EN ES
Start free
Menu

WordPress security problems in week 43 of 2026

New security problems in WordPress plugins, themes and WordPress itself, first reported from 19 October to 25 October 2026, in plain words.

Updated

In short

That week: 276 new problems in 197 plugins and themes; none are being attacked as far as we know.

Based on public reports. Check each plugin’s or theme’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

Other new problems

Elementor Website Builder plugin

  • This week Someone with an author account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 4.3.5.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 4.3.5.

LiteSpeed Cache plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 7.9.2.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 7.9.2.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 7.9.2.
  • This week A stranger could use it to harm your site. Fixed in version 7.9.1.

Essential Addons for Elementor plugin

  • This week Someone with an author account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 6.8.7.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 6.8.7.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More plugin

  • This week Someone could use it to harm your site. Fixed in version 5.0.0.
  • This week A stranger could in some setups, take over your site. Fixed in version 5.0.0.

Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin

  • This week Someone who already has an admin account could plant harmful code that runs for your visitors or admins. Fixed in version 7.8.5.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 7.8.5.

W3 Total Cache plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 2.11.0.

Fluent Forms plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 6.2.16.

Royal Addons for Elementor plugin

  • This week Someone with a contributor account on your site could run their own code on your site and take it over. Fixed in version 1.7.1069.

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 4.3.3.

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.15.6.

Meta Box plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 5.15.3.

PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 11.4.3.

YITH WooCommerce Wishlist plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 4.19.0.

WebP Express plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 0.25.16.

Formidable Forms plugin

  • This week A stranger could slow down or crash your site. Fixed in version 7.0.

Otter Blocks plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 3.2.8.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 3.2.8.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.2.8.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 3.2.8.

Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails plugin

  • This week A stranger could use it to harm your site. Fixed in version 2.2.0.

Ad Inserter – Ad Manager & AdSense Ads plugin

  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 2.8.19.

Redirection for Contact Form 7 plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.2.12.

CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin

  • This week A stranger could do things on your site they should not be allowed to. Fixed in version 4.1.21.

Anti-Spam, Spam FireWall by CleanTalk plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 6.90.

JetBackup – Backup, Restore & Migrate plugin

  • This week Someone could use it to harm your site. Fixed in version 3.1.24.10.

Qi Addons For Elementor plugin

  • This week Someone with a contributor account on your site could use it to harm your site. Fixed in version 1.11.2.

Popup Builder plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 4.4.6.

Advanced File Manager plugin

  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 6.0.0.

And 172 more products with new problems. Search for yours on the full list. All plugins and themes

What to do

  1. Check whether your site uses any of the plugins or themes on this page.
  2. If it does, update them to the fixed version or newer. Start with the ones marked Today.
  3. If there is no fixed version yet, think about turning the plugin off or replacing it until a fix comes out.
  4. Not sure which versions you have? Watchfox AI checks them every day and emails you only when something needs fixing.

Earlier weeks

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)