WordPress Plugins: 25 Vulnerabilities Disclosed, Including Critical Deserialization and SQLi Flaws
A coordinated disclosure on October 18, 2026, revealed 25 vulnerabilities in WordPress plugins, including critical flaws in Conversational Forms for ChatBot and Booktics.
Key findings
- 25 WordPress plugins disclosed with vulnerabilities on October 18, 2026.
- Critical flaws include deserialization in Conversational Forms for ChatBot (CVE-2026-110886) and SQLi in Booktics (CVE-2026-109894).
- High-severity issues include XSS, SQLi, and authorization bypass across multiple plugins.
- Multiple plugins like AI Engine and Modern Events Calendar Lite have several medium-severity flaws.
- Users must update affected plugins to the latest versions to patch these vulnerabilities.
On October 18, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins, with a critical deserialization flaw in Conversational Forms for ChatBot and SQL injection in Booktics posing the most severe threats. This coordinated disclosure event highlights ongoing security challenges within the extensive WordPress plugin ecosystem.
Several plugins were found to have critical or high-severity vulnerabilities. A deserialization of untrusted data vulnerability in QuantumCloud's Conversational Forms for ChatBot (CVE-2026-110886) and Arraytics' Booktics (CVE-2026-109894) were rated Critical, with CVSS scores of 9.8 and 9.3 respectively. These flaws could allow for object injection and SQL injection, respectively, potentially leading to complete system compromise.
High-severity vulnerabilities include Cross-Site Scripting (XSS) in PowerPack Lite for Beaver Builder (CVE-2026-110897), Simply Schedule Appointments (CVE-2026-110382), and Booktics (CVE-2026-109895), as well as Reflected XSS in eStore (CVE-2026-108485). Additionally, SQL injection vulnerabilities were found in Modern Events Calendar Lite (CVE-2026-96534), and authorization bypass flaws were present in WP E-Signature Add-on for Fluent Forms (CVE-2026-110383) and 2Way VideoCalls and Random Chat (CVE-2026-110885). Privilege escalation was also noted in Login with phone number (CVE-2026-110373) and OttoKit (CVE-2026-110372).
Medium-severity issues were also prevalent, including code injection in HivePress (CVE-2026-110885), missing authorization in Kit (CVE-2026-110880) and Advanced File Manager (CVE-2026-110365), and various other access control and data handling weaknesses. The AI Engine plugin (CVE-2026-111041, CVE-2026-110976) and Modern Events Calendar Lite (CVE-2026-110070, CVE-2026-110069) were each affected by multiple medium-severity flaws. Salon Booking System (CVE-2026-110035, CVE-2026-110033, CVE-2026-110032) also saw multiple medium-severity issues related to coupon disclosure, arbitrary file reads, and user role manipulation.
The affected versions for most plugins range from the earliest versions up to specific releases, with patches generally available. For instance, Modern Events Calendar Lite was patched in version 7.37.0 for some issues and 7.36.4 for others. Conversational Forms for ChatBot was patched in version 1.5.2, and Booktics in version 1.0.30. Users are strongly advised to update all listed plugins to their latest versions to mitigate these risks.
This large, coordinated disclosure underscores the importance of regular security audits and prompt patching for WordPress sites. The variety of vulnerabilities, from critical deserialization flaws to medium-severity access control issues, demonstrates the diverse attack surface presented by the plugin ecosystem. Website administrators should prioritize updating these plugins to protect their sites from potential exploitation.
The following CVEs were disclosed: CVE-2026-110897, CVE-2026-110895, CVE-2026-110886, CVE-2026-110885, CVE-2026-110883, CVE-2026-110880, CVE-2026-110383, CVE-2026-110382, CVE-2026-110373, CVE-2026-110372, CVE-2026-110365, CVE-2026-109895, CVE-2026-109894, CVE-2026-108485, CVE-2026-107436, CVE-2026-96534, CVE-2026-87844, CVE-2026-111041, CVE-2026-110981, CVE-2026-110976, CVE-2026-110070, CVE-2026-110069, CVE-2026-110035, CVE-2026-110033, CVE-2026-110032.