Daily summary
Vulnerabilities of 31 October 2026: 66 new, 7 critical
66 vulnerabilities added on 31 October 2026, 7 critical and 27 high: Authentication bypass in WordPress plugins, Remote code execution in WordPress plugins, Arbitrary file upload in WordPress plugins and more.
- 7 critical
- 27 high
- 32 medium
Authentication bypass in WordPress plugins
3 vulnerabilities
- 9.8Uncanny Toolkit for LearnDashUnauthenticated Authentication Bypass via 'email' Parameter
- 8.1Wp Social Login and Register Social CounterUnauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback
- 5.3Welcart e-CommerceAccount Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
Remote code execution in WordPress plugins
3 vulnerabilities
- 9.8Project ManagerUnauthenticated Remote Code Execution via 'id' Parameter Function Injection
- 9.8PDF Invoice for WooCommerce + Drag and Drop Template BuilderUnauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
- 8.8Nextgen GalleryAuthenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
Arbitrary file upload in WordPress plugins
1 vulnerability
Broken access control in WordPress plugins
6 vulnerabilities
- 9.1WP Booking SystemMissing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action
- 9.1Popup BuilderMissing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
- 6.5Redux FrameworkMissing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript
- 5.9WP Data AccessMissing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter
- 5.3Product Filter for WooCommerce by WBWMissing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter
- 4.3HustleMissing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and…
Arbitrary file access in WordPress plugins
3 vulnerabilities
- 9.1Acadlix LMSUnauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter
- 6.5Spectra Gutenberg BlocksMissing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters
- 5.4Photo Reviews for WooCommerceUnauthenticated File Deletion via 'wcpr_image_upload_id' Parameter
Privilege escalation in WordPress plugins
3 vulnerabilities
- 8.8User FrontendAuthenticated (Subscriber+) Privilege Escalation via post_content Parameter
- 8.8Rox Appointment BookingUnauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint
- 7.5Mail logging & CatcherAuthenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure
SQL injection in WordPress plugins
4 vulnerabilities
- 7.5WP Directory KitUnauthenticated SQL Injection via 'idfield' Parameter
- 7.5FunnelKit AutomationsUnauthenticated SQL Injection via 'bwfan_cart_id' Parameter
- 6.5WP2LEADSAuthenticated (Subscriber+) SQL Injection via order Parameter
- 5.3NewslettersAuthenticated (Subscriber+) SQL Injection via 'id' Parameter
Cross-site scripting in WordPress plugins
29 vulnerabilities
- 7.2Debug Log ManagerUnauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
- 7.2FeedWordPressUnauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
- 7.2WPO365 | MICROSOFT 365 GRAPH MAILERUnauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail
- 7.2Shield SecurityUnauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log
- 7.2Shipping Zones by Drawing for WooCommerceUnauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter
Show 24 more
- 7.2VikRentCar Car Rental Management SystemUnauthenticated Stored Cross-Site Scripting via 'optionals' Parameter
- 7.2Welcart e-CommerceUnauthenticated Stored Cross-Site Scripting via 'gid' Parameter
- 7.2PDF Invoices & Packing Slips for WooCommerceUnauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout
- 7.2VikRentCar Car Rental Management SystemUnauthenticated Stored Cross-Site Scripting via 'poplink' Parameter
- 7.2User Submitted PostsUnauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
- 7.2RelevanssiUnauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
- 7.2ThirstyAffiliatesUnauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
- 7.2SureCartUnauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
- 7.2W3 Total CacheUnauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
- 7.2PPWPUnauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision
- 7.2Meow LightboxUnauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
- 6.4FlexStockAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
- 6.4GeoDirectoryAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
- 6.4Smart PostAuthenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block
- 6.4SEOPressAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag
- 6.4Publishpress AuthorsAuthenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name
- 6.4Discussion BoardAuthenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field
- 6.4WP Job PortalAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter
- 6.1User FrontendReflected Cross-Site Scripting via 'field_attr[required]' Parameter
- 6.1Product Filter for WooCommerce by WBWReflected Cross-Site Scripting via 'wpf_fid' JSON Parameter
- 6.1WebmentionUnauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag
- 5.4Content PilotUnauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`
- 5.4W3 Total CacheUnauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
- 5.4Photo Gallery, Sliders, Proofing and ThemesUnauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
Ninja Forms
4 vulnerabilities · WordPress plugins
- 7.2Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
- 6.5Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
- 6.1Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
- 5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
Sensitive data exposure in WordPress plugins
3 vulnerabilities
- 5.3Booking for Appointments and Events CalendarUnauthenticated Sensitive Information Exposure in 'page' Parameter
- 5.3PDF Invoices & Packing Slips for WooCommerceUnauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache
- 5.3Seraphinite AcceleratorUnauthenticated Sensitive Information Exposure in Object Cache Directory
WordPress core
1 vulnerability
Servers and applications
2 vulnerabilities
Other vulnerabilities in WordPress plugins
3 vulnerabilities
- 6.5UsersWPUnauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash
- 5.3All in One SEOVulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
- 4.3Germanized for WooCommerceAuthenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change
npm packages
1 vulnerability
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.