CVE-2026-96451 The account form edits whoever was fetched last in Ultimate Member Ultimate Member Privilege escalation CWE-266 200,000+ 1 Oct 8.8 CVE-2026-97287 Routing around a working whitelist in Event Tickets Event Tickets SQL injection CWE-89 90,000+ 30 Sept 8.5 CVE-2026-97293 Injecting past the closing parenthesis in Media Library Assistant Media Library Assistant SQL injection CWE-89 70,000+ 30 Sept 8.5 CVE-2026-94487 A nonce check that fails open in PublishPress Capabilities PublishPress Capabilities Cross-site request forgery CWE-352 100,000+ 23 Sept 8.1 CVE-2026-94123 Unauthenticated arbitrary file read in NextGEN Gallery NextGEN Gallery Path traversal CWE-22 300,000+ 24 Sept 7.5 CVE-2026-107431 The two zeroes that compared equal in JetFormBuilder JetFormBuilder Missing authorization CWE-862 80,000+ 12 Oct 7.5 CVE-2026-94178 Subscriber to administrator through a CSV batch resume Import and export users and customers Privilege escalation CWE-266 70,000+ 24 Sept 7.5 CVE-2026-97307 The scrub list that only knew about payments in Cost Calculator Builder Cost Calculator Builder Sensitive data exposure CWE-200 20,000+ 2 Oct 7.5 CVE-2026-104406 The unhook list that became the authorization check in picu picu Missing authorization CWE-862 2,000+ 5 Oct 7.3 CVE-2026-102385 The encode and the decode cancel out in Ninja Forms Ninja Forms Cross-site scripting CWE-79 500,000+ 30 Sept 7.1 CVE-2026-93770 One unescaped anchor, and a way to reach it in WP Statistics WP Statistics Cross-site scripting CWE-79 500,000+ 24 Sept 7.1 CVE-2026-42702 The allow list that stood down when the list was empty in Tutor LMS Tutor LMS Cross-site scripting CWE-79 100,000+ 6 Oct 7.1 CVE-2026-102391 The keys the sanitiser never visits in JetFormBuilder JetFormBuilder Cross-site scripting CWE-79 80,000+ 30 Sept 7.1 CVE-2026-94078 Unauthenticated stored XSS in Site Reviews Site Reviews Cross-site scripting CWE-79 60,000+ 24 Sept 7.1 CVE-2026-100510 Two paths into the editor iframe in Post and Page Builder Post and Page Builder by BoldGrid Cross-site scripting CWE-79 50,000+ 30 Sept 7.1 CVE-2026-102376 The capability check that only the reader runs in Branda Branda Cross-site scripting CWE-79 20,000+ 30 Sept 7.1 CVE-2026-104407 The nonce that guarded the page and not the save in PowerPress PowerPress Podcasting Cross-site request forgery CWE-352 20,000+ 5 Oct 7.1 CVE-2026-104395 The hidden field that was never escaped in picu picu Cross-site scripting CWE-79 2,000+ 5 Oct 7.1 CVE-2026-102394 The magic number in place of a flag name in Essential Addons Essential Addons for Elementor Cross-site scripting CWE-79 1,000,000+ 1 Oct 6.5 CVE-2026-103063 The tag that keeps the quotes intact in ElementsKit ElementsKit Lite Cross-site scripting CWE-79 1,000,000+ 1 Oct 6.5 CVE-2026-97067 Turning a working allowlist into a wildcard in EWWW Image Optimizer EWWW Image Optimizer Cross-site scripting CWE-79 1,000,000+ 30 Sept 6.5 CVE-2026-97279 Choosing both the placeholder and its replacement in Polylang Polylang Cross-site scripting CWE-79 900,000+ 30 Sept 6.5 CVE-2026-103343 A script tag with no angle brackets in Fluent Forms Fluent Forms Cross-site scripting CWE-79 800,000+ 1 Oct 6.5 CVE-2026-103339 The space esc_attr has no reason to encode in MetForm MetForm Cross-site scripting CWE-79 