Every Monday we go through the WordPress vulnerabilities that received a CVE the week before and sort out which ones deserve your attention first. This is the first report in the series, covering September 28 to October 4, 2026.
The short version: if you run Kirki, Unlimited Elements for Elementor, NextGEN Gallery, Ultimate Member or GiveWP, update them today. Each one has a bug that an attacker can reach without an account, or with the kind of account anyone can create on those sites, and fixed versions are out for all five.
The week in numbers
463 new CVEs were published for WordPress plugins and themes last week. That is well above the usual pace: the three weeks before brought 264, 326 and 269. Most of the jump came on a single day, Wednesday, September 30, when 194 records went out, the bulk of them from Patchstack.
- Severity: 24 critical, 198 high, 223 medium, 12 low and 6 without a score (CVSS 3.1 base score from the record).
- Affected: 341 components, 337 plugins and 4 themes. No WordPress core CVE this week.
- Bug types: cross-site scripting is again the largest group with 190 records (41%), followed by broken access control (78), information disclosure (37) and SQL injection (35).
- Sources: Patchstack 216, Wordfence 143, WPScan 100, VulnCheck 4.
- Fixes: of the 408 records for plugins hosted on WordPress.org, 397 already have a newer release than the last affected version. 5 belong to plugins that WordPress.org has closed, so no update is coming. The remaining 55 records are for premium plugins, where the version history isn’t public.
Every record, with search and filters, is in our WordPress vulnerability database, which updates daily from the CVE List.
How we rate them
The CVSS score is a starting point, not the answer. Whoever publishes the record sets it, and it describes the bug in the abstract. We look at four things instead: who can reach the bug (anyone, any logged-in user, or only editors and admins), what has to be switched on for it to work, what the attacker gets, and how many sites run the plugin. That gives four labels:
- Patch now: no real barrier in front of the bug, serious impact, popular plugin.
- Patch this week: serious, but it needs an account, a particular setup or some luck.
- Check your settings: only exploitable with a specific option or feature turned on. If yours is off, update at your normal pace.
- Low priority: needs admin-level access, or gives the attacker very little.
An example from this week shows why: Nested Pages (90,000 installs) got a 9.8 with a “no login needed” vector, while the Patchstack advisory lists Contributor as the required role. Same bug, very different risk.
This week’s shortlist
| Plugin | Active installs | Bug | Login needed | Fixed in | Our rating |
|---|---|---|---|---|---|
| Kirki | 500,000+ | Arbitrary code execution | No | 6.3.2 | Patch now |
| Unlimited Elements for Elementor | 300,000+ | SQL injection | No | 2.0.21 | Patch now |
| NextGEN Gallery | 300,000+ | Arbitrary file download | No | 4.5.1 | Patch now |
| Ultimate Member | 200,000+ | Privilege escalation, plus 3 more | Subscriber | 2.14.0 | Patch now |
| GiveWP | 100,000+ | Authentication bypass | No | 4.17.0 | Patch now |
| Cache Enabler | 100,000+ | File and folder deletion | No (conditional) | 1.8.17 | Patch this week |
| W3 Total Cache | 900,000+ | Stored XSS | No | 2.10.7 | Check your settings |
| Autoptimize | 800,000+ | Stored XSS | No | 3.1.16 | Check your settings |
| All in One SEO | 2,000,000+ | Shortcode execution | No | 5.0.2.1 | Check your settings |
| Beaver Builder (Lite) | 100,000+ | Shortcode execution | No | 2.11.0.6 | Check your settings |
| LatePoint | 100,000+ | Shortcode execution | No | 5.7.1 | Check your settings |
Patch now
Kirki 6.3.1 and older: code execution without logging in
500,000+ installs · CVSS 8.2 · CVE-2026-103065 (Patchstack) · fixed in 6.3.2
Patchstack classifies it as arbitrary code execution that needs no login. That is the worst category there is: whoever triggers it runs their own instructions on your server, which usually ends with a backdoor and a new admin account. No technical details are public yet, and the 6.3.2 changelog doesn’t call anything a security fix. What the release does show is reworked permission checks: the built-in Role Manager is gone and access now follows WordPress capabilities.
Kirki started out as a Customizer framework that many themes ask you to install, and only later grew into a page builder. So it often sits on sites whose owners don’t think of it as their plugin. Look at the plugin list even if you have never opened Kirki.
Our rating: patch now. No login, worst-case impact, half a million sites. The 8.2 score undersells it.
Unlimited Elements for Elementor 2.0.20 and older: SQL injection without logging in
300,000+ installs · CVSS 9.3 · CVE-2026-103355 (Patchstack) · fixed in 2.0.21
A blind SQL injection that anonymous visitors can reach. Blind means the attacker doesn’t see query results directly and has to pull the data out piece by piece. That is slower, but tools do it automatically. Everything in the database is within reach: user emails and password hashes, customer and order data on WooCommerce sites, and whatever other plugins store.
