Published October 24, 2026. Based on public CVE records available on that date; details may change.

Twenty-nine CVE records for WordPress plugins were published on October 23 and 24, 2026, and most have a fixed release available now. Check which of these plugins you run, compare your version to the ranges below, and update; three plugins (MAS Videos, Front End Users and Advanced Twenty Seventeen) have been closed on WordPress.org with no fix and should be removed. Install counts come from WordPress.org and are rounded.

Covered in their own articles

Five plugins have their own write-ups today with full detail.

  • Prime Mover (10,000+ installs, CVE-2026-115806). Versions through 2.2.1 can deserialize data an unauthenticated visitor plants in a comment when an administrator later runs an export or restore. Wordfence scores it 9.8. Version 2.2.2's changelog credits Wordfence for hardening this code. Read our Prime Mover article.
  • Speed Optimizer (1,000,000+ installs, CVE-2026-111737, CVE-2026-111738). Two administrator-level issues that matter mostly on multisite, fixed in 7.8.5. See our Speed Optimizer article.
  • Popup Builder (200,000+ installs, CVE-2026-112230). Unauthenticated requests can move popups to the Trash, fixed in 4.4.6. See our Popup Builder article.
  • Download Monitor (80,000+ installs, CVE-2026-112207, CVE-2026-112219). A reflected cross-site scripting issue fixed in 5.3.4 and a multisite file-location issue fixed in 5.3.5. See our Download Monitor article.
  • User Profile Builder (40,000+ installs, CVE-2026-111965, CVE-2026-111966, CVE-2026-111982, CVE-2026-115807). Four issues, including one where an Author can create Editor accounts (Wordfence 7.1). Version 4.0.5 covers all four. See our Profile Builder article.

How to check which plugin versions you run

One command per site gives you the list. With WP-CLI, run wp plugin list --fields=name,version,update_version and look for the plugins below. Without WP-CLI, open Plugins in the dashboard and read the version under each name.

Check inactive plugins and staging copies too, since their files are still on the server. If you manage many sites, run the same command on each and search the output for the plugin slugs.

Unauthenticated or high-severity issues

These need no login, or lead to account takeover or role changes, so handle them first.

asVereinbase (CVE-2026-110956)

Versions before 1.1.8 treat an empty stored value as a match during password and second-factor checks, so an unauthenticated attacker can log in as any user, including an administrator. CISA's ADP scores it 9.8. WordPress.org shows 10+ installs. Update to 1.1.8 or later and review Users for accounts or role changes you do not recognize.

GTM Server Side by Stape (CVE-2026-55826)

Versions 2.0.0 up to, but not including, 2.1.48 let an unauthenticated attacker make the WooCommerce purchase tracking render another customer's full order data, including personal details, into the page's dataLayer. GitHub, the CNA for this record, scores it 8.7 under CVSS 4.0. The plugin is now listed on WordPress.org as Stape Conversion Tracking (10,000+ installs). Update to 2.1.48 or later; the current release is 2.3.10.

Front End Users (CVE-2026-87835)

Versions through 3.2.35 let an unauthenticated visitor registering through the front-end forms set their own membership level and mark their account as approved, confirmed and paid. CISA's ADP scores it 6.5. The plugin was closed on WordPress.org on October 13, 2026, and no newer version is available there, so remove or replace it.

GeoDirectory (seven CVEs)

Versions before 2.8.194 have seven issues (10,000+ installs). Two unauthenticated ones (CVE-2026-113490, CVE-2026-113492) expose draft, pending and private listings by ID, and a third (CVE-2026-113674) lets unauthenticated visitors edit or unpublish guest-submitted listings when guest posting is on. A Subscriber can read and delete some files through a path traversal issue (CVE-2026-113491) and change other users' listing images (CVE-2026-113489). A Contributor can store script through a map shortcode (CVE-2026-113493), and an administrator who cannot otherwise run code, such as a multisite subsite admin, can get code execution (CVE-2026-113673). CISA's ADP scores range from 3.7 to 7.2. Update to 2.8.194 or later; the current release is 2.8.197.

aBlocks (CVE-2026-110018)

Versions through 2.17.0 let a Contributor raise their own role to Editor or another non-administrator role through the form builder's registration endpoint. Wordfence scores it 8.8. WordPress.org shows 2,000+ installs. The record treats later versions as unaffected, and 2.18.0 is the current release, so update to 2.18.0 or later and check for accounts whose role changed.

