Published October 23, 2026. Based on public CVE records available on that date; details may change.

Twenty-five CVEs for WordPress plugins and one theme were published on October 22 and 23, 2026, affecting stores, forms, membership and multisite networks. Most are fixed in a release that is already available, so check which of these you run, compare your version to the affected range below, and update; Music Store has no fix yet and should be removed or replaced. The most serious issues of these two days have their own articles: WordPress Core Quick Edit XSS, LiteSpeed Cache, Essential Addons for Elementor, PixelYourSite, Depicter, WebP Express, Otter Blocks, CleanTalk Anti-Spam and ACF: Extended.

How to check which plugin versions you run

The fastest check is one command per site. With WP-CLI, run wp plugin list --fields=name,status,version,update_version and look for the plugin names below; for the Javo Spot theme, run wp theme list instead. Without WP-CLI, open Plugins (or Appearance > Themes) in the dashboard and read the version.

Check staging copies and inactive plugins too. An inactive plugin's files are still on the server, and some flaws can be reached without the plugin being active. If you do not use a plugin, delete it rather than leaving it deactivated.

If you manage many sites, export the plugin list from each one and search it for the plugin slugs. Agencies can run wp plugin list --format=csv across all sites from a single script.

Online stores and payments

These issues touch checkouts, orders and customer data, so stores should handle them first.

FluentCart (CVE-2026-100142)

Versions before 2.2.0 do not check that a saved customer address picked at checkout belongs to the person placing the order. An unauthenticated visitor can attach another customer's stored address to their own order and read back that customer's postal address, phone number and company details. Update to 2.2.0 or later.

Music Store (CVE-2026-115497)

Versions through 1.4.7 allow directory traversal through the f parameter, letting an unauthenticated attacker read files on the server (CVSS 7.5). It needs a valid purchase_id token, which the record notes anyone can get with one low-cost purchase or a shared download link. The record lists no fixed version, so remove or replace the plugin until one exists, and rotate the database password and secret keys in wp-config.php if you ran it on a public store.

Forms, logins, users and membership

These plugins handle accounts, logins and public submissions, which makes them common targets.

Royal MCP (CVE-2026-111958)

Versions before 1.5.7 do not limit a preview-link token to the single preview it was issued for. Anyone who obtains a valid token is treated as the token's owner across the whole REST API, which is an administrator by default, and the record calls the result full site takeover. Update to 1.5.7 or later, and check Users for accounts you do not recognize.

HIPAA Forms (CVE-2026-109927)

Versions before 3.3.2 let a user who already holds the plugin's own custom role rebuild that role with administrator-level capabilities. Update to 3.3.2 or later and review who holds that role.

User Profile Builder (CVE-2026-111966, CVE-2026-111982)

Versions before 4.0.5 have two issues. A Contributor can store script in a shortcode attribute that runs against higher-privileged users who submit the form, and on multisite a subsite Administrator can change any other user's email, including a Network Super Admin's, then take that account over through password reset. Update to 4.0.5 or later.

WP Ultimate Review (CVE-2026-103234)

Versions before 2.4.5 do not strip shortcodes from every field of the public review form, so an unauthenticated visitor can run arbitrary shortcodes when that field is displayed. It applies only when user reviews and that field's display are enabled. Update to 2.4.5 or later.

MasterStudy LMS (CVE-2026-88849)

Versions 3.7.13 through 3.7.54 let a user with the Instructor role overwrite the first name, last name and display name of any user, including administrators, which can be used for impersonation and phishing. Update to 3.7.55 or later.

Page Restriction WordPress (WP) by miniOrange (CVE-2026-114696)

Versions through 1.6.0 have a missing authorization issue rated CVSS 5.3 that requires no login. The record lists 1.6.1 as the first unaffected version, so update to 1.6.1 or later.

Multisite networks

These three only matter on multisite, where a subsite administrator is not trusted at the network level.

Download Monitor (CVE-2026-112219)

Versions before 5.3.5 let a subsite administrator approve arbitrary file locations, so the plugin can serve readable files from outside the uploads directory, including other subsites' files, to unauthenticated visitors. Single-site installations are unaffected. Update to 5.3.5 or later.

Speed Optimizer (CVE-2026-111737, CVE-2026-111738)

Versions before 7.8.5 let an administrator store script in settings printed in the page head, even where unfiltered_html is disallowed, and let a site administrator who is not a Super Admin create or overwrite network-wide options. Update to 7.8.5 or later.

