WordPress Plugins: 25 Vulnerabilities Including SQLi and XSS Disclosed Together
A batch of 25 WordPress plugin vulnerabilities, including critical SQL injection and XSS flaws, were disclosed on October 11, 2026, posing significant risks to user data and site integrity.
Key findings
- 25 WordPress plugins disclosed with vulnerabilities on October 11, 2026.
- Multiple SQL injection flaws (CVE-2026-89305, CVE-2026-89304, etc.) allow database data extraction.
- Several XSS vulnerabilities (CVE-2026-96227, CVE-2026-91829, etc.) enable script execution.
- High-severity flaws include authentication bypass and information disclosure issues.
- Affected plugins range from user management to e-commerce tools.
On October 11, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins, with a notable cluster of high-severity flaws. This coordinated disclosure event highlights ongoing security challenges within the extensive WordPress plugin ecosystem. The vulnerabilities span multiple bug classes, including SQL injection, cross-site scripting (XSS), authentication bypass, and information disclosure, impacting both authenticated and unauthenticated users.
A substantial portion of the disclosed vulnerabilities are SQL injection flaws, primarily affecting plugins that fail to properly sanitize and escape user input before incorporating it into database queries. These include CVE-2026-89305 and CVE-2026-89304 in the paymendo plugin, CVE-2026-89302 in Post Voting System, CVE-2026-89299 in WP Verify API, CVE-2026-89297 in Loja Automática, CVE-2026-89287 in ASPL Product Quotation, CVE-2026-89285 in Datalist it, CVE-2026-89234 in WP-Partner, CVE-2026-89232 in Recordbrowser, CVE-2026-89214 in WpCues Basic Quiz, CVE-2026-89213 in Llavero.io, CVE-2026-89195 in Site Setup Wizard, and CVE-2026-88930 in Social Web Suite. These vulnerabilities, rated with CVSSv3 scores of 8.6 or 6.5, allow attackers to extract sensitive data from the database.
Cross-site scripting (XSS) vulnerabilities were also prevalent. CVE-2026-96227 in Piotnet Forms (CVSSv3 8.8) allows unauthenticated attackers to store executable JavaScript. Similarly, CVE-2026-91829 in Subscribe to Comments (CVSSv3 7.1) enables reflected XSS via crafted URLs. Other XSS-related issues include CVE-2026-88905 in KeyWord Collector (CVSSv3 8.8), CVE-2026-88903 in Topcontent (CVSSv3 8.8), CVE-2026-88826 in SmugMug Embed (CVSSv3 8.8), and CVE-2026-87764 in BuddyPress Instant Chat (CVSSv3 8.8), all allowing for the storage or execution of malicious scripts.
Several plugins suffered from broken access control and capability checks. CVE-2026-97183 in WP-Invoice (CVSSv3 4.3) and CVE-2026-94235 in MemberHero (CVSSv3 4.3) allow authenticated users to retrieve sensitive user information or send arbitrary emails, respectively. CVE-2026-89283 in WP Posts Password Batch Manager (CVSSv3 8.6) permits unauthenticated attackers to reset passwords for all published posts. CVE-2026-88827 in Disable Users (CVSSv3 8.8) bypasses account disabling controls, allowing disabled accounts to retain full privileges. CVE-2026-93550 in Veeqo for WooCommerce (CVSSv3 4.3) allows authenticated users to trigger a remote bridge-installation process with arbitrary URLs.
The batch also includes a medium-severity vulnerability in Simple Membership (CVE-2026-88785, CVSSv3 4.7) that transmits plaintext passwords in URL query strings when an auto-login feature is enabled, exposing credentials in logs and browser history.
Most of these vulnerabilities appear to be unpatched in the versions specified, with attackers able to exploit them if the plugin is running that version. Users are strongly advised to update affected plugins to their latest versions to mitigate these risks. The sheer volume and severity of these vulnerabilities underscore the importance of regular security audits and prompt patching for WordPress sites.
The coordinated disclosure of these 25 vulnerabilities on a single day highlights a significant security event for the WordPress ecosystem. Users of the affected plugins should prioritize updating to secure versions to protect their sites from data breaches, unauthorized access, and script injection attacks. Staying informed about plugin security advisories and maintaining a proactive patching strategy are crucial for WordPress site administrators.