Wordfence Intelligence Weekly WordPress Vulnerability Report (January 19, 2026 to January 25, 2026)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.
Last week, there were 243 vulnerabilities disclosed in 206 WordPress Plugins and 17 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 73 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 33,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
-
-
- WAF-RULE-891 – Data redacted while we work with the vendor on a patch.
-
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 162 |
| Unpatched | 81 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 2 |
| Medium Severity | 181 |
| High Severity | 50 |
| Critical Severity | 10 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Missing Authorization | 89 |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 64 |
| Cross-Site Request Forgery (CSRF) | 17 |
| Exposure of Sensitive Information to an Unauthorized Actor | 13 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 11 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 10 |
| Improper Privilege Management | 6 |
| Incorrect Privilege Assignment | 6 |
| Server-Side Request Forgery (SSRF) | 5 |
| Authorization Bypass Through User-Controlled Key | 4 |
| Deserialization of Untrusted Data | 4 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Unrestricted Upload of File with Dangerous Type | 4 |
| Improper Access Control | 1 |
| Improper Authentication | 1 |
| Improper Authorization | 1 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 |
| Incorrect Authorization | 1 |
| Unverified Password Change | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 32 | |
| 24 | |
| 23 | |
| 10 | |
| 9 | |
| 8 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| ABG Rich Pins | abg-rich-pins |
| Academy LMS | academy |
| Accordion – Responsive Horizontal & Vertical Accordion Block | b-accordion |
| AdForest Elementor | adforest-elementor |
| Admin and Site Enhancements (ASE) | admin-site-enhancements |
| Admin login URL Change | admin-login-url-change |
| Administrative Shortcodes | administrative-shortcodes |
| AdminQuickbar | adminquickbar |
| Advanced Custom Fields: Extended | acf-extended |
| Advanced iFrame | advanced-iframe |
| Advanced Reporting & Statistics for WooCommerce – Orders, Products & Customers Reporting | webd-woocommerce-advanced-reporting-statistics |
| Ai Image Alt Text Generator for WP | ai-image-alt-text-generator-for-wp |
| AIKTP | aiktp |
| Alchemist Ajax Upload | alchemist-ajax-upload |
| Alex User Counter | user-counter |
| All-in-One Video Gallery | all-in-one-video-gallery |
| Alpha Blocks | alpha-blocks |
| amr cron manager | amr-cron-manager |
| Anything Order by Terms | anything-order-by-terms |
| APPExperts – Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps | appexperts |
| Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | simply-schedule-appointments |
| ArtPlacer Widget | artplacer-widget |
| Automatic Featured Images from Videos | automatic-featured-images-from-videos |
| Autopost for X (formerly Autoshare for Twitter) | autoshare-for-twitter |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Blockons – Gutenberg blocks for WordPress and WooCommerce websites | blockons |
| Bold Page Builder | bold-page-builder |
| Booking (Reservation & Appointment) | directorist-booking |
| Booking Activities | booking-activities |
| Bookingor – Booking System for Appointment Calendar, Meeting Scheduler & WooCommerce Bookings | bookingor |
| Booter – Bots & Crawlers Manager | booter-bots-crawlers-manager |
| BOX NOW Delivery | box-now-delivery |
| Broadstreet | broadstreet |
| BuddyPress | buddypress |
| Canto Testimonials | canto-testimonials |
| Cloudinary – Deliver Images and Videos at Scale | cloudinary-image-management-and-manipulation-in-the-cloud-cdn |
| CM CSS Columns | cm-css-columns |
| Contact Form 7 GetResponse Extension | contact-form-7-getresponse-extension |
| Cookie consent for developers | cookie-consent-for-developers |
| Coven - Furniture Store WooCommerce Theme | coven-core |
| Creator LMS – WordPress LMS Plugin for Coaches & Course Creators | creatorlms |
| CubeWP Framework | cubewp-framework |
| Custom Fonts – Host Your Fonts Locally | custom-fonts |
| Dinatur | dinatur |
| Directorist Social Login | directorist-social-login |
