-92715
- xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN — CVE-2026-109985
- WP Booking System – Booking Calendar — CVE-2026-109369
- WP Booking System – Booking Calendar — CVE-2026-109368
- WP Booking System – Booking Calendar — CVE-2026-108123
- Welcart e-Commerce — CVE-2026-107752
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — CVE-2026-107744
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — CVE-2026-104736
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-111602
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-110653
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — CVE-2026-109208
- Kirki – Freeform Page Builder, Website Builder & Customizer — CVE-2026-107762
- Kirki – Freeform Page Builder, Website Builder & Customizer — CVE-2026-104734
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-110703
- Tutor LMS – eLearning and online course solution — CVE-2026-93681
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments — CVE-2026-109224
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — CVE-2026-104003
- FiboSearch – Ajax Search for WooCommerce — CVE-2026-100106
- WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) — CVE-2026-97640
- YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports — CVE-2026-92553
- WP Photo Album Plus — CVE-2026-92115
- WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters — CVE-2026-19798
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder — CVE-2026-15222
- WP Booking System – Booking Calendar — CVE-2026-111178
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-111069
- WebberZone Top 10 — Popular Posts — CVE-2026-110290
- WPeMatico RSS Feed Fetcher — CVE-2026-110252
- WP Mail Logging — CVE-2026-109401
- HivePress – Business Directory, Listings & Classified Ads Plugin — CVE-2026-109388
- HivePress – Business Directory, Listings & Classified Ads Plugin — CVE-2026-109193
- TranslatePress – Translate Multilingual sites with AI Translation — CVE-2026-107768
- HUSKY – Products Filter for WooCommerce Professional — CVE-2026-107646
- WP Compress – Instant Performance & Speed Optimization — CVE-2026-104755
- Schema & Structured Data for WP & AMP — CVE-2026-96570
- Theme My Login — CVE-2026-89079
- Tutor LMS – eLearning and online course solution — CVE-2026-88963
- SiteOrigin CSS — CVE-2026-111122
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar — CVE-2026-109513
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — CVE-2026-109447
- SiteOrigin CSS — CVE-2026-107764
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — CVE-2026-107748
- Slim SEO – A Fast & Automated SEO Plugin For WordPress — CVE-2026-104001
- Simply Schedule Appointments — CVE-2026-104000
- Ultra Addons for Contact Form 7 — CVE-2026-103999
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer — CVE-2026-103896
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor — CVE-2026-100186
- Broken Link Checker — CVE-2026-96562
- Nexter Extension – Security, Performance, Code Snippets & Site Toolkit — CVE-2026-111114
- NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar — CVE-2026-110721
- Klarna for WooCommerce — CVE-2026-110590
- MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. — CVE-2026-109515
- InstaWP Connect – 1-click WP Staging & Migration — CVE-2026-109400
- Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy — CVE-2026-109191
- FunnelKit – Funnel Builder for WooCommerce Checkout — CVE-2026-107746
- Modula Image Gallery – Photo Grid & Video Gallery — CVE-2026-107659
- My Calendar – Accessible Event Manager — CVE-2026-104798
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — CVE-2026-103911
- Gwolle Guestbook — CVE-2026-103481
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — CVE-2026-101335
- Complianz GDPR/CCPA Cookie Consent Banner — CVE-2026-97339
- Backuply – Backup, Restore, Migrate and Clone — CVE-2026-93953
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy — CVE-2026-89280
- Flying Scripts: Delay JavaScript to Improve Site Speed & Performance — CVE-2026-109990
- RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator — CVE-2026-109207
- Colibri Page Builder — CVE-2026-107758
- Debloat – Remove Unused CSS, Optimize JS — CVE-2026-104769
- Popup Box – Create Countdown, Coupon, Video, Contact Form Popups — CVE-2026-100159
- Blog2Social: Social Media Auto Post & Scheduler — CVE-2026-108092
- Elementor Website Builder – more than just a page builder — CVE-2026-11905
- Ocean Extra — CVE-2026-86803
- VK Blocks — CVE-2026-78087
- Tracking Code Manager — CVE-2026-15180
- Link Library — CVE-2026-15090
- PhastPress — CVE-2026-3712
- Kirki – Freeform Page Builder, Website Builder & Customizer — CVE-2026-14572
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer — CVE-2026-108587
- Search Regex — CVE-2026-104932
- WP Ghost (Hide My WP Ghost) – Security & Firewall — CVE-2026-89051
- FV Flowplayer Video Player — CVE-2026-86461
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes — CVE-2026-110284
- Gallery Custom Links — CVE-2026-107757
- Meow Lightbox — CVE-2026-107756
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-107754
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-107650
- Mang Board WP — CVE-2026-104909
- Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress — CVE-2026-103907
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-103380
- ShopMagic – email automation for WordPress — CVE-2026-103367
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-103366
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-100163
- FV Flowplayer Video Player — CVE-2026-97398
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder — CVE-2026-95808
- Countdown Timer – Widget Countdown — CVE-2026-16495