EN ES
Start free
Menu

WordPress security problems in week 39 of 2026

New security problems in WordPress plugins, themes and WordPress itself, first reported from 21 September to 27 September 2026, in plain words.

Updated

In short

That week: 319 new problems in 222 plugins and themes; 1 is being attacked.

Based on public reports. Check each plugin’s or theme’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

Fix today

WordPress WordPress itself

  • Today A stranger could read or delete private files on your server. Fixed in version 7.1.2.

Other new problems

Elementor Website Builder plugin

  • This week Someone could take over your site as an admin. Fixed in version 4.3.2.

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin

  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 2.0.2.1.
  • This week A stranger could use it to harm your site. Fixed in version 2.0.2.1.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 2.0.2.

UpdraftPlus: WP Backup & Migration Plugin plugin

  • This week Anyone with an account on your site, even a basic one could use it to harm your site. Fixed in version 2.26.8.26.

ElementsKit Elementor Addons plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 4.0.6.

File Manager plugin

  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 8.0.5.
  • This week A stranger could use it to harm your site. Fixed in version 8.0.5.

Safe SVG plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 2.5.1.
  • This week Someone with a contributor account on your site could use it to harm your site. Fixed in version 2.5.1.

All-In-One Security plugin

  • This week Anyone with an account on your site, even a basic one could use it to harm your site. Fixed in version 5.4.9.

Spectra Legacy – Gutenberg Blocks plugin

  • This week Someone with a contributor account on your site could see private information they should not see. Fixed in version 2.20.1.

Translate WordPress with GTranslate plugin

  • This week A stranger could use it to harm your site. Fixed in version 5.0.1.

The Events Calendar plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 6.17.5.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 6.17.5.
  • This week A stranger could use it to harm your site. Fixed in version 6.17.5.

Premium Addons for Elementor plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 4.11.106.

Forminator Forms plugin

  • This week A stranger could use it to harm your site. Fixed in version 1.57.2.1.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 1.57.2.1.
  • This week A stranger could do things on your site they should not be allowed to. Fixed in version 1.57.2.1.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 1.57.2.1.

WP Statistics plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 14.16.14.

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.15.4.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.15.4.
  • This week A stranger could in some setups, take over your site. Fixed in version 3.15.4.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.15.4.

Kirki – Freeform Page Builder, Website Builder & Customizer plugin

  • This week A stranger could make your server visit other addresses on their behalf. Fixed in version 6.2.1.

PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 11.4.2.

TranslatePress – Translate Multilingual sites with AI Translation plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.3.6.

Template Kit – Import plugin

  • This week Someone with an editor account on your site could read or delete private files on your server. Fixed in version 1.0.17.

HappyAddons for Elementor plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 3.50.0.

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin

  • This week A stranger could read or delete private files on your server. Fixed in version 4.5.1.

Blocksy Companion plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 2.1.56.

CMB2 plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 2.13.0.

ShortPixel Image Optimizer plugin

  • This week Anyone with an account on your site, even a basic one could in some setups, take over your site. Fixed in version 6.5.6.

Ad Inserter – Ad Manager & AdSense Ads plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 2.8.19.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 2.8.19.

And 197 more products with new problems. Search for yours on the full list. All plugins and themes

What to do

  1. Check whether your site uses any of the plugins or themes on this page.
  2. If it does, update them to the fixed version or newer. Start with the ones marked Today.
  3. If there is no fixed version yet, think about turning the plugin off or replacing it until a fix comes out.
  4. Not sure which versions you have? Watchfox AI checks them every day and emails you only when something needs fixing.

Earlier weeks

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)