362 WordPress Plugin Vulnerabilities Disclosed Last Week
Wordfence's weekly vulnerability report for September 14 to 20, 2026 catalogued 362 new vulnerabilities across 247 WordPress plugins and 4 WordPress themes, with 45 of those issues still unpatched as of publication. The data comes from the Wordfence Intelligence Vulnerability Database, which now contains more than 40,000 WordPress vulnerabilities and is freely accessible through a user interface, an API, and a webhook integration. The company states that site owners, enterprises, hosting providers, and individuals can use these tools to build layered security, and that the mission is to make vulnerability information available to everyone.
The report breaks down severity by CVSS score, a standard 0 to 10 rating where higher numbers mean greater risk. Last week's additions included 18 critical vulnerabilities, 74 high severity, 266 medium severity, and 4 low severity. The most common weakness type, as classified by CWE (Common Weakness Enumeration), was cross-site scripting (XSS) with 94 instances, followed by missing authorization with 69, SQL injection with 35, authorization bypass through user-controlled keys with 27, and exposure of sensitive information with 27. Other notable types included code injection, unrestricted file upload, cross-site request forgery (CSRF), path traversal, server-side request forgery (SSRF), and improper authentication.
A significant item is a new firewall rule, WAF-RULE-957, deployed by Wordfence's Threat Intelligence Team to protect against an unauthenticated stored cross-site scripting vulnerability in WordPress Core up to version 7.1, related to how the wpautop() function handles blockquotes. wpautop is a WordPress function that automatically adds paragraph and line break tags to content. Wordfence says the rule was rolled out immediately to Premium, Care, and Response customers, while users of the free Wordfence plugin will receive the enhanced protection after a 30 day delay. The vulnerability details are redacted while Wordfence works with the vendor on a patch, which is a common practice to prevent attackers from exploiting an unfixed flaw.
In total, 186 vulnerability researchers contributed to WordPress security last week. The most active reporters included Wordfence PRISM with 25 vulnerabilities, Karthik Ramakrishnan with 17, Ananda Dhakal with 13, Artus KG with 12, and three researchers with 11 each: Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso. Many other researchers submitted between one and ten findings. Wordfence also runs a bug bounty program where responsible disclosure of in-scope vulnerabilities can earn a reward and get the researcher mentioned in the weekly report.
The report lists a large number of affected plugins, including widely used names such as All-in-One WP Migration and Backup, LiteSpeed Cache, Elementor addons (Element Pack, Master Addons, JetElements), GiveWP, Booking Calendar, Forminator, Mailchimp for WooCommerce, Popup Maker, Redux Framework, and many others. Because 317 vulnerabilities were patched but 45 remain unpatched, site owners should check whether any plugin or theme they run appears in the list and apply updates or temporary mitigations. Wordfence advises reviewing the full list in its database.
For a site owner, this weekly report is a reminder that keeping WordPress secure requires constant attention. Managed WordPress hosting such as AEU Hosting can reduce the burden by providing security hardening, automatic backups, and expert support to help apply patches before attackers can exploit a disclosed flaw.