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | dokan-lite |
| Download After Email – Subscribe & Download Form Plugin | download-after-email |
| Easy Property Listings | easy-property-listings |
| Easy Theme Options | easy-theme-options |
| Ecwid by Lightspeed Ecommerce Shopping Cart | ecwid-shopping-cart |
| Edwiser Bridge – WordPress Moodle Integration | edwiser-bridge |
| ElementCamp | element-camp |
| Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | wp-event-solution |
| ExpressTechSoftwares Addon for MemberPress and Discord | expresstechsoftwares-memberpress-discord-add-on |
| Extend Link | extend-link |
| Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) | extensions-for-cf7 |
| File Manager for Google Drive – Integrate Google Drive | integrate-google-drive |
| Final User | final-user |
| Fitness Trainer- Training Membership Plugin | fitness-trainer |
| FlatPM – Ad Manager, AdSense and Custom Code | flatpm-wp |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration | fluent-boards |
| Fraud Prevention For WooCommerce and EDD | woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers |
| Friendly Functions for Welcart | friendly-functions-for-welcart |
| Frontis Blocks — Block Library for the Block Editor | frontis-blocks |
| GDPR CCPA Compliance & Cookie Consent Banner | ninja-gdpr-compliance |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| GZSEO | gzseo |
| Happy Addons for Elementor | happy-elementor-addons |
| HD Quiz | hd-quiz |
| Head Meta Data | head-meta-data |
| Homey Core | homey-core |
| Hospital Doctor Directory | hospital-doctor-directory |
| Hotel Listings | hotel-listing |
| Hustle – Email Marketing, Lead Generation, Optins, Popups | wordpress-popup |
| Hydra Booking — Appointment Scheduling & Booking Calendar | hydra-booking |
| Image Photo Gallery Final Tiles Grid | final-tiles-grid-gallery-lite |
| iNET Webkit | inet-webkit |
| Institutions Directory | institutions-directory |
| Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms | cf7-hubspot |
| iRobots.txt SEO | irobotstxt-seo |
| JavaScript Notifier | javascript-notifier |
| JobBank - WordPress Job manager plugin | jobbank |
| JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin | jobwp |
| JustClick registration plugin | justclick-subscriber |
| KalravAI Agent | kalrav-ai-agent |
| Kentha Elementor Widgets | kentha-elementor |
| KiviCare – Clinic & Patient Management System (EHR) | kivicare-clinic-management-system |
| Koko Analytics – Privacy-Friendly WordPress Analytics | koko-analytics |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| Latest Post Shortcode | latest-post-shortcode |
| Lawyer Directory | lawyer-directory |
| LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart | lazytasks-project-task-management |
| Lead Form Builder & Contact Form | lead-form-builder |
| LeadBI Plugin for WordPress | leadbi |
| LeadConnector | leadconnector |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| LifePress | lifepress |
| ListingHub | listinghub |
| Listivo Core | listivo-core |
| Login Page Editor | login-page-editor |
| MailerLite – WooCommerce integration | woo-mailerlite |
| Materialis Companion | materialis-companion |
| Media Library File Size | media-library-file-size |
| Melapress Role Editor | melapress-role-editor |
| Meta-box GalleryMeta | meta-box-gallerymeta |
| MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor | metform |
| Moderate Selected Posts | moderate-selected-posts |
| Monetag Official Plugin | monetag-official |
| Movie Booking | movie-booking |
| My auctions allegro | my-auctions-allegro-free-edition |
| My Post Order | my-posts-order |
| MyHome Core | myhome-core |
| Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization | nelio-ab-testing |
| Nelio Content – Editorial Calendar & Social Media Auto-Posting | nelio-content |
| Newsletter – Send awesome emails from WordPress | newsletter |
| Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | nexter-extension |
| Notifications for Forms & WordPress Actions | notifier |
| NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | notificationx |
| Omnipress | omnipress |
| Order Notification for WooCommerce – Get Instant Audio Alert on new Orders | woc-order-alert |
| Paid Downloads | paid-downloads |
| PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) | peachpay-for-woocommerce |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| Pie Register – User Registration, Profiles & Content Restriction | pie-register |
| Points and Rewards for WooCommerce | points-and-rewards-for-woocommerce |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Postalicious | postalicious |
| Prime Listing Manager | prime-listing-manager |
| Protección de datos – RGPD | proteccion-datos-rgpd |
| Quiz Maker, Poll Maker & Survey Maker by Opinion Stage | social-polls-by-opinionstage |
| Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player | radio-player |
| ravpage | ravpage |
| Real Estate Pro - WordPress Plugin | real-estate-pro |
| RealHomes CRM | realhomes-crm |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| Responsive Header Plugin | responsive-header |
| Ryviu – Review Importer & Product Reviews | ryviu |
| Salon Booking System – Free Version | salon-booking-system |
| Same Category Posts | same-category-posts |
| Save as PDF Plugin by PDFCrowd | save-as-pdf-by-pdfcrowd |
| Scalenut | scalenut |
| Schema & Structured Data for WP & AMP | schema-and-structured-data-for-wp |
| SEO Booster | seo-booster |
| Set Bulk Post Categories | set-bulk-post-categories |
| Share This Image | share-this-image |
| ShoutOut | shoutout |
| Simple Crypto Shortcodes | simple-crypto-shortcodes |
| Simple Membership | simple-membership |
| Simple Membership WP user Import | simple-membership-wp-user-import |
| SiteLock Security – WP Hardening, Login Security & Malware Scans | sitelock |
| Star Review Manager | star-review-manager |
| SumUp Payment Gateway For WooCommerce | sumup-payment-gateway-for-woocommerce |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | supportcandy |
| SurveyJS: Drag & Drop Form Builder | surveyjs |
| Tabby Checkout | tabby-checkout |
| Table of Contents Creator | table-of-contents-creator |
| TableOn – WordPress Posts Table Filterable | posts-table-filterable |
| TaxCloud for WooCommerce | simple-sales-tax |
| Textmetrics | webtexttool |
| The Events Calendar | the-events-calendar |
| ThemeRuby Multi Authors – Assign Multiple Writers to Posts | themeruby-multi-authors |
| Timeline Event History | timeline-event-history |
| TOP Table Of Contents | top-table-of-contents |
| Tutor LMS BunnyNet Integration | tutor-lms-bunnynet-integration |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultra Portfolio | ultra-portfolio |
| Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | uncanny-automator |
| UPI QR Code Payment Gateway for WooCommerce | upi-qr-code-payment-for-woocommerce |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| User Submitted Posts – Enable Users to Submit Posts from the Front End | user-submitted-posts |
| UX Flat | ux-flat |
| Viet contact | viet-contact |
| VK Google Job Posting Manager | vk-google-job-posting-manager |
| Web Push Notifications – Webpushr | webpushr-web-push-notifications |
| weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | wedocs |
| weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce | wemail |
| Wired Impact Volunteer Management | wired-impact-volunteer-management |
| Wise Analytics | wise-analytics |
| Wishlist Member | wishlist-member-x |
| Wizit Gateway for WooCommerce | wizit-gateway-for-woocommerce |
| Workscout Core | workscout-core |
| WP BackItUp Community Edition | wp-backitup |
| WP Bannerize Pro | wp-bannerize-pro |
| WP Custom Admin Interface | wp-custom-admin-interface |
| WP Directory Kit | wpdirectorykit |
| WP Docs | wp-docs |
| WP DSGVO Tools (GDPR) | shapepress-dsgvo |
| WP eCommerce | wp-e-commerce |
| WP Forms Signature Contract Add-On | wp-forms-signature-contract-add-on |
| WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | wp-google-maps |
| WP Hello Bar | wp-hello-bar |
| WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | wp-job-portal |
| WP Membership | wp-membership |
| WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | wp-rss-aggregator |
| WP Term Order | wp-term-order |
| WP Travel – Ultimate Travel Booking System, Tour Management Engine | wp-travel |
| WP Youtube Video Gallery | wp-youtube-video-gallery |
| WP-ClanWars | wp-clanwars |
| wpCAS | wpcas |
| WPElemento Importer | wpelemento-importer |
| WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | wpo365-login |
| Xpro Addons — 140+ Widgets for Elementor | xpro-elementor-addons |
| XStore Core | et-core-plugin |
| ZT Captcha | zt-captcha |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| AdForest | adforest |
| CarSpot – Dealership Wordpress Classified Theme | carspot |
| Craft | Coffee Shop Cafe Restaurant WordPress | craftcoffee |
| DotLife | Coaching Online Courses WordPress | dotlife |
| EcoBlue | ecoblue |
| enfold | enfold |
| Grand Magazine | Blog WordPress | grandmagazine |
| Grand Spa | Massage Salon WordPress | grandspa |
| Grand Tour | Travel Agency WordPress | grandtour |
| Hostiko - Hosting WordPress & WHMCS Theme | hostiko |
| Hoteller Booking WordPress | hoteller |
| Listihub - Directory Listing WordPress Theme | listihub |
| PeakShops - Modern & Multi-Concept WooCommerce Theme | peakshops |
| Prowess - Fitness and Gym WordPress Theme | prowess |
| Travel Booking WordPress Theme | traveler |
| Werkstatt - Creative Portfolio WordPress Theme | werkstatt |
| WorkScout - Job Board WordPress Theme | workscout |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Academy LMS [academy]
Researcher
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Affected Software
Booking Activities [booking-activities]
Researcher
Affected Software
Directorist Social Login [directorist-social-login]
Researcher
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]
Researcher
Kalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action
9.8
Affected Software
KalravAI Agent [kalrav-ai-agent]
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Affected Software
LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart [lazytasks-project-task-management]
Researcher
Affected Software
Prime Listing Manager [prime-listing-manager]
Researcher
Affected Software
Movie Booking [movie-booking]
Researcher
Affected Software
Admin and Site Enhancements (ASE) [admin-site-enhancements]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Researcher
Affected Software
Final User [final-user]
Researcher
Affected Software
Hospital Doctor Directory [hospital-doctor-directory]
Researcher
Affected Software
Institutions Directory [institutions-directory]
Researcher
Affected Software
Lawyer Directory [lawyer-directory]
Researcher
Affected Software
Melapress Role Editor [melapress-role-editor]
Researcher
Affected Software
WP Membership [wp-membership]
Researcher
Affected Software
RealHomes CRM [realhomes-crm]
Researcher
Affected Software
Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
AdForest [adforest]
Researcher
Affected Software
Researcher
Affected Software
WP eCommerce [wp-e-commerce]
Researcher
Affected Software
Listivo Core [listivo-core]
Researcher
Affected Software
MyHome Core [myhome-core]
Researcher
Affected Software
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit [nexter-extension]
Researcher
Affected Software
Researcher
Affected Software
Werkstatt - Creative Portfolio WordPress Theme [werkstatt]
Researcher
Affected Software
Administrative Shortcodes [administrative-shortcodes]
Researcher
Affected Software
Coven - Furniture Store WooCommerce Theme [coven-core]
Researcher
Affected Software
Booking (Reservation & Appointment) [directorist-booking]
Researcher
Affected Software
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution]
Researcher
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Affected Software
Kentha Elementor Widgets [kentha-elementor]
Researcher
Affected Software
Koko Analytics – Privacy-Friendly WordPress Analytics [koko-analytics]
Researcher
Affected Software
MailerLite – WooCommerce integration [woo-mailerlite]
Researcher
Affected Software
Omnipress [omnipress]
Researcher
Affected Software
Paid Downloads [paid-downloads]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
BuddyPress [buddypress]
Researcher
Affected Software
AdForest Elementor [adforest-elementor]
Researcher
Affected Software
amr cron manager [amr-cron-manager]
Researcher
Affected Software
Dinatur [dinatur]
Researcher
Affected Software
Frontis Blocks — Block Library for the Block Editor [frontis-blocks]
Affected Software
Grand Tour | Travel Agency WordPress [grandtour]
Researcher
Affected Software
Homey Core [homey-core]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
