497 WordPress vulnerabilities hit plugins and themes
WordPress vulnerabilities disclosed between October 12 and October 18, 2026 affected 327 plugins and 23 themes, according to additions made to the Wordfence Intelligence Vulnerability Database. Wordfence recorded 497 vulnerabilities in total, with 428 marked patched and 69 still unpatched. The disclosures involved contributions from 218 security researchers, including 40 vulnerabilities attributed to Wordfence PRISM.
The severity breakdown gives site owners a clear reason to review their installed software promptly. Wordfence classified 23 vulnerabilities as critical, 153 as high severity, 315 as medium severity and six as low severity. These ratings use CVSS, the Common Vulnerability Scoring System, which measures how serious a security flaw is on a scale that reaches 10. The report records the most severe group at scores of 9.8 or 9.1, and many could be attacked without the intruder first signing in.
The largest category was cross-site scripting, where unsafe input can make a website run unwanted browser code, with 159 vulnerabilities. Wordfence also counted 116 missing-authorization flaws, 34 SQL injection issues that could let hostile input manipulate database queries, 33 cases of deserialization of untrusted data, 31 sensitive-information exposures, 22 improper privilege-management flaws, 20 authorization bypasses through user-controlled keys and 15 code-injection weaknesses. Other categories included 11 dangerous file uploads, 10 path-traversal flaws, eight failures to verify data authenticity, seven cross-site request forgery issues, six authentication flaws, five PHP remote file inclusion cases, four client-side enforcement failures, three incorrect-authorization flaws and three server-side request forgery issues. The remaining entries covered improper input validation, open redirects, a race condition, embedded malicious code, improper access control, downstream injection, command injection and insufficiently random values.
Among the 9.8-rated vulnerabilities, three remained unpatched when recorded. AGE-GATE 1.0 and earlier had unauthenticated remote code execution through PHP code injection in the width or height parameters of its standalone admin.php file, tracked as CVE-2026-104800. JTL-Connector for WooCommerce 2.4.3 and earlier had an unauthenticated file-upload flaw in its image.push method, CVE-2026-87855. Snazzy Social Media Feed 2.5 and earlier had an unauthenticated file-upload issue through the pluginURL parameter, CVE-2026-110002. Remote code execution means an attacker can make the website run commands or code chosen by the attacker. Unauthenticated means no valid website account is required.
Wordfence marked the other 9.8-rated issues as patched. These included arbitrary file upload in 10Web Booster through version 2.34.10, CVE-2026-108587; authentication bypass and SQL injection in Abandoned Cart Pro for WooCommerce through 10.8.0, CVE-2026-97657 and CVE-2026-97668; attachment-based file upload in ELEX WordPress HelpDesk through 3.3.7, CVE-2026-103768; and PHP object injection in LearnPress through 4.4.10, CVE-2026-104736. PHP object injection is the unsafe reconstruction of supplied data into program objects, which can become dangerous when suitable code is present on the site.
The patched critical group also covered privilege escalation in MailOptin through 1.2.78.6, CVE-2026-109515; file upload in Mang Board 2.4.4, CVE-2026-109219; remote code execution in MDTF through 1.3.9, CVE-2026-108151; privilege escalation in My Calendar through 3.8.7, CVE-2026-104798; account takeover in OTP Login and Register Woocommerce through 2.7.2, CVE-2026-110135; and file upload leading to remote code execution in Printcart Store through 2.9.1, CVE-2026-93388. Privilege escalation lets an account obtain permissions it should not have.
Further 9.8-rated patched entries were embedded malicious code in Rank Math SEO PRO 3.0.123, CVE-2026-111862; privilege escalation through mass assignment in SimpleForm through 3.10.0, CVE-2026-104748; PHP object injection in Sunshine Photo Cart through 3.7.4, CVE-2026-104730; remote code execution in The Grid through 2.8.1, CVE-2026-94169; and privilege escalation in Theme My Login through 7.2.1, CVE-2026-89079.
Four more critical issues received CVSS scores of 9.1. The Appointment Booking Plugin LatePoint through 5.7.4 had a patched authentication bypass caused by a race condition in its one-time-password attempts counter, CVE-2026-110653. BuddyPress XProfile Custom Image Field through 3.1.0 had an unpatched unauthenticated arbitrary-file-deletion flaw. Click to Chat through 4.44 had a patched shortcode-execution flaw, CVE-2026-92097, while File Upload to Order through 1.1.3 had a patched arbitrary-file-deletion issue, CVE-2026-107594.
The high-severity findings included authenticated remote code execution, file upload, account takeover, file deletion and command injection in plugins used for affiliate content, customer management, email design, video, directories, maps, salons, photo albums and SMTP email. Wordfence also reported an unpatched cluster of 8.1-rated PHP object-injection flaws affecting the Avventure, Bonbon, Coinpress, Edge Decor, EmojiNation, Filmax, Gamezone, Gamic, Good Homes, Gunslinger, Le Truffe, Legal Stone, Marcell, Meals and Wheels, Mission, Motorix, Muzicon, Nuts and Orpheus themes. Unpatched high-severity issues also included arbitrary file reading in Contact Form 7 Signature Addon through 4.2.2, SQL injection in Gmedia Photo Gallery through 1.25.1, and a separate SQL injection in JTL-Connector for WooCommerce through 2.4.3.
Wordfence said its threat-intelligence team deployed WAF-RULE-966 and WAF-RULE-967 while working with vendors on patches, but withheld their technical details. A WAF, or web application firewall, filters harmful web requests before they reach vulnerable code. It also added protection for PHP object injection in comments. Premium, Care and Response customers received the rules immediately, while the free plugin was scheduled to receive them after a 30-day delay. Firewall protection reduces exposure but does not replace installing a vendor patch or removing vulnerable software.
The Wordfence database contains more than 40,000 vulnerabilities and can be accessed through its free user interface, application programming interface and webhook integration. A webhook automatically sends a notification when a database event occurs. Wordfence said sites running its plugin with scanning enabled should already have been alerted when affected, while Slack and HTTP webhooks can provide real-time notices about new or updated entries.
Site owners should compare every installed plugin and theme against the affected versions, update patched products and disable unpatched components until a safe release becomes available.