WordPress Plugins: 24 Vulnerabilities Disclosed, Including Two Critical Flaws
A batch of 24 WordPress plugin vulnerabilities, including two critical flaws, were disclosed on September 2, 2026, impacting site security and data integrity.
Key findings
- 24 WordPress plugin vulnerabilities disclosed on September 2, 2026, ranging from Medium to Critical severity.
- Two Critical vulnerabilities (CVE-2026-4357, CVE-2025-9314) allow unauthenticated file uploads and arbitrary code execution.
- Multiple plugins suffer from stored XSS, authentication bypass, and payment manipulation flaws.
- Flaws include improper input sanitization, lack of authorization checks, and CSRF vulnerabilities across various plugins.
- Affected plugins include All in One SEO, Yoast SEO Premium, RegistrationMagic, and others; updates are available.
On September 2, 2026, a significant batch of 24 vulnerabilities affecting various WordPress plugins was disclosed, spanning a 5-hour window. These vulnerabilities range in severity from Low to Critical, with two Critical flaws (CVE-2026-4357 and CVE-2025-9314) and one High severity flaw (CVE-2025-15485) posing the most immediate risk to WordPress sites. The disclosures highlight common weaknesses in plugin development, including improper input sanitization, lack of authorization checks, and insecure handling of user-supplied data.
Several plugins were found to have stored cross-site scripting (XSS) vulnerabilities. CVE-2026-75134, affecting the SEOWriting plugin, allows authenticated contributors to inject malicious JavaScript via an overly permissive KSES allowlist. Similarly, CVE-2026-83547 in Xpro Addons and CVE-2026-82884 in All in One SEO also permit stored XSS attacks through insufficiently escaped widget settings and post content, respectively. CVE-2026-19698, a critical vulnerability in the Developer Tools plugin, stems from an unauthenticated arbitrary file upload in its bundled SWFUpload component.
Other notable vulnerabilities include authentication bypass and privilege escalation flaws. CVE-2026-4357, a critical vulnerability in the Embed HTML5 Game plugin, allows unauthenticated attackers to upload PHP backdoors due to improper restrictions on file uploads. CVE-2025-15485, a high-severity flaw in the Auto x LINE plugin, enables unauthenticated users to exploit missing authorization checks in REST endpoints to update plugin settings and clear logs. CVE-2026-77009, a critical vulnerability in the WatchMan-Site7 plugin, grants any authenticated user access to a debugging console that executes arbitrary PHP code.
Cross-site request forgery (CSRF) and insecure direct object reference (IDOR) issues were also present. CVE-2026-8151, affecting the Simple Membership MailChimp Integration plugin, lacks CSRF checks on its settings page, allowing attackers to replace API keys. CVE-2026-14326 in the Timetics plugin allows users with a custom staff role to modify appointments belonging to other staff members due to a lack of per-object ownership enforcement.
Several plugins suffered from vulnerabilities allowing unauthenticated users to bypass payment or protection mechanisms. CVE-2026-83533 (WP Express Checkout) and CVE-2026-77794 and CVE-2026-77793 (RegistrationMagic) allow users to mark orders as paid or complete registrations without actual payment. CVE-2026-78153 (Restrict User Access) and CVE-2025-15490 and CVE-2025-15489 (Passster) allow unauthenticated users to bypass content restrictions or retrieve protected content.
The batch also included vulnerabilities related to information disclosure and HTTP header injection. CVE-2025-15481 (Notification Bar for WordPress) exposes an unauthenticated script that discloses subscriber emails. CVE-2026-2811 (Ajaxify Comments) is vulnerable to HTTP Header Injection due to insufficient input sanitization. CVE-2026-10821 (Yoast SEO Premium) could allow users with Author-level access to inject control characters into Apache configuration files.
The disclosures on September 2, 2026, underscore the persistent security challenges within the WordPress ecosystem. Users are strongly advised to review the specific plugins affected by these vulnerabilities and apply updates promptly. The presence of critical and high-severity flaws, particularly those allowing arbitrary code execution and file uploads, necessitates immediate attention to mitigate potential compromise.
The patched versions for these vulnerabilities are: SEOWriting through 1.12.5, Simple Membership MailChimp Integration before 1.9.8, Xpro Addons before 1.7.4, WP Express Checkout before 2.4.9, All in One SEO before 5.0.0.1, Brave before 0.8.8, Restrict User Access before 2.8.1, RegistrationMagic before 6.0.9.9, WatchMan-Site7 through 4.2.0, Embed HTML5 Game through 1.3, Ajaxify Comments before 3.2, HIPAA FORMS before 3.2.0, GutenKit before 2.5.1, User Frontend before 4.3.11, Timetics through 1.0.61, Yoast SEO Premium before 27.6.1, Developer Tools through 1.1.3, Wp Edit Password Protected before 1.3.5, Icegram Express before 5.8.6, Passster before 4.2.26 and 4.2.24, Auto x LINE through 1.0.0, Notification Bar for WordPress through 1.1.8. CVE-2025-13398 was a duplicate and not published.
This batch of vulnerabilities highlights the critical need for ongoing security audits and timely patching within the vast WordPress plugin landscape. Users should prioritize updating the affected plugins to their latest versions to protect their sites from these diverse security risks. The concentration of critical and high-severity issues in this single disclosure event serves as a stark reminder of the potential impact of unpatched vulnerabilities.