WordPress Plugins: 25 Vulnerabilities Including Critical Flaws Disclosed Together
Key findings • 25 WordPress plugins disclosed with vulnerabilities on October 22, 2026, within a two-hour window. • Vulnerabilities span Stored XSS, Missing Authorization, SQL Injection, Auth…
Key findings
- 25 WordPress plugins disclosed with vulnerabilities on October 22, 2026, within a two-hour window.
- Vulnerabilities span Stored XSS, Missing Authorization, SQL Injection, Auth Bypass, and more.
- Critical flaws found in TMS Amelia, SureCart, and high-severity issues in Profile Builder and ACF Extended.
- Multiple plugins for Elementor, WooCommerce, and other popular platforms are affected.
- Users urged to update all plugins immediately to patch these widespread security issues.
On October 22, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins, with a tight disclosure window of just two hours. These vulnerabilities, ranging in severity from Medium to Critical, highlight ongoing security challenges within the WordPress ecosystem. The disclosures primarily fall into two categories: Cross-Site Scripting (XSS) and Missing Authorization flaws, with several other vulnerability types also present.
Several plugins were found to be vulnerable to Stored Cross-Site Scripting (XSS). These include hupe13 Extensions for Leaflet Map (CVE-2026-114703), nicdark ND Shortcodes For Visual Composer (CVE-2026-114702), xootix Waitlist Woocommerce (Back in stock notifier) (CVE-2026-114701), Gloriafood Restaurant Menu – Food Ordering System – Table Reservation (CVE-2026-114700), Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) (CVE-2026-112845), Codepeople Contact Form Email (CVE-2026-112379), WP Mailster (CVE-2026-111830), and WPVibes Elementor Addon Elements (CVE-2026-114184). These XSS vulnerabilities could allow attackers to inject malicious scripts into websites, which are then executed in the browsers of other users.
A notable cluster of vulnerabilities involves Missing Authorization, where improperly configured access controls could be exploited. Affected plugins include yoomoney ЮKassa для WooCommerce (CVE-2026-114699), miniOrange Page Restriction WordPress (WP) (CVE-2026-114696), Ahmad Majestic Support (CVE-2026-1116), WP Sunshine Sunshine Photo Cart (CVE-2026-111842), Brainstorm Force SureDash (CVE-2026-110894, CVE-2026-110893), and IdeaBox Creations PowerPack Addons for Elementor (CVE-2026-114182). These flaws could permit unauthorized users to access or manipulate data and functionality they should not have access to.
Other critical and high-severity vulnerabilities were also part of this disclosure batch. TMS Amelia (CVE-2026-112311) suffers from a critical SQL Injection vulnerability, potentially allowing attackers to compromise database integrity. Brainstorm Force SureCart (CVE-2026-112241) has a critical Authentication Bypass vulnerability. Cozmoslabs Profile Builder (CVE-2026-112242) and ACF Extended (CVE-2026-112312) have high-severity Privilege Escalation and Missing Authorization flaws, respectively. Additionally, ACF Extended (CVE-2026-112311) is affected by Path Traversal, and WProyal Royal Elementor Addons (CVE-2026-111851) has a Code Injection vulnerability. Xpro Elementor Addons (CVE-2026-114177) is vulnerable to Cross-Site Request Forgery (CSRF).
The widespread nature of these vulnerabilities across numerous plugins underscores the importance of diligent security practices for WordPress users and developers. While specific patch information for each individual plugin was not detailed in the disclosures, users are strongly advised to update all plugins to their latest available versions to mitigate these risks. The concentration of medium-severity XSS and authorization flaws suggests a need for developers to focus on input sanitization and robust access control mechanisms.
This batch of disclosures serves as a reminder of the continuous need for vigilance in maintaining the security of WordPress websites. Users should regularly review their installed plugins, apply updates promptly, and consider security scanning tools to identify and address potential vulnerabilities. The sheer volume and variety of issues disclosed in such a short period emphasize the dynamic threat landscape within the WordPress plugin ecosystem.
The vulnerabilities disclosed include CVE-2026-114703, CVE-2026-114702, CVE-2026-114701, CVE-2026-114700, CVE-2026-114699, CVE-2026-114698, CVE-2026-114696, CVE-2026-114195, CVE-2026-112845, CVE-2026-112379, CVE-2026-112327, CVE-2026-112312, CVE-2026-112311, CVE-2026-112242, CVE-2026-112241, CVE-2026-112218, CVE-2026-111851, CVE-2026-111842, CVE-2026-111830, CVE-2026-110894, CVE-2026-110893, CVE-2026-114184, CVE-2026-114182, CVE-2026-114180, and CVE-2026-114177.