WordPress security problems in week 42 of 2026
New security problems in WordPress plugins, themes and WordPress itself, first reported from 12 October to 18 October 2026, in plain words.
Updated
In short
That week: 499 new problems in 351 plugins and themes; none are being attacked as far as we know.
Based on public reports. Check each plugin’s or theme’s changelog. Watchfox AI may be wrong.
Get an email when your site is affected: install Watchfox AI (free)
Other new problems
Elementor Website Builder plugin
- This week Someone with a contributor account on your site could see private information they should not see. Fixed in version 4.2.4.
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin
- This week A stranger could use it to harm your site. Fixed in version 2.0.2.2.
Rank Math SEO plugin
- This week A stranger could do things on your site they should not be allowed to. Fixed in version 1.0.280.
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager plugin
- This week A stranger could use it to harm your site. Fixed in version 2.4.0.
Essential Addons for Elementor plugin
- This week Someone with an author account on your site could take over your site as an admin. Fixed in version 6.8.6.
Complianz GDPR/CCPA Cookie Consent Banner plugin
- This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 7.5.6.
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN plugin
- This week Someone could do things on your site they should not be allowed to. Fixed in version 4.3.4.
Polylang plugin
- This week Someone with an editor account on your site could in some setups, take over your site. Fixed in version 3.8.10.
Click to Chat – HoliThemes plugin
- This week A stranger could use it to harm your site. Fixed in version 4.45.
The Events Calendar plugin
- This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 6.18.2.
Premium Addons for Elementor plugin
- This week Someone could do things on your site they should not be allowed to. Fixed in version 4.11.111.
- This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 4.11.111.
- This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 4.11.111.
Forminator Forms plugin
- This week A stranger could use it to harm your site. Fixed in version 1.58.2.
- This week A stranger could use it to harm your site. Fixed in version 1.58.2.
- This week Someone could do things on your site they should not be allowed to. Fixed in version 1.58.1.
Backuply – Backup, Restore, Migrate and Clone plugin
- This week Anyone with an account on your site, even a basic one could take over your site as an admin. Fixed in version 1.5.9.
Database Addon for Contact Form 7 plugin
- This week A stranger could use it to harm your site. Fixed in version 1.4.2.
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin
- This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 2.12.8.
Broken Link Checker plugin
- This week A stranger could use it to harm your site. Fixed in version 2.4.15.
- This week A stranger could use it to harm your site. Fixed in version 2.4.15.
Kirki – Freeform Page Builder, Website Builder & Customizer plugin
- This week A stranger could see private information they should not see. Fixed in version 6.4.0.
- This week Someone who already has an admin account could in some setups, take over your site. Fixed in version 6.4.0.
- This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 6.2.1.
Ocean Extra plugin
- This week A stranger could use it to harm your site. Fixed in version 2.6.1.
TranslatePress – Translate Multilingual sites with AI Translation plugin
- This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.3.8.
WP Mail Logging plugin
- This week Someone who already has an admin account could see private information they should not see. Fixed in version 1.17.1.
Jeg Kit for Elementor plugin
- This week Anyone with an account on your site, even a basic one could see private information they should not see. Fixed in version 3.2.20.
Otter Blocks plugin
- This week A stranger could send your visitors from your site to a harmful site. Fixed in version 3.2.3.
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails plugin
- This week A stranger could use it to harm your site. Fixed in version 2.1.4.
Ad Inserter – Ad Manager & AdSense Ads plugin
- This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 2.8.19.
- This week Anyone with an account on your site, even a basic one could use it to harm your site. Fixed in version 2.8.19.
WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin
- This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 1.2.0.
And 326 more products with new problems. Search for yours on the full list. All plugins and themes
What to do
- Check whether your site uses any of the plugins or themes on this page.
- If it does, update them to the fixed version or newer. Start with the ones marked Today.
- If there is no fixed version yet, think about turning the plugin off or replacing it until a fix comes out.
- Not sure which versions you have? Watchfox AI checks them every day and emails you only when something needs fixing.
Earlier weeks
Get an email when your site is affected.
Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.
Install Watchfox AI (free)