Everything else

These are lower risk for most sites, but still worth updating on your next maintenance pass.

JetBackup (CVE-2026-104068)

Versions before 3.1.24.10 can follow a symbolic link inside a crafted backup archive and write files outside the restore folder, which may lead to code execution depending on the server (CVSS 7.2). It requires an administrator to import and restore that archive. Update to 3.1.24.10 or later, and only restore backups from sources you trust.

Popup Builder (CVE-2026-112230)

Versions before 4.4.6 let unauthenticated requests move popups into the Trash and overwrite their stored preview data. Update to 4.4.6 or later and check that your popups are still published.

MB Custom Post Types & Custom Taxonomies (CVE-2026-110010, CVE-2026-110011)

Versions 2.0.2 through 2.12.2 let an unauthenticated request re-run a legacy migration, which can reset post type or taxonomy settings on sites upgraded from a pre-2.0 release and re-expose content you had hidden. Versions 2.4.0 through 2.12.2 also let a Contributor export admin-only definitions and details of other users' non-public posts. Update to 2.12.3 or later.

Photo Engine (CVE-2026-111971, CVE-2026-111972)

Versions before 6.5.8 let an Author or higher store script in collection and gallery names, and delete media attachments uploaded by other users, including administrators. Update to 6.5.8 or later.

Link Library (CVE-2026-78392)

Versions before 7.9.6 allow stored cross-site scripting by a Contributor or higher through a link field. The preview is served without login and without checking that the link was approved, so an unapproved submission can reach visitors. Update to 7.9.6 or later.

Falcon, WordPress Optimizations & Tweaks (CVE-2026-112826)

Versions through 2.12.0 have a missing authorization issue rated CVSS 5.3 that requires no login. The record lists 2.12.1 as the first unaffected version, so update to 2.12.1 or later.

Infility Global (CVE-2026-109931)

Versions before 2.16.25 let any visitor overwrite a machine-translation setting (the record's title names a Google Translate API key) through an AJAX action with no authorization check. Update to 2.16.25 or later and re-enter your API key if it changed.

Old vulnerabilities that only now received CVE IDs

These four were fixed years ago and only received CVE IDs this week, so they matter only to sites still on very old versions. Each record notes that the Shadowserver Foundation observed exploitation evidence (in 2023, or 2025 for WPML), so any site still on these versions should update today and check for signs of compromise.

Javo Spot theme (CVE-2017-20287)

Versions before 3.0.0 let unauthenticated visitors read files such as wp-config.php through an AJAX action (CVSS 7.5). Update the theme to 3.0.0 or later, then change the database password and secret keys.

Broadstreet Ad Widget (CVE-2017-20289)

Versions from 2.2.0 up to, but not including, 2.12.0 allow local file inclusion by a logged-in user, which can run PHP code (CVSS 7.5). Update to 2.12.0 or later.

NotificationX (CVE-2022-51021)

Versions from 2.0.0 up to, but not including, 2.3.12 have an unauthenticated SQL injection issue in a REST endpoint (CVSS 8.2). Update to 2.3.12 or later.

WPML Multilingual CMS (CVE-2023-54413)

Versions before 4.6.1 have a reflected cross-site scripting issue through the wp_lang parameter on the login page (CVSS 6.1). Update to 4.6.1 or later.

What to do now

Work through this in order:

  1. Take a backup of files and database before updating.
  2. Update every plugin above that falls in an affected range, starting with stores, logins and public forms. Remove Music Store until a fix exists.
  3. Check Users for accounts you do not recognize, especially on sites running Royal MCP, HIPAA Forms or User Profile Builder. Our guide to finding hidden admin users covers the database checks.
  4. Delete plugins and themes you do not use.
  5. Turn on automatic updates for plugins you trust, or make sure someone checks for updates weekly. Our WordPress maintenance plan checklist covers the routine.

When to get help

If a site ran one of these plugins and you see unfamiliar users, new pages, unexpected redirects or warnings in Google, treat it as a possible compromise rather than only an update job. Our signs your WordPress site has been hacked checklist is a quick first pass, and our WordPress malware removal service handles cleanup when something is wrong. Agencies that want this checked across many sites can use a security audit.

Sources