The same release fixes a second SQL injection (any logged-in user, CVSS 8.5) and two cross-site scripting bugs. Version 2.0.21 came out on September 30 with the note “fixed some security issues found by Patchstack and Wordfence”. The current release is 2.0.23.
Our rating: patch now.
NextGEN Gallery 4.5.0 and older: anyone can download files from your server
300,000+ installs · CVSS 7.5 · CVE-2026-94123 (Patchstack) · fixed in 4.5.1
Arbitrary file download, no login required. The 7.5 looks tame because the bug “only” reads files, but the first file anyone asks for is wp-config.php. It holds your database password and the secret keys WordPress uses to sign login cookies. Backup archives and log files left in the web root come next.
The 4.5.1 changelog (September 18) lists “security hardening on Lightroom publishing”, and 4.5.2 (October 1) adds two more security fixes: ZIP imports can no longer write outside the gallery folder, and the REST API no longer lets gallery editors change a gallery’s folder or owner. Go straight to 4.5.2.
Our rating: patch now, higher than the CVSS suggests. If the site sat on an old version for weeks, changing the database password and the keys in wp-config.php afterwards is cheap insurance. Everyone gets logged out once, that’s the only cost.
Ultimate Member 2.13.1 and older: from subscriber to admin
200,000+ installs · 4 CVEs · worst: CVSS 8.8, CVE-2026-96451 (Patchstack) · fixed in 2.14.0
The serious one is a privilege escalation: a subscriber can raise their own role. On most sites “needs a subscriber account” is a real barrier. On Ultimate Member sites it isn’t, because open registration is usually the reason the plugin is installed.
The other three: profile fields marked private (owner only, members only or restricted to a role) can be read by anyone through the member directory’s AJAX endpoint (CVE-2026-93428, CVSS 7.5); a stored XSS through the form ID that needs no login (CVE-2026-96270, 7.2); and a SQL injection that needs an admin account (CVE-2026-62059, 7.6).
Ultimate Member calls 2.14.0 a major update and asks for a backup first (the red note in the plugin list above). Take the backup, but don’t let it push the update to next month.
Our rating: patch now on any site with open registration.
GiveWP 4.16.9 and older: authentication bypass
100,000+ installs · CVSS 9.1 · CVE-2026-97196 (Patchstack) · fixed in 4.17.0
Patchstack lists it as broken authentication that needs no login, with high impact on both confidentiality and integrity. The advisory gives no further detail. The 4.17.0 changelog (September 23) has two security entries, one of them: donors can no longer add unverified email addresses to their own donor record.
Donation sites hold names, email and postal addresses and giving history. In the EU that makes a leak a data breach you may have to report, not just a technical problem.
Our rating: patch now. The current release is 4.18.0.
Cache Enabler 1.8.16 and older: file deletion, with a catch
100,000+ installs · CVSS 8.7 · CVE-2026-19253 (WPScan) · fixed in 1.8.17
The cache purge routine builds a file path from a URL without checking it, and doesn’t keep the deletion inside the cache folder. Deleting files sounds like vandalism, but on WordPress it is a takeover route: without wp-config.php the site falls back to the installer, and whoever gets there first can connect the site to a database of their own.
The catch: an anonymous visitor only gets in when another plugin on the site passes a URL taken from the request to Cache Enabler’s public cache-clearing hook. That is why the record rates the attack complexity as high.
Our rating: patch this week. You probably don’t know which of your plugins call that hook, so don’t count on being outside the condition. The 1.8.17 changelog names the CVE directly.
Check your settings first
The next five look serious on paper (two of them score 9.1), but each one only works when a particular feature is on. Update them anyway. If you can’t do it today, check the setting.
W3 Total Cache 2.10.6 and older: stored XSS through a comment
900,000+ installs · CVSS 7.2 · CVE-2026-87920 (Wordfence) · fixed in 2.10.7
An anonymous visitor can plant JavaScript in a comment, and it then runs for everyone who opens the page, logged-in administrators included. Script running in an admin’s browser can do anything the admin can, such as creating a new user or installing a plugin. It only works with “Remove query strings from static resources” enabled, because the URL rewriting behind that option is what breaks the HTML attribute.
Our rating: check your settings. With the box ticked and comments open, treat it as patch now.
Autoptimize 3.1.15.1 and older: stored XSS through the URL
800,000+ installs · CVSS 7.2 · CVE-2026-14995 (Wordfence) · fixed in 3.1.16
The same family: script injected through the path of the requested URL, stored, and executed later. The precondition is the Critical CSS feature with a valid criticalcss.com API key, because only then do frontend requests add entries to the Critical CSS job queue, which is where the injected code ends up. The 3.1.16 changelog mentions general security hardening and changes to job queueing.
Our rating: check your settings. If the API key field is empty, the bug can’t be triggered.
