260 WordPress Plugin Vulnerabilities Found, 38 Unpatched
Wordfence, the security company behind Wordfence Intelligence, reported that 260 WordPress plugin vulnerabilities were disclosed last week, from September 7 to September 13, 2026, across 207 plugins. These vulnerabilities were added to the Wordfence Intelligence Vulnerability Database, and 147 vulnerability researchers contributed to WordPress security during that period. The report is part of Wordfence's weekly effort to make vulnerability information freely accessible, supporting what the company calls defense in depth for WordPress sites.
Of the 260 vulnerabilities, 221 have already been patched, one is partially patched, and 38 remain unpatched. By severity, 184 are rated Medium, 66 are High, and 10 are Critical. The most common weakness type was Cross-site Scripting (XSS), a flaw that lets attackers inject malicious scripts into pages viewed by other users, accounting for 66 of the findings. Missing authorization (when a plugin fails to check whether a user has permission to perform an action) accounted for 58, exposure of sensitive information 21, SQL injection 18, improper privilege management 15, authorization bypass through user-controlled key 13, path traversal 11, deserialization of untrusted data 10, code injection 9, improper authentication 6, unrestricted file upload 6, client-side enforcement of server-side security 5, cross-site request forgery 5, PHP remote file inclusion 3, insufficient verification of data authenticity 2, protection mechanism failure 2, open redirect 2, authentication bypass using an alternate path or channel 1, guessable CAPTCHA 1, injection 1, incorrect authorization 1, missing authentication for critical function 1, server-side request forgery 1, uncontrolled resource consumption 1, and unverified password change 1.
The affected plugins listed in the Wordfence report include AcyMailing, Advanced Contact form 7 DB, Advanced Customized Prompts, Advanced Partial Payment or Deposit for WooCommerce, Advanced Product Fields Extended for WooCommerce, AI Builder, Anti-Spam by CleanTalk, Aruba HiSpeed Cache, Awesome Support, BackWPup, bbPress, BEAR, Beaver Builder, Bold Page Builder, Bold Timeline Lite, Amelia, Bookit, Booktics, Buddyforms, BuddyPress, Builderall for WordPress, Bulk Password Reset, CatalogX, Checkout Custom Fields Builder for WooCommerce, CODE MONKEYS PROPOSALS, FormyChat, Contact Form to DB by BestWebSoft, Content Mask, CoolClock, CryptoPayment Gateway, Csomagpontok és Címkék WooCommerce-hez, Custom Menu Wizard Widget, Direct Download for WooCommerce, Domain For Sale, Drag and Drop File Upload for Elementor Forms, DT LMS, Easy Appointments, Easy Google Fonts, EDD Product Catalog Feed by PixelYourSite, ElasticPress, ELEX WooCommerce Request a Quote, Email Subscribers & Newsletters, Event Booking Manager for WooCommerce, Event Tickets and Registration, Eventin, EventON, Everest Forms, Featured Image with URL, FireBox, Flexible Quantity, Floating Chat Widget (Chaty), Form Maker by 10Web, Frontegg SAML SSO, GamiPress, Gato GraphQL, GEO my WP, Gpx2Graphics, Graphina, Groundhogg, Gutenverse News, Hide My WP Ghost, HT Menu, HUSKY, Hustle, ilGhera Reviso Exporter for WooCommerce, IMPress for IDX Broker, Insert or Embed Articulate Content, IP2Location Country Blocker, IPGP Visitors Origin, JCH Optimize, JetFormBuilder, Jetpack, Kirki, LearnPress, Live Composer, LukasApps CAPTCHA tools for Contact Form 7, Mail Mint, MailMunch, Master Addons for Elementor, Masteriyo LMS, MDJM Event Management, Media Library Assistant, MemberPress Corporate Accounts, MetForm, miniOrange 2FA, MIPL Checkout Fields Manager for WooCommerce, Mobile Events Manager, MPG, MultiVendorX, Music Store, My Calendar, Nexi XPay Build, Next-Cart Store to WooCommerce Migration, Ninja Forms, Notiqoo, Bookly, Open User Map, Orbit Fox, OTP Login & Register Woocommerce, Page Visits Counter, Passster, Payment Gateway PayPay for WooCommerce, Payment Plugins for PayPal WooCommerce, Payment Plugins for Stripe WooCommerce, PDF Builder for WooCommerce, Podlove Podcast Publisher, myCred, Product Filter for WooCommerce by WBW, Product XML Feed Manager for WooCommerce, PublishPress Capabilities, Quads Ads Manager, Quentn WP, Quiz and Survey Master, Rara One Click Demo Import, Really Simple Security, Redux Framework, Registration Form for WooCommerce, Relevanssi, RepairBuddy, Repeater Fields for Gravity Forms, Return Refund and Exchange For WooCommerce, Robokassa payment gateway, Rox Appointment Booking, Royal Addons for Elementor, rtMedia, RTMKit, Salon Booking System, SEO Flow by LupsOnline, Shirt Product Designer for WooCommerce, Sidebar Manager Light, Simple Ajax Chat, Simple CAPTCHA with Cloudflare Turnstile, Simple Membership, Simple Payment, Sina Extension for Elementor, Site Kit by Google, Site Reviews, SiteSkite, Sky Addons for Elementor, Slim SEO, Smart Marketing SMS and Newsletters Forms, SMS Alert, Sprout Invoices, SSL Zen, Starter Templates, Sticky Chat Widget, Sunshine Photo Cart, SupportCandy, SureCart, SureRank SEO, Tangible Loops & Logic, Teddy Bear Customize Addon, Temporary Login Without Password, Thanko Thank You Page Customizer for WooCommerce, The Events Calendar, ThemeREX Addons, Themify WooCommerce Product Filter, Translate WordPress with GTranslate, Tutor LMS, Ultimate Gift Cards for WooCommerce, Unbounce Landing Pages, Unlimited Elements for Elementor, User Access Manager, User Registration & Membership, UsersWP, Verified Reviews, Vigilant, and Visual Composer Website Bui.
The report also credits 147 vulnerability researchers for their contributions. The top researchers were Wordfence PRISM with 25 vulnerabilities, Artus KG, Ananda Dhakal, and Jakub Herman with 10 each, Yaswanth Reddy Sunkara, 0xBassia, and Karthik Ramakrishnan with 6 each, Philipp Doblhofer with 5, and Peng Zhou, daroo, Pedro Pinho, and Nabil Irawan with 4 each. Many other researchers contributed one vulnerability each. Wordfence Intelligence offers its vulnerability database, API, and webhook integration free for personal and commercial use, with over 40,000 vulnerabilities in the database, allowing site owners, hosting providers, and enterprises to stay on top of new disclosures.
For site owners, the practical takeaway is immediate action: 38 vulnerabilities are still unpatched, meaning attackers can exploit them right now. Update all plugins as soon as patches are available, remove unused plugins, and use a firewall or security plugin to block common exploit attempts. Managed WordPress hosting such as AEU Hosting helps by providing automatic backups, security hardening, performance tuning, SSL, and expert support, so a site can recover quickly if a vulnerable plugin is compromised.