655 WordPress vulnerabilities include 21 critical flaws
WordPress vulnerability disclosures reached 655 issues across 406 plugins and 100 themes during October 5 to October 11, according to Wordfence Intelligence. Of those vulnerabilities, 366 were marked patched and 289 remained unpatched, making an immediate inventory of installed software important for site owners, agencies and IT teams.
The severity breakdown was 21 critical, 249 high, 377 medium and eight low severity vulnerabilities. Severity was measured with CVSS, the Common Vulnerability Scoring System used to rate the potential impact of a security flaw. Wordfence credited 236 security researchers with contributing disclosures during the week and said its database contains more than 40,000 WordPress vulnerabilities. Its database interface, application programming interface and webhook integration, which can automatically send new records to another system, are available without charge for personal and commercial use.
The most common weakness was cross-site scripting, or XSS, which can cause a vulnerable page to run attacker-supplied browser code, with 198 cases. Missing authorization accounted for 112, while unsafe deserialization, where untrusted stored data is reconstructed in a dangerous way, accounted for 67. There were also 61 SQL injection flaws, which allow hostile input to interfere with database commands, and 45 cases of sensitive information exposure. The remaining categories were improper privilege management, 30; PHP remote file inclusion, 24; authorization bypass through a user-controlled key, 21; dangerous file upload, 18; path traversal, 15; code injection, 11; improper authentication, nine; cross-site request forgery, eight; client-side enforcement of server-side security, seven; incorrect authorization, six; server-side request forgery, five; missing authentication for a critical function, three; uncontrolled resource consumption, three; alternate-path authentication bypass, two; protection mechanism failure, two; and eight categories with one case each, including a race condition, externally accessible files, improper authorization, input validation failure, downstream injection, sensitive information in sent data, an infinite loop and sensitive cached information.
All 21 critical vulnerabilities had CVSS scores of either 9.8 or 9.1. The patched 9.8 group included 3D Product configurator for WooCommerce through 2.16.2, CVE-2026-103889, with unauthenticated remote code execution, meaning an outsider could potentially make the server run hostile instructions. Advanced IP Blocker through 8.13.13, CVE-2026-104732, had an authentication bypass involving its two-factor login handler. Bricksforge through 3.1.8.9, CVE-2026-85097, and Extensions For CF7 through 3.4.5, CVE-2026-94589, had unauthenticated arbitrary file-upload flaws. SiteVault through 1.5.19, CVE-2026-42696, had remote code execution; SMS Alert through 4.0.0, CVE-2026-94256, allowed account takeover; and WPCOM Member through 1.7.27, CVE-2026-104803, had a social-login authentication bypass.
Eight 9.8-rated flaws were listed as unpatched. They affected Anton Extensions through 1.2.2, CVE-2026-104028; the Doctreat theme through 1.7.0, CVE-2026-39770; Everest Backup through 2.3.13, CVE-2026-39802; Freeton WP through 1.0.0, CVE-2026-84737; Mindstien Quick Login through 1.0, CVE-2026-84734; Tailored Tools through 3.0.3, CVE-2026-62025; Tonda Membership through 1.0.1, CVE-2026-62022; and Tourfic Pro through 1.17.3, CVE-2026-39774. The weaknesses included file upload, remote code execution, account takeover and privilege escalation, where an attacker gains permissions that should not be available.
The six critical flaws scored at 9.1 included four patched issues: Avada (Fusion) Builder through 3.16.1, CVE-2026-97670, allowed unauthenticated WordPress actions through a dynamic form token; Blocksy Companion through 2.1.58, CVE-2026-107645, had privilege escalation through the role parameter; PPOM through 34.0.10, CVE-2026-104801, allowed file deletion; rtMedia through 4.7.13, CVE-2026-105892, also allowed file deletion; and Super Forms through 6.3.316, CVE-2026-17609, allowed directory deletion. Simple File List through 6.3.11, CVE-2026-39792, was listed as unpatched and allowed unauthenticated file deletion.
The high-severity findings also included several flaws exploitable by low-privilege registered users. Patched examples rated 8.8 affected ACPT Premium through 2.0.66, LatePoint through 5.7.3, Creator LMS through 1.2.21, FooSales through 1.43.0, FV Player 8 through 8.1.7, Groundhogg through 4.9, LifterLMS through 10.2.1 and Super Forms through 6.3.316. Unpatched 8.8 issues affected CodeBard Help Desk through 1.1.2, Content Visibility for Divi Builder through 5.03, Crowdfundly through 2.2.2, Taskbot through 6.6, Veeqo for WooCommerce through 2.2.8, Workreap Core through 3.4.5 and WP Duplicate through 1.1.11. Their effects included remote code execution, file upload, privilege escalation and PHP object injection.
A substantial set of 8.1-rated flaws involved unauthenticated local file inclusion or PHP object injection in themes. Products listed as unpatched included Aalto through 1.8, Alliance through 3.11, Ambient through 1.7, Anesta through 1.5.3, Armania through 1.4.8, Asia Garden through 1.3.1, Avala through 1.1.4, Backhoe through 2.0, Balance through 1.12.0, Biolife through 3.2.3, Booklovers through 2.13.0, Boutique through 2.3.3, Buzz Stone through 1.0.2, Camelia through 1.2.15, Cardea through 2.3, CleanSkin through 1.5.0, Convex through 1.16.0, Drone Media through 2.2.0, Duka Market through 1.3.0, Dwell through 1.16.0, Edema through 1.2.2.2, Education Center through 3.6.12 and Equadio through 1.1.4. DirectoryPress through 3.6.27 was also unpatched. Patched 8.1 examples included Advanced Form Integration through 2.9.0, AFFI through 1.0.10 and Booster for WooCommerce through 8.4.0.
Wordfence also deployed firewall rules for stored XSS in WordPress Core 7.1 through 7.1.2 involving pending comments, and unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce through 10.8.0 involving the guest persistent-cart meta_value. Premium, Care and Response users received those rules immediately, while the free version was scheduled to receive them after a 30-day delay. Wordfence said sites using its plugin with scanning enabled should have received a warning when affected software was detected.
Site owners should update patched products promptly and disable or remove an affected plugin or theme when no patch is available, especially for unauthenticated flaws that do not require an account. Before making changes, create a tested backup and confirm that recovery works. For organizations that prefer not to manage this work alone, AEU Hosting provides managed WordPress hosting secured end to end, which is directly relevant when maintaining a security-sensitive WordPress installation.