WordPress Security Roundup: November 6 to November 13, 2026
Short answer
From November 6 to November 13, 2026, 38 WordPress security issues were severe enough or widespread enough to list. This post covers the 29 most severe: 5 critical and 24 high. If your site runs any plugin or theme below, back it up and update to the fixed version. If no fix is out yet, deactivate it until one ships. If you would rather not handle updates yourself, see our WordPress services.
This week, 38 WordPress security issues matched our review for November 6 to November 13, 2026. The post lists the 29 most severe, which include 5 rated critical and 24 rated high. The issues affect several kinds of software, including form plugins, appointment booking plugins, course and education tools, and WooCommerce checkout add-ons, as well as one theme.
The problems reported include account takeover, authentication bypass, privilege escalation, arbitrary file deletion, and file upload. You should update the software listed below as soon as you can, and remove any item you no longer use.
Which WordPress plugins and themes need an update this week?
These are the plugins and themes on this list, most severe first. Select a name to jump to its details.
Source: Wordfence Intelligence, November 2026. Severity is the CVSS score out of 10.
What is each issue and how do you fix it?
Each entry gives the type of flaw, its severity score, the affected and fixed versions and a link to the full record.
38 issues matched this week. The 29 most severe are listed here.
AutomatorWP Webhooks (plugin)
- Issue: Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field
- Severity: 9.8 out of 10 (Critical)
- Affected versions: 1.4.4 and earlier
- Fixed in: 1.4.5
- What to do: Update to version 1.4.5, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-126173
- Source: Wordfence Intelligence record
The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger: with an 'Is the user ID' field: to an Update-User action whose User ID field is left blank…
Basel Post Types (plugin)
- Issue: Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt
- Severity: 9.8 out of 10 (Critical)
- Affected versions: 1.18 and earlier
- Fixed in: 1.19
- What to do: Update to version 1.19, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-89324
- Source: Wordfence Intelligence record
The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entir…
Ninja Forms: File Uploads (plugin)
- Issue: Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'
- Severity: 9.1 out of 10 (Critical)
- Affected versions: 3.3.36 and earlier
- Fixed in: 3.3.37
- What to do: Update to version 3.3.37, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-126537
- Source: Wordfence Intelligence record
The Ninja Forms: File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes/fields/upload.php: which returns early (leaving the client-supplied files[] intact) whenever a public submission carries a nonempty extra.saveProgress: and NF_FU_External_Abstracts_Service::process_upload() in includes/external/abstracts/service.php, whose authoritative-path reload only fires when the client sends upload_id. By omitting up…
Checkout Field Editor for WooCommerce (Pro) (plugin)
- Issue: Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action
- Severity: 9.1 out of 10 (Critical)
- Affected versions: 3.8.0 and earlier
- Fixed in: 3.8.1
- What to do: Update to version 3.8.1, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-122041
- Source: Wordfence Intelligence record
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (includi…
Appointment Booking Plugin: LatePoint | Calendar & Scheduling for WordPress (plugin)
- Issue: Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter
- Severity: 9.1 out of 10 (Critical)
- Affected versions: 5.7.6 and earlier
- Fixed in: 5.7.7
- What to do: Update to version 5.7.7, or a newer patched version
- Active installs: 100,000+
- CVE: CVE-2026-118066
- Source: Wordfence Intelligence record
The Appointment Booking Plugin: LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()` function in `lib/models/model.php` comparing WHERE-clause values against the literal strings `'IS NULL'` and `'IS NOT NULL'` and concatenating a match directly into SQL without binding it as a parameter, a flaw that neither `sanitize_text_field()` nor the 5.7.5 `is_scalar()` hardening guard closes, since both pass the scalar sentinel thr…
Widget Options: Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets (plugin)
- Issue: Authenticated (Contributor+) Code Injection via 'post_content' Parameter
- Severity: 8.8 out of 10 (High)
- Affected versions: 4.2.6.1 and earlier
- Fixed in: 4.2.7
- What to do: Update to version 4.2.7, or a newer patched version
- Active installs: 100,000+
- CVE: CVE-2026-116615
- Source: Wordfence Intelligence record
The Widget Options: Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing between the save-time strip filter (`widgetopts_strip_logic_from_blocks()`) and the render-time parser (`blockopts_filter_before_display()`): embedding an inner `<!–start_widgetopts` literal inside a JSON key causes the write-side `json_decode` to see a non-`class` key and skip stripping: persisting the payload verbatim to the database:…
VibeBP (plugin)
- Issue: Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()
- Severity: 8.8 out of 10 (High)
- Affected versions: 1.9.9.8.1 and earlier
- Fixed in: 1.9.9.8.2
- What to do: Update to version 1.9.9.8.2, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-16135
- Source: Wordfence Intelligence record
The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to grant themselves administrator privileges by updating their own 'wp_capabilities' user meta value.
