UpHeron
All posts

Critical vulnerabilities

71 critical vulnerabilities in 45 WordPress themes, 24 WordPress plugins and ZITADEL

71 vulnerabilities rated critical (CVSS 9.0 or higher) found on 3 November 2026: Remote code execution in WordPress plugins, Arbitrary file upload in WordPress plugins, PHP object injection in WordPress themes and more.

  • 71 critical

Remote code execution in WordPress plugins

2 vulnerabilities

  1. 10.0SiteVault – Backup, Restore, Migration & CloningUp to 1.5.19CVE-2026-42696
  2. 9.83D Product configurator for WooCommerceUnauthenticated Remote Code Execution via 'xpv_image' ParameterUp to 2.16.2CVE-2026-103889

Arbitrary file upload in WordPress plugins

4 vulnerabilities

  1. 9.9Creator LMSUp to 1.2.21CVE-2026-62129
  2. 9.9CodeBard Help DeskUp to 1.1.2CVE-2026-62024
  3. 9.8Extensions For Cf7Unauthenticated Arbitrary File Upload via Signature Field File UploadUp to 3.4.5CVE-2026-94589
  4. 9.0Tailored ToolsUp to 3.0.3CVE-2026-62025

PHP object injection in WordPress themes

45 vulnerabilities

  1. 9.8Buzz Stone | Magazine & Viral Blog WordPressUp to 1.0.2CVE-2026-81797
  2. 9.8PhotoliaUp to 1.0.3CVE-2026-78535
  3. 9.8QweryUp to 3.6.1CVE-2026-78533
  4. 9.8JacquelineUp to 2.22CVE-2026-78531
  5. 9.8AllianceUp to 3.11CVE-2026-78529
Show 40 more
  1. 9.8KickerUp to 2.2.1CVE-2026-66569
  2. 9.8OriginalUp to 1.9.0CVE-2026-66568
  3. 9.8AnestaUp to 1.5.3CVE-2026-66567
  4. 9.8FC UnitedUp to 1.1.1CVE-2026-66565
  5. 9.8ShiftCVUp to 3.0.14CVE-2026-66564
  6. 9.8Education CenterUp to 3.6.12CVE-2026-66483
  7. 9.8WindsorUp to 2.10CVE-2026-66563
  8. 9.8Drone MediaUp to 2.2.0CVE-2026-66482
  9. 9.8Asia GardenUp to 1.3.1CVE-2026-62125
  10. 9.8InvetexUp to 2.18CVE-2026-62123
  11. 9.8N7 | Golf Club Sports & EventsUp to 2.21CVE-2026-62124
  12. 9.8Law OfficeUp to 3.20CVE-2026-62120
  13. 9.8WineShopUp to 3.20CVE-2026-62090
  14. 9.8EquadioUp to 1.1.4CVE-2026-62087
  15. 9.8JunoUp to 2.25CVE-2026-62086
  16. 9.8AvalaUp to 1.1.4CVE-2026-62077
  17. 9.8KallesUp to 1.1.7.1CVE-2026-62076
  18. 9.8Yacht RentalUp to 2.6CVE-2026-62054
  19. 9.8Wine HouseUp to 3.20CVE-2026-62053
  20. 9.8TipsyUp to 1.6CVE-2026-62052
  21. 9.8SplendourUp to 1.23CVE-2026-62050
  22. 9.8StargazeUp to 1.10CVE-2026-62051
  23. 9.8CleanSkinUp to 1.5.0CVE-2026-42723
  24. 9.8BookloversUp to 2.13.0CVE-2026-62045
  25. 9.8GutentypeUp to 2.1.12CVE-2026-62046
  26. 9.8DwellUp to 1.16.0CVE-2026-93942
  27. 9.8ConvexUp to 1.16.0CVE-2026-93943
  28. 9.8CameliaUp to 1.2.15CVE-2026-93944
  29. 9.8HygiaUp to 1.21.0CVE-2026-93937
  30. 9.8HogwordsUp to 1.2.7CVE-2026-93938
  31. 9.8GreenyUp to 2.10.0CVE-2026-93940
  32. 9.8EdemaUp to 1.2.2.2CVE-2026-93941
  33. 9.8PartisoUp to 1.1.13CVE-2026-93934
  34. 9.8Let's PlayUp to 1.1.15CVE-2026-93935
  35. 9.8IPharmUp to 1.2.4CVE-2026-93936
  36. 9.8TantraUp to 2.9.0CVE-2026-93930
  37. 9.8SmashUp to 1.12.0CVE-2026-93931
  38. 9.8Smart CasaUp to 1.0.12CVE-2026-93932
  39. 9.8RosalindaUp to 1.2.4CVE-2026-93933
  40. 9.8TravesiaUp to 1.1.16CVE-2026-93929

PHP object injection in WordPress plugins

6 vulnerabilities

  1. 9.8Booster for WooCommerceUp to 8.4.0CVE-2026-42718
  2. 9.8Dynamic User DirectoryUp to 2.4CVE-2026-42719
  3. 9.8Payever - WooCommerce GatewayUp to 4.8.2CVE-2026-42716
  4. 9.8AFFI – Affiliate Marketing for WooCommerceUp to 1.0.10CVE-2026-104398
  5. 9.8BalanceUp to 1.12.0CVE-2026-93945
  6. 9.8VetoUp to 1.6.0CVE-2026-93927

Privilege escalation in WordPress plugins

4 vulnerabilities

  1. 9.8Tonda MembershipUp to 1.0.1CVE-2026-62022
  2. 9.8AIWUUp to 1.5.9CVE-2026-39801
  3. 9.8miniorange otp verificationUp to 5.5.7CVE-2026-106610
  4. 9.1Blocksy CompanionUnauthenticated Privilege Escalation to 'role' ParameterUp to 2.1.58CVE-2026-107645

Arbitrary file access in WordPress plugins

2 vulnerabilities

  1. 9.8rtMedia for WordPress, BuddyPress and bbPressUp to 4.7.13CVE-2026-105892
  2. 9.1PPOMUnauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' ParameterUp to 34.0.10CVE-2026-104801

Authentication bypass in WordPress plugins

2 vulnerabilities

  1. 9.8WPCOM MemberUnauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login CallbackUp to 1.7.27CVE-2026-104803
  2. 9.8Advanced IP BlockerUnauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login HandlerUp to 8.13.13CVE-2026-104732

File inclusion in WordPress plugins

1 vulnerability

  1. 9.8DirectoryPressUp to 3.6.27CVE-2026-62032

SQL injection in WordPress plugins

3 vulnerabilities

  1. 9.3uListingUp to 2.2.0CVE-2026-62031
  2. 9.3Elex Bulk Edit Products Prices Attributes For Woocommerce BasicUp to 1.5.3CVE-2026-40800
  3. 9.3TickeraUp to 3.6.0.6CVE-2026-105889

Authentication bypass in servers and applications

2 vulnerabilities

  1. 9.3ZITADELZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider ConfusionFixed in 4.19.2CVE-2026-109372
  2. 9.2ZITADELZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session CookieFixed in 4.19.2CVE-2026-109373

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.