My auctions allegro [my-auctions-allegro-free-edition]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Quiz Maker, Poll Maker & Survey Maker by Opinion Stage [social-polls-by-opinionstage]
Researcher
Patch Status
Patched
Patched
Published
Jan 19, 2026
Jan 19, 2026
Affected Software
Quiz Maker, Poll Maker & Survey Maker by Opinion Stage [social-polls-by-opinionstage]
Researcher
Affected Software
Researcher
Affected Software
User Submitted Posts – Enable Users to Submit Posts from the Front End [user-submitted-posts]
Researcher
Affected Software
WorkScout - Job Board WordPress Theme [workscout]
Researcher
Affected Software
Workscout Core [workscout-core]
Researcher
Affected Software
All-in-One Video Gallery [all-in-one-video-gallery]
Researcher
Affected Software
Researcher
Affected Software
Frontis Blocks — Block Library for the Block Editor [frontis-blocks]
Researcher
Affected Software
Happy Addons for Elementor [happy-elementor-addons]
Researcher
Affected Software
Nelio Content – Editorial Calendar & Social Media Auto-Posting [nelio-content]
Researcher
Affected Software
Travel Booking WordPress Theme [traveler]
Researcher
Affected Software
Ultra Portfolio [ultra-portfolio]
Researcher
Affected Software
ABG Rich Pins [abg-rich-pins]
Researcher
Affected Software
Administrative Shortcodes [administrative-shortcodes]
Researcher
Affected Software
Advanced iFrame [advanced-iframe]
Researcher
Affected Software
Alpha Blocks [alpha-blocks]
Researcher
Affected Software
ArtPlacer Widget [artplacer-widget]
Researcher
Affected Software
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Canto Testimonials [canto-testimonials]
Researcher
Affected Software
CM CSS Columns [cm-css-columns]
Researcher
Affected Software
enfold [enfold]
Researcher
Affected Software
Extend Link [extend-link]
Researcher
Affected Software
FlatPM – Ad Manager, AdSense and Custom Code [flatpm-wp]
Researcher
GZSEO <= 2.0.11 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting
6.4
Affected Software
GZSEO [gzseo]
Researcher
Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
6.4
Affected Software
Head Meta Data [head-meta-data]
Researcher
Affected Software
LeadBI Plugin for WordPress [leadbi]
Researcher
Affected Software
Omnipress [omnipress]
Researcher
Affected Software
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content [wp-rss-aggregator]
Researcher
Affected Software
Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]
Researcher
Affected Software
ThemeRuby Multi Authors – Assign Multiple Writers to Posts [themeruby-multi-authors]
Researcher
Affected Software
Tutor LMS BunnyNet Integration [tutor-lms-bunnynet-integration]
Researcher
Affected Software
Researcher
Affected Software
UX Flat [ux-flat]
Researcher
Affected Software
VK Google Job Posting Manager [vk-google-job-posting-manager]
Researcher
Affected Software
WP DSGVO Tools (GDPR) [shapepress-dsgvo]
Researcher
Affected Software
Researcher
Affected Software
XStore Core [et-core-plugin]
Researcher
Affected Software
Researcher
Affected Software
Craft | Coffee Shop Cafe Restaurant WordPress [craftcoffee]
Researcher
Affected Software
Researcher
Affected Software
Easy Theme Options [easy-theme-options]
Researcher
Affected Software
Grand Magazine | Blog WordPress [grandmagazine]
Researcher
Affected Software
Grand Spa | Massage Salon WordPress [grandspa]
Researcher
Affected Software
Hoteller Booking WordPress [hoteller]
Researcher
Affected Software
iRobots.txt SEO [irobotstxt-seo]
Researcher
Affected Software
JustClick registration plugin [justclick-subscriber]
Researcher
Affected Software
ExpressTechSoftwares Addon for MemberPress and Discord [expresstechsoftwares-memberpress-discord-add-on]
Researcher
Affected Software
My Post Order [my-posts-order]
Researcher
Affected Software
Save as PDF Plugin by PDFCrowd [save-as-pdf-by-pdfcrowd]
Researcher
Affected Software
Table of Contents Creator [table-of-contents-creator]
Researcher
Affected Software
TableOn – WordPress Posts Table Filterable [posts-table-filterable]
Researcher
Affected Software
Timeline Event History [timeline-event-history]
Researcher
Affected Software
wpCAS [wpcas]
Researcher
Affected Software
AIKTP [aiktp]
Researcher
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Affected Software
Same Category Posts [same-category-posts]
Researcher
Affected Software