CourseCure Courses (plugin)
- Issue: Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint
- Severity: 8.8 out of 10 (High)
- Affected versions: 1.5.1 and earlier
- Fixed in: 1.5.3
- What to do: Update to version 1.5.3, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-15309
- Source: Wordfence Intelligence record
The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update_option() with attacker-controlled keys and values without any authorization verification. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges to administrator by setting the default_role WordPress option to 'administrator' and users_can_register to '1', then registering a…
Masterstudy: Education WordPress Theme (theme)
- Issue: Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- Severity: 8.8 out of 10 (High)
- Affected versions: 4.8.151 and earlier
- Fixed in: 4.8.152
- What to do: Update to version 4.8.152, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-13764
- Source: Wordfence Intelligence record
The Masterstudy: Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by setting the `stm_developer_access_token` transient and using the developer access auto-login flow to obtain administrator session cookies.
Reset Database (plugin)
- Issue: Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset()
- Severity: 8.8 out of 10 (High)
- Affected versions: 1.1.3 and earlier
- Fixed in: No fix released yet
- What to do: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-119615
- Source: Wordfence Intelligence record
The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the process_reset() function being registered on admin_init with no capability check, a computed-but-unused nonce, a gating condition that passes whenever no WordPress administrator literally named 'admin' exists (the default on modern installs), and an identity test that verifies the ATTACKER'S OWN password rather than an administrator's. This makes it possible for authenticated attackers, with subscriber-level access and above, to drop every prefixed database…
6Storage Rentals (plugin)
- Issue: Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'six_storage_online_api_url' Option Poisoning + Transient-Backed Auth Bypass
- Severity: 8.8 out of 10 (High)
- Affected versions: 2.31.0 and earlier
- Fixed in: No fix released yet
- What to do: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-103883
- Source: Wordfence Intelligence record
The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the `six_storage_portal_registration()` AJAX handler: registered on `wp_ajax_six_storage_portal_plugin_registration`: performs no capability check and no nonce verification before writing the caller-supplied `six_storage_online_api_url` POST parameter to the site-wide option of the same name; the unauthenticated `six_storage_create_wp_user()` handler then redeems a transient seeded from that att…
Everest Forms: Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (plugin)
- Issue: Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
- Severity: 8.2 out of 10 (High)
- Affected versions: 3.6.2 and earlier
- Fixed in: 3.6.3
- What to do: Update to version 3.6.3, or a newer patched version
- Active installs: 90,000+
- CVE: CVE-2026-120513
- Source: Wordfence Intelligence record
The Everest Forms: Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when…
Photo Gallery, Sliders, Proofing and Themes: NextGEN Gallery (plugin)
- Issue: Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters
- Severity: 8.1 out of 10 (High)
- Affected versions: 4.5.5 and earlier
- Fixed in: 4.5.6
- What to do: Update to version 4.5.6, or a newer patched version
- Active installs: 300,000+
- CVE: CVE-2026-118191
- Source: Wordfence Intelligence record
The Photo Gallery, Sliders, Proofing and Themes: NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The 'NextGEN Manage gallery' capability required to reach the vulnerable endpoint is granted to Administrators by default but can…
ARforms (plugin)
- Issue: Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header
- Severity: 8.1 out of 10 (High)
- Affected versions: 7.2.4 and earlier
- Fixed in: 7.3
- What to do: Update to version 7.3, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-111190
- Source: Wordfence Intelligence record
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution poss…
WPML Multilingual CMS (plugin)
- Issue: Unauthenticated Authentication Bypass in Language-per-Domain SSO via 'wpml_sso_token_domain' Parameter
- Severity: 8.1 out of 10 (High)
- Affected versions: 4.9.7 and earlier
- Fixed in: 5.0.0
- What to do: Update to version 5.0.0, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-76877
- Source: Wordfence Intelligence record
The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain sign-in token via `wp_create_nonce('wpml_sso')` on the logout landing page, where the browser has already discarded its authentication cookies: so `wp_get_session_token()` returns an empty string and the token collapses to the shared anonymous nonce for the current 12-hour tick rather than a user-bound secret: and then storing it in the…
Everest Forms: Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (plugin)
- Issue: Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
- Severity: 7.5 out of 10 (High)
- Affected versions: 3.6.3 and earlier
- Fixed in: No fix released yet
- What to do: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
- Active installs: 90,000+
- CVE: CVE-2026-115483
- Source: Wordfence Intelligence record
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check, without validating or restricting the path. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, such as wp-config.php, which can contain sensitive information. Successful exploitation requires a form whose email notification has…
All in One Addons For WPBakery Page Builder (formerly Visual Composer) (plugin)
- Issue: Authenticated (Contributor+) Local File Inclusion
- Severity: 7.5 out of 10 (High)
- Affected versions: 1.2 and earlier
- Fixed in: No fix released yet
- What to do: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-110516
- Source: Wordfence Intelligence record
The All in One Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
Ultra Addons for Contact Form 7 (plugin)
- Issue: Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser
- Severity: 7.5 out of 10 (High)
- Affected versions: 3.5.54 and earlier
- Fixed in: 3.5.55
- What to do: Update to version 3.5.55, or a newer patched version
- Active installs: 60,000+
- CVE: CVE-2026-100386
- Source: Wordfence Intelligence record
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the PDF Generator addon to be active and an administrator-configured PDF body template to be enabled for the targeted contact form.