600,000+ 1 Oct 6.5 CVE-2026-105890 The heading level that never had to be a number in Kadence Blocks Kadence Blocks Cross-site scripting CWE-79 600,000+ 8 Oct 6.5 CVE-2026-94168 Zero-click stored XSS in Premium Addons for Elementor Premium Addons Cross-site scripting CWE-79 600,000+ 23 Sept 6.5 CVE-2026-104393 The setting that runs as script when the editor opens it in Happy Addons Happy Addons Cross-site scripting CWE-79 400,000+ 7 Oct 6.5 CVE-2026-95530 Subscriber to administrator in PixelYourSite PixelYourSite Cross-site scripting CWE-79 400,000+ 23 Sept 6.5 CVE-2026-103070 The tag that was safe until the plugin rewrote it in ShortPixel ShortPixel Image Optimizer Cross-site scripting CWE-79 300,000+ 8 Oct 6.5 CVE-2026-102914 The escape that would not encode an entity twice in Presto Player Presto Player Cross-site scripting CWE-79 100,000+ 5 Oct 6.5 CVE-2026-104404 The block attribute that shipped without quotes in GiveWP GiveWP Cross-site scripting CWE-79 100,000+ 5 Oct 6.5 CVE-2026-105873 The deny list that knew one key and one syntax in Element Pack Element Pack Cross-site scripting CWE-79 100,000+ 7 Oct 6.5 CVE-2026-105875 The attacker supplies the widget that loads the library in Prime Slider Prime Slider Cross-site scripting CWE-79 100,000+ 7 Oct 6.5 CVE-2026-105884 The quotes the attacker never had to write in LazyLoad LazyLoad Cross-site scripting CWE-79 100,000+ 7 Oct 6.5 CVE-2026-94680 Stored XSS in The Post Grid via an unvalidated shortcode ID The Post Grid Cross-site scripting CWE-79 100,000+ 23 Sept 6.5 CVE-2026-96834 Claiming an email you do not own in GiveWP GiveWP Missing authorization CWE-862 100,000+ 24 Sept 6.5 CVE-2026-104391 The link that carried a setting into another author's quiz in Quiz and Survey Master Quiz and Survey Master Cross-site scripting CWE-79 40,000+ 7 Oct 6.5 CVE-2026-105078 The shortcode attribute that was trusted like a setting in WP Store Locator WP Store Locator Cross-site scripting CWE-79 40,000+ 8 Oct 6.5 CVE-2026-94674 Breaking out of the data layer in Pixel Manager for WooCommerce Pixel Manager for WooCommerce Cross-site scripting CWE-79 40,000+ 30 Sept 6.5 CVE-2026-105886 The dropdown whose options were only a suggestion in Ultimate Post Kit Ultimate Post Kit Missing authorization CWE-862 30,000+ 8 Oct 6.5 CVE-2026-94461 Stored XSS in the Ditty WordPress plugin Ditty Cross-site scripting CWE-79 30,000+ 23 Sept 6.5 CVE-2026-97262 Letting the client decide whether to check permissions Visual Composer Website Builder Cross-site scripting CWE-79 30,000+ 30 Sept 6.5 CVE-2026-97266 A style attribute inside a class attribute in Virtue Toolkit Virtue/Ascend/Pinnacle Toolkit Cross-site scripting CWE-79 30,000+ 30 Sept 6.5 CVE-2026-97301 Escaping the value and printing the key in Cool FormKit Lite Cool FormKit Lite Cross-site scripting CWE-79 20,000+ 30 Sept 6.5 CVE-2026-97298 Three call sites escaped, two not, in King Addons for Elementor King Addons for Elementor Cross-site scripting CWE-79 10,000+ 30 Sept 6.5 CVE-2026-102399 The twenty-sixth action in Photo Gallery by Supsystic Photo Gallery by Supsystic Cross-site request forgery CWE-352 20,000+ 30 Sept 5.4 CVE-2026-104675 The permission check that asked about a different post in Event Tickets Event Tickets Missing authorization CWE-862 90,000+ 5 Oct 4.3