Researcher
Affected Software
Textmetrics [webtexttool]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
Researcher
Affected Software
Advanced Reporting & Statistics for WooCommerce – Orders, Products & Customers Reporting [webd-woocommerce-advanced-reporting-statistics]
Researcher
Affected Software
Alchemist Ajax Upload [alchemist-ajax-upload]
Researcher
Affected Software
WP BackItUp Community Edition [wp-backitup]
Researcher
Affected Software
WP Bannerize Pro [wp-bannerize-pro]
Researcher
Affected Software
Contact Form 7 GetResponse Extension [contact-form-7-getresponse-extension]
Researcher
Affected Software
Custom Fonts – Host Your Fonts Locally [custom-fonts]
Researcher
Affected Software
Download After Email – Subscribe & Download Form Plugin [download-after-email]
Researcher
Affected Software
Easy Property Listings [easy-property-listings]
Researcher
Affected Software
ElementCamp [element-camp]
Researcher
Affected Software
Final User [final-user]
Researcher
Affected Software
Fitness Trainer- Training Membership Plugin [fitness-trainer]
Researcher
Affected Software
Hospital Doctor Directory [hospital-doctor-directory]
Researcher
Affected Software
Hotel Listings [hotel-listing]
Researcher
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Affected Software
Institutions Directory [institutions-directory]
Researcher
Affected Software
JobBank - WordPress Job manager plugin [jobbank]
Researcher
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
Lawyer Directory [lawyer-directory]
Researcher
Affected Software
LeadConnector [leadconnector]
Researcher
Affected Software
Researcher
Affected Software
Listihub - Directory Listing WordPress Theme [listihub]
Researcher
Affected Software
ListingHub [listinghub]
Researcher
Affected Software
WP Membership [wp-membership]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Affected Software
Researcher
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
Protección de datos – RGPD [proteccion-datos-rgpd]
Researcher
Affected Software
Real Estate Pro - WordPress Plugin [real-estate-pro]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
Researcher
Affected Software
SEO Booster [seo-booster]
Researcher
Affected Software
Share This Image [share-this-image]
Researcher
Affected Software
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]
Researcher
Affected Software
SumUp Payment Gateway For WooCommerce [sumup-payment-gateway-for-woocommerce]
Researcher
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
Tabby Checkout [tabby-checkout]
Researcher
Affected Software
TaxCloud for WooCommerce [simple-sales-tax]
Researcher
Affected Software
Researcher
Affected Software
UPI QR Code Payment Gateway for WooCommerce [upi-qr-code-payment-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Notifications for Forms & WordPress Actions [notifier]
Researcher
Affected Software
Web Push Notifications – Webpushr [webpushr-web-push-notifications]
Researcher
Affected Software
Researcher
Affected Software
Wired Impact Volunteer Management [wired-impact-volunteer-management]
Researcher
Affected Software
Wise Analytics [wise-analytics]
Researcher
Affected Software
Wizit Gateway for WooCommerce [wizit-gateway-for-woocommerce]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]
Researcher
Affected Software
WP-ClanWars [wp-clanwars]
Researcher
Affected Software
Cookie consent for developers [cookie-consent-for-developers]
Researcher
Affected Software
JavaScript Notifier [javascript-notifier]
Researcher
Affected Software
Meta-box GalleryMeta [meta-box-gallerymeta]
Researcher
Affected Software
Postalicious [postalicious]
Researcher
Affected Software
Responsive Header Plugin [responsive-header]
Researcher
Affected Software
Viet contact [viet-contact]
Researcher
Affected Software
WP Hello Bar [wp-hello-bar]
Researcher
Affected Software
Admin login URL Change [admin-login-url-change]
Researcher
Affected Software
AdminQuickbar [adminquickbar]
Researcher
Affected Software
Ai Image Alt Text Generator for WP [ai-image-alt-text-generator-for-wp]
Researcher
Affected Software
Alex User Counter [user-counter]
Researcher
Affected Software
All-in-One Video Gallery [all-in-one-video-gallery]
Researcher
Affected Software
Anything Order by Terms [anything-order-by-terms]
Researcher
Affected Software