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more (plugin)
- Issue: Unauthenticated Denial of Service
- Severity: 7.5 out of 10 (High)
- Affected versions: 3.13.6 and earlier
- Fixed in: 3.13.7
- What to do: Update to version 3.13.7, or a newer patched version
- Active installs: 200,000+
- CVE: CVE-2026-120854
- Source: Wordfence Intelligence record
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 3.13.6. This is due to insufficient validation of user supplied input. This makes it possible for unauthenticated attackers to make the affected site unavailable.
Booking for Appointments and Events Calendar: Amelia Pro (plugin)
- Issue: Unauthenticated SQL Injection via 'tag' Parameter Array Keys
- Severity: 7.5 out of 10 (High)
- Affected versions: 4.0 to 9.9.1
- Fixed in: 9.9.2
- What to do: Update to version 9.9.2, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-116751
- Source: Wordfence Intelligence record
The Booking for Appointments and Events Calendar: Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'tag[] (array KEYS)' parameter in all versions up to, and including, 9.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress's wp_magic_quotes escapes array values but not array keys, meaning attacker-…
Booking for Appointments and Events Calendar: Amelia (plugin)
- Issue: Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint
- Severity: 7.5 out of 10 (High)
- Affected versions: 9.0 to 9.9.1
- Fixed in: 9.9.2
- What to do: Update to version 9.9.2, or a newer patched version
- Active installs: 90,000+
- CVE: CVE-2026-107616
- Source: Wordfence Intelligence record
The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability: which the plugin's own `wpamelia-customer` role possesses: and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export…
Forminator Forms: Contact Form, Payment Form & Custom Form Builder (plugin)
- Issue: Unauthenticated Privilege Escalation
- Severity: 7.3 out of 10 (High)
- Affected versions: before 1.58.4
- Fixed in: 1.58.4
- What to do: Update to version 1.58.4, or a newer patched version
- Active installs: 600,000+
- CVE: CVE-2026-111579
- Source: Wordfence Intelligence record
The Forminator Forms: Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to 1.58.4. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privileges beyond those intended for their role.
