Wordpress-plugins

This hub aggregates every CVE we track for Wordpress-plugins, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Wordpress-plugins.

• CVE-2026-95529WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability7.1Sep 23, 2026
• CVE-2026-95525WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability6.5Sep 23, 2026
• CVE-2026-95523WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability6.5Sep 23, 2026
• CVE-2026-95524WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability5.3Sep 23, 2026
• CVE-2026-94500WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability6.5Sep 23, 2026
• CVE-2026-94168WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability6.5Sep 23, 2026
• CVE-2026-94118WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability6.5Sep 23, 2026
• CVE-2026-93527WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability8.5Sep 23, 2026
• CVE-2026-92235WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter8.1Sep 22, 2026
• CVE-2026-85658Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)8.1Sep 19, 2026
• CVE-2026-92229Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter9.1Sep 19, 2026
• CVE-2026-77820WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute6.4Sep 19, 2026
• CVE-2026-92622Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute6.4Sep 18, 2026
• CVE-2026-84909Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute6.4Sep 18, 2026
• CVE-2026-16750Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure5.3Sep 17, 2026