Automatic Featured Images from Videos [automatic-featured-images-from-videos]
Researcher
Affected Software
Autopost for X (formerly Autoshare for Twitter) [autoshare-for-twitter]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Booter – Bots & Crawlers Manager [booter-bots-crawlers-manager]
Researcher
Affected Software
BOX NOW Delivery [box-now-delivery]
Researcher
Affected Software
Broadstreet [broadstreet]
Researcher
Affected Software
Cloudinary – Deliver Images and Videos at Scale [cloudinary-image-management-and-manipulation-in-the-cloud-cdn]
Researcher
Affected Software
Lead Form Builder & Contact Form [lead-form-builder]
Researcher
Affected Software
CubeWP Framework [cubewp-framework]
Researcher
Affected Software
WP Custom Admin Interface [wp-custom-admin-interface]
Researcher
Affected Software
Ecwid by Lightspeed Ecommerce Shopping Cart [ecwid-shopping-cart]
Researcher
Affected Software
Edwiser Bridge – WordPress Moodle Integration [edwiser-bridge]
Researcher
Affected Software
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) [extensions-for-cf7]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Fraud Prevention For WooCommerce and EDD [woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers]
Researcher
Affected Software
Friendly Functions for Welcart [friendly-functions-for-welcart]
Researcher
Affected Software
GDPR CCPA Compliance & Cookie Consent Banner [ninja-gdpr-compliance]
Researcher
Affected Software
Researcher
Affected Software
HD Quiz [hd-quiz]
Researcher
Affected Software
Hospital Doctor Directory [hospital-doctor-directory]
Researcher
Affected Software
Hotel Listings [hotel-listing]
Researcher
Affected Software
iNET Webkit [inet-webkit]
Researcher
Affected Software
Institutions Directory [institutions-directory]
Researcher
Affected Software
File Manager for Google Drive – Integrate Google Drive [integrate-google-drive]
Researcher
Integration for Contact Form 7 HubSpot <= 1.4.3 - Authenticated (Subscriber+) Information Exposure
4.3
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Latest Post Shortcode [latest-post-shortcode]
Researcher
Affected Software
Lawyer Directory [lawyer-directory]
Researcher
Affected Software
LifePress [lifepress]
Researcher
Affected Software
Login Page Editor [login-page-editor]
Researcher
Affected Software
Materialis Companion [materialis-companion]
Researcher
Affected Software
Media Library File Size [media-library-file-size]
Researcher
Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management
4.3
Affected Software
Meta-box GalleryMeta [meta-box-gallerymeta]
Researcher
Affected Software
Moderate Selected Posts [moderate-selected-posts]
Researcher
Affected Software
Monetag Official Plugin [monetag-official]
Researcher
Affected Software
Newsletter – Send awesome emails from WordPress [newsletter]
Researchers
Affected Software
Researcher
Affected Software
Points and Rewards for WooCommerce [points-and-rewards-for-woocommerce]
Researcher
Affected Software
Set Bulk Post Categories [set-bulk-post-categories]
Researcher
Affected Software
Simple Crypto Shortcodes [simple-crypto-shortcodes]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Simple Membership WP user Import [simple-membership-wp-user-import]
Researcher
Affected Software
Researcher
Affected Software
Star Review Manager [star-review-manager]
Researcher
Affected Software
SurveyJS: Drag & Drop Form Builder [surveyjs]
Researcher
Affected Software
SurveyJS: Drag & Drop Form Builder [surveyjs]
Researcher
Affected Software
SurveyJS: Drag & Drop Form Builder [surveyjs]
Researcher
Affected Software
WP Term Order [wp-term-order]
Researcher
Affected Software
TOP Table Of Contents [top-table-of-contents]
Researcher
weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update
4.3
Affected Software
Researcher
Affected Software
Wishlist Member [wishlist-member-x]
Researcher
Affected Software
WP Forms Signature Contract Add-On [wp-forms-signature-contract-add-on]
Researcher
Affected Software
WP Youtube Video Gallery [wp-youtube-video-gallery]
Researcher
Affected Software
WPElemento Importer [wpelemento-importer]
Researcher
Affected Software
ZT Captcha [zt-captcha]
Researcher
Affected Software
Researcher
Affected Software
Salon Booking System – Free Version [salon-booking-system]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments