Published October 21, 2026. Based on public CVE records available on that date; details may change.

Eighteen CVEs were published on October 21, 2026 for WordPress plugins used by online stores, booking sites, membership sites and contact forms. Most are fixed in a release that is already available: check which of these plugins you run, compare your version to the affected range below, and update. For the most serious issues of the day (Duplicator, Elementor, Ninja Forms, WP Time Capsule, Modern Events Calendar, Weglot and Download Manager), see the separate articles we published the same day.

How to check which plugin versions you run

The fastest check is one command per site. With WP-CLI, run wp plugin list --fields=name,status,version,update_version and look for the plugin names below. Without WP-CLI, open Plugins in the dashboard and read the version under each plugin name.

Check staging copies and inactive plugins too. An inactive plugin's files are still on the server, and some flaws can be reached without the plugin being active. If you do not use a plugin, delete it rather than leaving it deactivated.

If you manage many sites, export the plugin list from each one and search it for the plugin slugs. Agencies can run wp plugin list --format=csv across all sites from a single script.

Online stores (WooCommerce and payments)

These issues touch checkouts, carts and customer data, so stores should handle them first.

Cart Abandonment Recovery for WooCommerce (CVE-2026-96901)

Versions before 2.2.0 accept an unsigned recovery token, which the record describes as an unauthenticated authentication bypass. A visitor could abuse the cart recovery link flow instead of a real customer. Update to 2.2.0 or later.

WholesaleX (CVE-2026-111955, CVE-2026-111956)

Versions before 3.0.9 have two unauthenticated issues: one lets accounts be activated without the administrator approval step, and the other exposes the CSV of imported users. Wholesale sites often import customer lists, so the second issue can expose personal data. Update to 3.0.9 or later and review recently approved wholesale accounts.

TI WooCommerce Wishlist (CVE-2026-15261)

Versions before 2.13.0 can disclose private wishlists to unauthenticated visitors through the share_key value. Update to 2.13.0 or later.

SureCart (CVE-2026-108073)

Versions before 4.9.5 can disclose private catalog data to unauthenticated visitors through the expand parameter. If you sell private or member-only products, update to 4.9.5 or later.

LatePoint (CVE-2026-105256)

Versions before 5.7.5 let an unauthenticated visitor change the payment_portion parameter, which the record describes as a payment bypass (CVSS 5.3). Booking businesses that take deposits online should update to 5.7.5 or later and compare recent bookings against payments received.

Forms, logins and user accounts

These plugins sit on public forms or control who can log in, which makes them common targets.

miniOrange 2FA (CVE-2026-111949)

Versions 6.2.9 through 6.3.0 allow a two-factor authentication bypass through passkey second-factor rebinding. Two-factor login exists to stop stolen passwords from working, so this one matters even though it needs specific conditions. Update to 6.3.1 or later, then review the passkeys registered to administrator accounts.

WP User Manager (CVE-2026-110523)

Versions 2.9.21 through 2.9.25 can give an unauthenticated visitor a paid registration role after the Stripe connection is disconnected. The record calls this privilege escalation. Update to 2.9.26 or later and review users who registered with paid roles recently.

Redirection for Contact Form 7 (CVE-2026-111574)

Versions 2.2.7 through 3.2.11 allow unauthenticated stored cross-site scripting through the lead debug metabox. A visitor's form submission can carry script that runs when an administrator views the lead. Update to 3.2.12 or later.

Profile Builder (CVE-2026-111948)

Versions before 4.0.1 have a reflected cross-site scripting issue in the row actions for unconfirmed emails. An attacker would need an administrator to open a crafted link. Update to 4.0.1 or later.

HappyForms (CVE-2026-14556)

Versions before 1.26.15 allow unauthenticated HTML injection into the admin notification email through the client_referer value (CVSS 5.4). A form submission can put attacker-controlled links into the email you receive. Update to 1.26.15 or later, and be careful with links inside form notification emails in the meantime.

Formidable Forms (CVE-2026-85642)

Versions 6.5 through 6.35 have an unauthenticated denial-of-service issue in the payment gateway connection verification. The record lists 7.0 as the first unaffected version. Update to 7.0 or later.

Strong Testimonials (CVE-2026-107435)

Versions through 3.3.12 have a stored cross-site scripting issue rated CVSS 7.1. Update to the latest release, and review recently submitted testimonials before approving them.

Everything else

These are lower risk for most sites, but still worth updating on your next maintenance pass.

Simple Banner (CVE-2026-107506)

Versions before 3.3.3 allow authenticated privilege escalation through the user permissions setting. Sites that give Simple Banner access to non-administrators should update to 3.3.3 or later first.

Swift Performance Lite (CVE-2026-110651)

Versions before 2.3.7.4 have a SQL injection issue in the image optimizer that requires an Author account or higher. Update to 2.3.7.4 or later, and remove author accounts that are no longer needed.

WP Booking System (CVE-2026-109147)

Versions before 2.1.0.3 have a reflected cross-site scripting issue through the booking_id parameter. Update to 2.1.0.3 or later.

Advanced File Manager (CVE-2026-79627)

Versions 5.4.13 through 5.4.14 have an authenticated stored cross-site scripting issue that bypasses the SVG sanitizer. The record lists 6.0.0 as the first unaffected version. File manager plugins give broad access to the server, so also confirm only administrators can use it, or remove it if you rarely need it.

AI Engine (CVE-2026-110982)

Versions before 3.8.6 let a user with an Editor account or higher change the title and excerpt of posts they should not be able to edit, through the update_post_title function. The risk is limited to sites with editors you do not fully trust. Update to 3.8.6 or later.

What to do now

Work through this in order:

  1. Take a backup of files and database before updating.
  2. Update every plugin above that falls in an affected range, starting with stores and public forms.
  3. Check Users for accounts you do not recognize, especially on sites running WholesaleX, WP User Manager or Simple Banner. Our guide to finding hidden admin users covers the database checks.
  4. Delete plugins you do not use.
  5. Turn on automatic updates for plugins you trust, or make sure someone checks for updates weekly. Our WordPress maintenance plan checklist covers the routine.

When to get help

If a site ran one of these plugins and you see unfamiliar users, new pages, unexpected redirects or warnings in Google, treat it as a possible compromise rather than only an update job. Our signs your WordPress site has been hacked checklist is a quick first pass, and our WordPress malware removal service handles cleanup when something is wrong. Agencies that want this checked across many sites can use a security audit.

Sources