WordPress: 25 Plugin Vulnerabilities Disclosed in Single-Day Batch
A coordinated disclosure on October 17, 2026, revealed 25 vulnerabilities across numerous WordPress plugins, including XSS, SQLi, and authorization bypass flaws.
Key findings
- 25 WordPress plugins disclosed with vulnerabilities on October 17, 2026.
- Vulnerabilities include XSS, SQLi, auth bypass, and information disclosure.
- Multiple plugins allow unauthenticated attackers to exploit flaws.
- Affected plugins range from e-commerce to user management tools.
- Urgent updates are recommended for all affected plugins.
On October 17, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins, impacting a wide range of functionalities and user privileges. This coordinated disclosure event highlights ongoing security challenges within the extensive WordPress ecosystem. The vulnerabilities span multiple categories, including cross-site scripting (XSS), SQL injection, authorization bypass, and information disclosure, with several carrying high severity ratings.
Several plugins were affected by Cross-Site Scripting (XSS) vulnerabilities. CVE-2026-109701, affecting PAYCOMET for WooCommerce, and CVE-2026-110384, impacting Fancy Comments WordPress, allow for reflected XSS. Stored XSS vulnerabilities were found in the Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin (CVE-2026-111110), the European VAT Compliance Assistant for WooCommerce (CVE-2026-100316), the YMC Filter plugin (CVE-2026-109983), and the User Registration & Membership plugin (CVE-2026-96660). The Themify Builder plugin also suffers from stored XSS via a shortcode attribute (CVE-2026-111726).
SQL injection vulnerabilities were also prevalent. CVE-2026-91074 in the BSK PDF Manager plugin and CVE-2026-104122 in the Ukr-To-Lat plugin allow authenticated users to execute arbitrary SQL queries. Additionally, CVE-2026-110882 in the SMS Alert Order Notifications plugin involves missing authorization due to incorrectly configured access control.
Other notable vulnerabilities include an authorization bypass in the Patreon WordPress plugin (CVE-2026-92431), allowing enumeration of taxonomy terms, and a CSRF vulnerability in the same plugin (CVE-2026-92432) that could lead to account takeover. The ACF Frontend Admin by DynamiApps plugin has two vulnerabilities: CVE-2026-81344 allows for PHP object injection via deserialization, and CVE-2026-81343 permits unauthenticated users to overwrite site-wide options. The User Registration & Membership plugin is also affected by a CSRF vulnerability (CVE-2026-92978) and arbitrary shortcode execution (CVE-2026-92798).
The impact of these vulnerabilities varies, with some allowing unauthenticated attackers to perform malicious actions, while others require authenticated access. For instance, CVE-2026-100316 and CVE-2026-111110 could be exploited by unauthenticated attackers to inject arbitrary data. CVE-2026-110889, a sensitive information disclosure in Gantry 5 Framework, could lead to data breaches. CVE-2026-97314 in ThirstyAffiliates allows disclosure of affiliate link destinations.
The affected plugins and their versions are specified in the individual CVE details. For example, SMS Alert Order Notifications is affected up to version 4.0.1, PAYCOMET for WooCommerce up to 5.45, and Gantry 5 Framework up to 5.6.4. The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin is vulnerable up to version 2.8.61. The Patreon WordPress plugin is affected before version 1.10.0. The BSK PDF Manager plugin is vulnerable up to version 3.8.1, and ACF Frontend Admin by DynamiApps up to 3.29.13. The User Registration & Membership plugin is affected up to version 5.2.8, and Tutor LMS up to 4.1.0. The Themify Builder plugin is vulnerable up to version 7.8.2. Users are strongly advised to update these plugins to their patched versions as soon as possible to mitigate these risks.
This batch of disclosures underscores the importance of diligent security practices for WordPress users, including regular updates and careful selection of plugins. The sheer volume and variety of vulnerabilities reported on a single day indicate a persistent need for developers to prioritize security in their coding practices and for users to remain vigilant about applying patches promptly. Staying informed about such disclosures is crucial for maintaining a secure WordPress environment.
CVE-2026-110882, CVE-2026-109701, CVE-2026-110889, CVE-2026-111110, CVE-2026-110253, CVE-2026-109983, CVE-2026-100316, CVE-2026-110384, CVE-2026-97314, CVE-2026-92433, CVE-2026-92432, CVE-2026-92431, CVE-2026-91074, CVE-2026-81344, CVE-2026-81343, CVE-2026-110527, CVE-2026-106470, CVE-2026-104246, CVE-2026-104122, CVE-2026-103376, CVE-2026-96660, CVE-2026-92978, CVE-2026-92798, CVE-2026-92715, CVE-2026-111726