All in One SEO, Beaver Builder, LatePoint: shortcode execution
Three popular plugins had the same kind of bug this week: text typed by a visitor ends up somewhere WordPress runs shortcodes. How bad that is depends entirely on the shortcodes your site has. Most just print something. Some, from form, membership or shop plugins, display data the visitor shouldn’t see or trigger actions. The attacker gets to call any of them, with any parameters.
- All in One SEO before 5.0.2.1 (2,000,000+ installs, CVSS 6.5, CVE-2026-19856 and CVE-2026-100152): through the search query, when AIOSEO breadcrumbs appear on the search results page. WPScan adds that on sites upgraded from older versions the protection was switched off entirely. Fixed in 5.0.2.1, released October 1.
- Beaver Builder Lite 2.11.0.5 and older (100,000+, CVSS 9.1, CVE-2026-92084): through a widget in the Sidebar module that shows visitor text, such as Recent Comments, once the comment is approved or if moderation is off. Fixed in 2.11.0.6, where the Sidebar module no longer runs shortcodes.
- LatePoint 5.7.0 and older (100,000+, CVSS 9.1, CVE-2026-92966): through the customer name entered in the booking form, executed when the Customer Cabinet block displays it. Fixed in 5.7.1; the current release is 5.7.4.
Our rating: check your settings. The 9.1 scores assume the worst-case setup. The All in One SEO bug scores lower, but it sits on 2 million sites, so it is the one most likely to concern you.
Also on the list
Smaller install bases or narrower conditions, but if you run one of these, read on.
- BackupSheep 1.8 and older: an empty integration key counts as valid, so anyone can create and download a full backup (database included) and delete files. CVSS 10.0. WordPress.org closed the plugin in July 2024 and no fix is coming. Uninstall it.
- Super Forms (premium, 6.3.316 and older): anyone can register an administrator account through a published registration form (CVE-2026-15989, 9.8), plus an unauthenticated file read (CVE-2026-15896, 9.1). The records list no fixed version, so check with the vendor.
- Divi Membership (premium): an unauthenticated privilege escalation (2.2.0 and older) and an authentication bypass through the PayPal callback (2.3.0 and older), both 9.8.
- WordPress File Upload 5.1.10 and older (10,000+): SQL injection without login, 9.3. Fixed in 5.2.0.
- Estatik 4.3.5 and older (10,000+): subscriber to admin, 9.8. Fixed in 4.3.6.
- CartFlows 3.2.0 and older (200,000+): remote code execution for Contributor accounts and up, 8.8. Fixed in 3.2.1. A real risk mainly if you give out Contributor accounts.
- WP 2FA before 4.1.0 (100,000+): a TOTP code stays valid after it has been used, so someone who has the password and sees a fresh code can log in with it too. Narrow, but it undercuts the reason the plugin is there. Fixed in 4.1.0.
- Nested Pages 3.3.2 and older (90,000+): PHP object injection for Contributor accounts and up, despite the 9.8 “no login” vector. Fixed in 3.3.3.
What to do this week
- Open Plugins → Update Available and update the plugins above first.
- If something can’t be updated today, switch off its precondition: the W3 Total Cache query string option, the Autoptimize critical CSS key, AIOSEO breadcrumbs on the search page, open registration on an Ultimate Member site.
- On sites that ran Ultimate Member, Super Forms, Divi Membership or Estatik, open Users, filter by Administrator and look for accounts you don’t recognise.
- Remove BackupSheep if it is still installed anywhere.
- Not sure what runs on a site you look after? Our free security review checks it from the outside and matches the plugin versions it can see against the same database. It only sees what the public pages reveal, so the plugin list in wp-admin remains the reference.
Where Must-Have Security fits
Updates close the holes on this list, and next week brings a new one. Most of this week’s serious bugs are a first step. Code execution in Kirki, an administrator account through Ultimate Member, Super Forms or Divi Membership: what the attacker does next is make it stick, with a backdoor file, an uploaded plugin or an edited theme file. All of those mean writing executable code to the server.
Must-Have Security puts a separate confirmation in front of exactly that step. On a protected site, being an administrator isn’t enough to write PHP files: it takes a passkey or authenticator code, and that factor isn’t stored in the database. So a hijacked admin session or a leaked database doesn’t let anyone plant a backdoor on its own. It makes it much harder for an attacker to run their own code; it doesn’t replace updates. For the SQL injection side, we wrote up how the firewall catches injections without a signature.
How this report is made
We take every CVE record for WordPress core, plugins and themes published in the CVE List between Monday and Sunday (UTC), as collected in our database. Install counts are from WordPress.org on the Monday the report comes out. Fixed versions come from the advisory, the plugin’s changelog or the code change itself. The screenshots were taken on a local test site running the affected versions. The ratings are ours.
The next report covers October 5 to 11 and comes out on Monday, October 12.
