WordPress Plugins: 25 Vulnerabilities Disclosed in Batch, Including Critical Flaws
Key findings • 25 WordPress plugin vulnerabilities disclosed in a single batch between Oct 24-25, 2026. • Critical deserialization flaw in Tribulant Newsletters (CVE-2026-94075) and High in R…
Key findings
- 25 WordPress plugin vulnerabilities disclosed in a single batch between Oct 24-25, 2026.
- Critical deserialization flaw in Tribulant Newsletters (CVE-2026-94075) and High in Relevanssi (CVE-2026-114704).
- Multiple authorization bypasses affect GiveWP, Duplicator, and other plugins.
- High-severity XSS vulnerabilities found in QA Analytics, VOD Infomaniak, and Events Manager.
- Unauthenticated order completion and privilege escalation are among the disclosed risks.
- Urgent updates required for numerous plugins to mitigate widespread security risks.
On October 24-25, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins, with a notable cluster of high and critical severity flaws. These vulnerabilities, disclosed over a 22-hour period, span multiple plugin categories including e-commerce, user management, and content display, posing a broad risk to WordPress site administrators and users. The disclosures highlight common weaknesses such as improper authorization checks, deserialization of untrusted data, and cross-site scripting (XSS) vulnerabilities.
Several plugins were affected by authorization bypass flaws, allowing lower-privileged users to perform actions reserved for administrators. For instance, the Duplicator WordPress plugin (before 5.0.0) exposed its one-click upgrade routine without proper authentication, potentially allowing unauthorized users in a multisite network to exploit it. Similarly, the Datawiza Proxy Auth Plugin (before 1.1.1) allowed unauthenticated attackers to create and authenticate as administrators by trusting unverified HTTP request headers. The GiveWP plugin (before 4.19.0.1) suffered from multiple authorization issues, including allowing users with view-only donor report access to modify donor addresses, enabling custom role users to edit other users' pages, and permitting unauthenticated visitors to view unpublished donation forms. The InstaWP Connect plugin (before 0.1.4.2) and WPVR plugin (before 9.0.3 and 9.1.3) also had vulnerabilities related to improper capability checks, allowing authenticated users with lower privileges to modify content or settings they should not have access to.
Deserialization of untrusted data was another critical theme, with vulnerabilities found in the Relevanssi plugin (through 4.28.4) and the Tribulant Software Newsletters plugin (through 4.18.1). These flaws could lead to object injection, a severe vulnerability that can allow attackers to execute arbitrary code on the server. The Relevanssi vulnerability was rated High (CVSSv3 7.2), while the Tribulant Software Newsletters vulnerability was rated Critical (CVSSv3 9.8), indicating a severe risk of compromise.
Cross-site scripting (XSS) vulnerabilities were present in multiple plugins, including Qi Addons For Elementor (before 1.11.2), Contact Form by Supsystic (before 1.8.0), Ad Inserter (through 2.8.18), QA Analytics (through 5.3.0.1), VOD Infomaniak (through 1.5.14), and Events Manager (through 7.4.8). These XSS flaws, ranging from stored to reflected types, could allow attackers to inject malicious scripts into websites, potentially leading to session hijacking, credential theft, or defacement. The QA Analytics, VOD Infomaniak, and Events Manager plugins all had High severity XSS vulnerabilities (CVSSv3 7.1).
Other notable vulnerabilities include an unauthenticated order marking flaw in the Chikkili- Google Pay India for Woocommerce plugin (through 1.0.6) and the WP Stripe Checkout plugin (before 1.2.2.62), which allowed attackers to mark orders as paid without actual payment. The aBlocks plugin (up to 2.17.0) had a privilege escalation vulnerability via its REST API, and Magepeople inc. WpEvently (through 5.7.8), Knit Pay UPI QR Code Payment Gateway for WooCommerce (through 1.6.3), and quadlayers WP Social Feed Gallery (through 5.0.13) all suffered from missing authorization vulnerabilities.
The disclosed vulnerabilities affect a wide range of WordPress plugin versions, with patches and updates available for most. Users are strongly advised to update the affected plugins to the versions specified in their respective advisories to mitigate these security risks. The coordinated disclosure of these 25 CVEs underscores the ongoing need for diligent security practices and timely patching within the WordPress ecosystem.
Key findings from this batch include:
- A critical deserialization vulnerability in Tribulant Software Newsletters (CVE-2026-94075) and a high-severity one in Relevanssi (CVE-2026-114704).
- Multiple authorization bypass flaws across plugins like GiveWP, Duplicator, and Datawiza Proxy Auth.
- Several high-severity Stored and Reflected XSS vulnerabilities in plugins such as QA Analytics, VOD Infomaniak, and Events Manager.
- Unauthenticated order completion exploits in WooCommerce payment gateway plugins.
- Privilege escalation in the aBlocks plugin via its REST API.
- A broad range of affected plugins, emphasizing the need for regular updates.
The batch of vulnerabilities disclosed between October 24-25, 2026, highlights critical security weaknesses across numerous WordPress plugins. These include severe deserialization flaws, numerous authorization bypasses, and various cross-site scripting vulnerabilities. The timely patching of affected plugins is crucial for maintaining the security of WordPress websites.
The vulnerabilities disclosed include: CVE-2026-94295, CVE-2026-115251, CVE-2026-115214, CVE-2026-115183, CVE-2026-114743, CVE-2026-114742, CVE-2026-114741, CVE-2026-114740, CVE-2026-111981, CVE-2026-111980, CVE-2026-111979, CVE-2026-111978, CVE-2026-111976, CVE-2026-110285, CVE-2025-15705, CVE-2026-114704, CVE-2026-114192, CVE-2026-114191, CVE-2026-110018, CVE-2026-114705, CVE-2026-114194, CVE-2026-94075, CVE-2026-114697, CVE-2026-114695, CVE-2026-114694.