ProfilePress: Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content (plugin)
- Issue: Unauthenticated Arbitrary Shortcode Execution
- Severity: 7.3 out of 10 (High)
- Affected versions: 4.17.7 and earlier
- Fixed in: 4.18.0
- What to do: Update to version 4.18.0, or a newer patched version
- Active installs: 100,000+
- CVE: CVE-2026-39733
- Source: Wordfence Intelligence record
The The ProfilePress: Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
ARforms (plugin)
- Issue: Unauthenticated Stored Cross-Site Scripting via Referer Header
- Severity: 7.2 out of 10 (High)
- Affected versions: 7.2.4 and earlier
- Fixed in: 7.3
- What to do: Update to version 7.3, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-12424
- Source: Wordfence Intelligence record
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The arf_save_incomplete_form_data() AJAX handler is registered with wp_ajax_nopriv_, meaning unauthenticated attackers can store a malicious payload by submitting a partial form entry with a forged Referer header, with no authentication require…
ARforms (plugin)
- Issue: Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
- Severity: 7.2 out of 10 (High)
- Affected versions: 7.2.4 and earlier
- Fixed in: 7.3
- What to do: Update to version 7.3, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-12427
- Source: Wordfence Intelligence record
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is deserialized via maybe_unserialize() when an administrator views the affected entry; if the attacker's array contains a 'referrer' key, the attacker-controlled page_url and http_referrer values are used as-i…
Avada (Fusion) Builder (plugin)
- Issue: Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook
- Severity: 7.2 out of 10 (High)
- Affected versions: 3.16.1 and earlier
- Fixed in: 3.16.2
- What to do: Update to version 3.16.2, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-84938
- Source: Wordfence Intelligence record
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Fusion Form is embedded on an admin-authored page (granting manage_options context to the Dynamic Data action hook ca…
ARMember Premium: Membership Plugin, Content Restriction, Member Levels, User Profile & User signup (plugin)
- Issue: Unauthenticated Stored Cross-Site Scripting via Registration Custom Field
- Severity: 7.2 out of 10 (High)
- Affected versions: 7.8.1 and earlier
- Fixed in: 7.8.2
- What to do: Update to version 7.8.2, or a newer patched version
- Active installs: Not listed on WordPress.org (sold elsewhere, so there is no public count)
- CVE: CVE-2026-93427
- Source: Wordfence Intelligence record
The ARMember Premium: Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AI Engine: MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini (plugin)
- Issue: Unauthenticated Stored Cross-Site Scripting
- Severity: 7.2 out of 10 (High)
- Affected versions: 3.9.1 and earlier
- Fixed in: 3.9.2
- What to do: Update to version 3.9.2, or a newer patched version
- Active installs: 90,000+
- CVE: CVE-2026-123478
- Source: Wordfence Intelligence record
The AI Engine: MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.1. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
JetFormBuilder: Dynamic Blocks Form Builder (plugin)
- Issue: Unauthenticated Stored Cross-Site Scripting
- Severity: 7.2 out of 10 (High)
- Affected versions: 3.6.8 and earlier
- Fixed in: 3.6.8.1
- What to do: Update to version 3.6.8.1, or a newer patched version
- Active installs: 80,000+
- CVE: CVE-2026-123482
- Source: Wordfence Intelligence record
The JetFormBuilder: Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.6.8. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What should you do about these issues?
Back up your site, then update each listed plugin or theme you use to its fixed version. Here is the order to follow.
- Check what you run. In your WordPress dashboard, open Plugins, then Appearance and Themes. Compare the names and version numbers with the table above.
- Back up first. Make a fresh backup of your files and database before you change anything.
- Update to the fixed version. Use Dashboard, then Updates, or the update link on the Plugins screen. Premium plugins may need a new download from the seller.
- No fix yet? Deactivate the plugin or theme until the developer ships a fix, and delete it if your site can run without it.
- Test the site. Load your home page, send a test form and try checkout if you sell online, so you know the update did not break anything.
Questions people ask
What do the severity scores mean?
Each score is a CVSS rating on a scale of 0 to 10. Scores of 9.0 and up are critical, 7.0 to 8.9 are high, 4.0 to 6.9 are medium and 0.1 to 3.9 are low. A higher score means the flaw is easier to abuse or can do more harm.
What if an issue has no fix yet?
It means the developer has not released a patched version. Until they do, the safest choice is to deactivate the plugin or theme, or swap it for one that is still looked after.
Is my site at risk if I do not use these plugins?
A flaw in a plugin or theme only affects sites that have it installed. A plugin that is installed but turned off can still be a risk in some cases, so delete the ones you no longer use.
How do I check which version I have?
In your WordPress dashboard, open Plugins. The version number shows under each plugin name. For themes, open Appearance, then Themes, and click a theme to see its version.
Why are only some issues listed?
It lists issues published in the last 7 days that score 7.0 or higher and affect a plugin or theme with at least 50,000 active installs on WordPress.org or one sold outside WordPress.org, where install counts are not public, plus any issue in WordPress core. When more than 29 match, only the 29 most severe are shown here.
Sources and copyright
- Wordfence Intelligence vulnerability database: the source of every record in this post.
- CVE Program: the public ID given to each known flaw.
- FIRST CVSS: how the 0 to 10 severity scores are worked out.
The vulnerability data in this post comes from Wordfence Intelligence. Each entry above links to its full record. The data licenses are at the end of this post.
Keep your site patched without doing it yourself
We keep WordPress sites updated, backed up and secure every day, and we fix what breaks. Care plans, one-time fixes and developer help, all from one team.
About the author
Jonathan Wofford is the founder of Your WP Guy, a WordPress care and maintenance service supporting 105+ active client sites. He and his team keep WordPress sites fast, secure, and running, so business owners can stay focused on their business instead of their website.
Data license
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
https://www.cve.org/Legal/TermsOfUse
