EN ES
Start free
Menu

WordPress security problems this week

New security problems in WordPress plugins, themes and WordPress itself, first reported from 26 October to 1 November 2026, in plain words.

Updated

In short

This week: 310 new problems in 208 plugins and themes; none are being attacked as far as we know.

Based on public reports. Check each plugin’s or theme’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

Other new problems

WordPress WordPress itself

  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with an author account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week A stranger could see private information they should not see. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could slow down or crash your site. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with an editor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone could use it to harm your site. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could use it to harm your site. Fixed in version 7.1.4.
  • This week Someone could use it to harm your site. Fixed in version 7.1.4.
  • This week A stranger could run their own code on your site and take it over. Fixed in version 7.1.4.
  • This week Someone could use it to harm your site. Fixed in version 7.1.4.

LiteSpeed Cache plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 7.9.2.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 7.9.2.

Rank Math SEO plugin

  • This week Someone with a contributor account on your site could run their own code on your site and take it over. Fixed in version 1.0.277.

All in One SEO plugin

  • This week A stranger could use it to harm your site. Fixed in version 5.0.4.

Essential Addons for Elementor plugin

  • This week A stranger could take over your site as an admin. Fixed in version 6.8.8.
  • This week A stranger could use it to harm your site. Fixed in version 6.8.7.

Spectra Legacy – Gutenberg Blocks plugin

  • This week A stranger could do things on your site they should not be allowed to. Fixed in version 2.20.5.

Newsmatic theme

  • This week A stranger could read or change the data in your site’s database. Fixed in version 1.5.1.

Redux Framework plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 4.5.16.
  • This week Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to. Fixed in version 4.5.16.

W3 Total Cache plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 2.11.0.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 2.11.0.

Enable Media Replace plugin

  • This week Someone with an author account on your site could do things on your site they should not be allowed to. Fixed in version 4.2.3.

Forminator Forms plugin

  • This week A stranger could use it to harm your site. Fixed in version 1.58.0.
  • This week A stranger could use it to harm your site. Fixed in version 1.55.1.

Kadence Blocks plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 3.8.0.2.

Royal Addons for Elementor plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 1.7.1070.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 1.7.1070.
  • This week A stranger could use it to harm your site. Fixed in version 1.7.1070.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 1.7.1070.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 1.7.1070.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 1.7.1070.
  • This week A stranger could use it to harm your site. Fixed in version 1.7.1070.
  • This week A stranger could use it to harm your site. Fixed in version 1.7.1070.

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin

  • This week Anyone with an account on your site, even a basic one could use it to harm your site. Fixed in version 3.15.6.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.15.6.
  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 3.15.6.
  • This week A stranger could use it to harm your site. Fixed in version 3.15.6.

GoSMTP – SMTP for WordPress plugin

  • This week Someone could take over your site as an admin. Fixed in version 1.2.5.

MailPoet – Newsletters, Email Marketing, and Automation plugin

  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 5.14.2.

Meta Box plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 5.15.3.

Kirki – Freeform Page Builder, Website Builder & Customizer plugin

  • This week Anyone with an account on your site, even a basic one could take over your site as an admin. Fixed in version 6.3.0.

Page Builder by SiteOrigin plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 2.38.0.
  • This week Someone with a contributor account on your site could use it to harm your site. Fixed in version 2.38.0.

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 4.5.5.
  • This week Someone could run their own code on your site and take it over. Fixed in version 4.5.0.
  • This week Someone could read or delete private files on your server. Fixed in version 4.5.0.

PDF Invoices & Packing Slips for WooCommerce plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 5.16.5.
  • This week A stranger could see private information they should not see. Fixed in version 5.16.6.

SEOPress – AI SEO Plugin & On-site SEO plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 10.4.

WP Activity Log plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 5.6.2.

Formidable Forms plugin

  • This week Anyone with an account on your site, even a basic one could use it to harm your site. Fixed in version 7.0.

Password Protected plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 2.8.5.

And 183 more products with new problems. Search for yours on the full list. All plugins and themes

What to do

  1. Check whether your site uses any of the plugins or themes on this page.
  2. If it does, update them to the fixed version or newer. Start with the ones marked Today.
  3. If there is no fixed version yet, think about turning the plugin off or replacing it until a fix comes out.
  4. Not sure which versions you have? Watchfox AI checks them every day and emails you only when something needs fixing.

Earlier weeks

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)