Music Store (CVE-2026-115497): fix now available

This is the same file-read issue we listed in our October 23 roundup. The record lists versions through 1.4.7 as affected (Wordfence, 7.5), and version 1.4.8 is on WordPress.org with a changelog entry that restricts downloads to the designated downloads directory and credits Wordfence. WordPress.org shows 200+ installs. Update to 1.4.8 or later. If you ran an earlier version on a public store, still rotate the database password and secret keys in wp-config.php.

Lower-severity and logged-in issues

Most of these require at least a Subscriber or Contributor account, so they matter most on sites with open registration or several authors. ACF: Extended is the exception: it needs no login, but only affects forms whose stored settings lack one option, and is rated lower.

MAS Videos (CVE-2026-107907)

Versions through 1.3.4 let any logged-in user permanently delete posts, pages and attachments belonging to others. CISA's ADP scores it 6.5. The plugin was closed on WordPress.org on October 13, 2026, with no newer version there, so remove or replace it.

News Kit Addons for Elementor (CVE-2026-97352, CVE-2026-97353)

Versions before 1.4.9 let a Subscriber install and activate a specific plugin from WordPress.org (CISA's ADP, 4.3), and versions through 1.4.7 let a Subscriber write arbitrary post meta to any post (5.4). The second record names no fixed version, but the changelog lists security fixes in 1.4.8 and 1.4.9. WordPress.org shows 3,000+ installs. Update to 1.4.9 or later; the current release is 1.5.0.

Advanced Twenty Seventeen (CVE-2026-107887)

Versions through 1.3.1 let any logged-in user switch the site's active theme, and the same action can be triggered against an administrator through cross-site request forgery. CISA's ADP scores it 5.4. The plugin was closed on WordPress.org on October 13, 2026, with no newer version there, so remove it.

Pixel Tag Manager for WooCommerce (CVE-2026-105199)

Versions before 2.2.3 let a Contributor overwrite the tracking configuration and have script run in every visitor's browser, including administrators. CISA's ADP scores it 6.8. WordPress.org shows 2,000+ installs (slug pixel-manager-for-woocommerce). Update to 2.2.3 or later.

WPVR (CVE-2026-114429)

Versions 8.5.49 up to, but not including, 9.0.3 let a Contributor store script in tour hotspot content. CISA's ADP scores it 6.8. WordPress.org shows 10,000+ installs. Update to 9.0.3 or later.

ACF: Extended (CVE-2026-94263)

Versions 0.9.2.4 up to, but not including, 0.9.2.8 of ACF: Extended and ACF: Extended PRO do not always disable shortcodes in front-end form confirmation messages, so an unauthenticated visitor can have shortcodes run when submitting an affected form. WPScan scores it 4.8. WordPress.org shows 100,000+ installs. Update to 0.9.2.8 or later. Our ACF: Extended article covers the related issue in the same release.

What to do now

Work through this in order:

  1. Back up files and database before updating.
  2. Update every plugin above that falls in an affected range, starting with the unauthenticated issues.
  3. Remove MAS Videos, Front End Users and Advanced Twenty Seventeen, since no fix is available on WordPress.org.
  4. Check Users for unfamiliar accounts or raised roles on sites running asVereinbase, aBlocks, Front End Users or User Profile Builder. Our guide to finding hidden admin users covers the database checks.
  5. Delete plugins you do not use, and set a weekly update routine using our WordPress maintenance plan checklist.

When to get help

If a site ran one of these plugins and you see unfamiliar users, deleted content, new pages or unexpected scripts, treat it as a possible compromise rather than only an update job. Our signs your WordPress site has been hacked checklist is a quick first pass, and our WordPress malware removal service handles cleanup when something is wrong. Agencies that want this checked across many sites can use a security audit.

Sources