Plugin Security
How to judge, replace and remove WordPress plugins.
60
Guides
Ultra Addons for Contact Form 7 ≤ 3.5.50 – Unauthenticated Arbitrary File Upload
CVE-2026-82901 is a critical unauthenticated arbitrary file upload vulnerability in Ultra Addons for Contact Form 7 ≤ 3.5.50 when the PDF Generator module is enabled. Update to 3.5.51…
miniOrange OTP Login ≤ 5.5.5 – Unauthenticated Administrator Login Bypass
CVE-2026-85984 can let unauthenticated attackers take over administrator accounts on miniOrange OTP Login 5.5.5 and earlier under a vulnerable settings combination. Update to 5.5.6.
Elementor 4.3.0-4.3.1 – REST Nonce Bypass to Privilege Escalation
CVE-2026-62062 lets a crafted link bypass REST nonce validation in Elementor 4.3.0 and 4.3.1, enabling actions permitted to a logged-in victim. Update to 4.3.2.
s2Member ≤ 260814 – Unauthenticated Remote Code Execution
CVE-2026-19804 allows unauthenticated remote code execution on specifically configured s2Member sites running version 260814 or earlier. Update to 260829 or newer.
YOP Poll <= 7.0.10 - Administrator Account Takeover via postMessage Origin Validation (CVE-2026-85682)
YOP Poll 7.0.10 and earlier can expose an administrator REST nonce through unsafe postMessage origin handling. Update to 7.0.11 or later and review administrator accounts.
Visual Composer <= 45.16.0 - Unauthenticated Local File Inclusion (CVE-2026-12227)
Visual Composer Website Builder 45.16.0 and earlier permits unauthenticated local file inclusion through the vcv-template parameter. Update to 45.16.1 or later immediately.
HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion (CVE-2026-92969)
HUSKY Products Filter for WooCommerce 1.4.4 and earlier permits unauthenticated local PHP file inclusion through its AJAX product rendering path. Update to 1.4.5 or later.
WordPress Core <= 7.1.1 - Unauthenticated Path Traversal and Local File Inclusion (CVE-2026-87902)
WordPress Core through 7.1.1 contains an unauthenticated template path-traversal flaw that can include local PHP files and lead to RCE on compatible theme/server configurations. Update to 7.1.2 or…
Forminator Forms <= 1.57.2 - Unauthenticated Shortcode Execution (CVE-2026-92229)
Forminator Forms 1.57.2 and earlier can process untrusted current_url input as WordPress shortcodes. Update to 1.57.3 or later and review exposed forms and logs.
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden Field (CVE-2026-84434)
Gravity Forms 3.1.0.4 and earlier can accept an arbitrary upload through a hidden File Upload field on a public form. Update to 3.1.1 or later and inspect upload…