UpHeron
All posts

Critical vulnerabilities

8 critical vulnerabilities in 8 WordPress plugins

8 vulnerabilities rated critical (CVSS 9.0 or higher) found on 3 November 2026: Remote code execution in WordPress plugins, Arbitrary file upload in WordPress plugins, Privilege escalation in WordPress plugins and more.

  • 8 critical

Remote code execution in WordPress plugins

2 vulnerabilities

  1. 10.0The GridUp to 2.8.1CVE-2026-94169
  2. 9.8My CalendarUnauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' AttributeUp to 3.8.7CVE-2026-104798

Arbitrary file upload in WordPress plugins

2 vulnerabilities

  1. 9.8ELEX WordPress HelpDesk & Customer Ticketing SystemUnauthenticated Arbitrary File Upload via IMAP Email AttachmentUp to 3.3.7CVE-2026-103768
  2. 9.8Mang BoardUnauthenticated Arbitrary File Upload via 'image_path' ParameterUp to 2.4.4CVE-2026-109219

Privilege escalation in WordPress plugins

2 vulnerabilities

  1. 9.8Theme My LoginUnauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data FilterUp to 7.2.1CVE-2026-89079
  2. 9.8MailOptinUnauthenticated Privilege Escalation to 'form_custom_field_mappings' ParameterUp to 1.2.78.6CVE-2026-109515

PHP object injection in WordPress plugins

1 vulnerability

  1. 9.8Sunshine Photo CartUnauthenticated PHP Object Injection via 'key' ParameterUp to 3.7.4CVE-2026-104730

SQL injection in WordPress plugins

1 vulnerability

  1. 9.3Green PopupsFixed in 7.6.3CVE-2026-94388

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.