EN ES
Start free
Menu

WordPress security problems in week 44 of 2026

New security problems in WordPress plugins, themes and WordPress itself, first reported from 26 October to 1 November 2026, in plain words.

Updated

In short

That week: 553 new problems in 356 plugins and themes; 1 is being attacked.

Based on public reports. Check each plugin’s or theme’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

Not ready to install? Get the Monday list.
The Monday list

Every week the fox reads them all.

One email a week. Unsubscribe any time. Privacy

Fix today

WordPress WordPress itself

  • Today A stranger could run their own code on your site and take it over. Fixed in version 7.1.4.
  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with an author account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week A stranger could see private information they should not see. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could slow down or crash your site. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with an editor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone could use it to harm your site. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 7.1.4.
  • This week Someone with a contributor account on your site could use it to harm your site. Fixed in version 7.1.4.
  • This week Someone could use it to harm your site. Fixed in version 7.1.4.
  • This week Someone could use it to harm your site. Fixed in version 7.1.4.

Other new problems

Contact Form 7 plugin

  • This week A stranger could run their own code on your site and take it over. Fixed in version 6.2.4.

LiteSpeed Cache plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 7.9.2.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 7.9.2.

OceanWP theme

  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 4.2.8.

Rank Math SEO plugin

  • This week Someone with a contributor account on your site could run their own code on your site and take it over. Fixed in version 1.0.277.

All in One SEO plugin

  • This week A stranger could use it to harm your site. Fixed in version 5.0.4.

Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 2.9.6.

Essential Addons for Elementor plugin

  • This week A stranger could take over your site as an admin. Fixed in version 6.8.8.
  • This week Someone with an author account on your site could take over your site as an admin. Fixed in version 6.8.8.
  • This week A stranger could use it to harm your site. Fixed in version 6.8.7.
  • This week A stranger could use it to harm your site. Fixed in version 6.8.7.

Security Optimizer plugin

  • This week Someone could use it to harm your site. Fixed in version 1.6.9.

All-In-One Security plugin

  • This week Anyone with an account on your site, even a basic one could take over your site as an admin. Fixed in version 5.5.0.

Spectra Legacy – Gutenberg Blocks plugin

  • This week A stranger could do things on your site they should not be allowed to. Fixed in version 2.20.5.

Newsmatic theme

  • This week A stranger could read or change the data in your site’s database. Fixed in version 1.5.1.

Redux Framework plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 4.5.16.
  • This week Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to. Fixed in version 4.5.16.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 4.5.17.

W3 Total Cache plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 2.11.0.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 2.11.0.

Joinchat – Enhanced “click to chat” plugin

  • This week Someone with an author account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 6.4.2.

Enable Media Replace plugin

  • This week Anyone with an account on your site, even a basic one could in some setups, take over your site. Fixed in version 4.2.3.
  • This week A stranger could in some setups, take over your site. Fixed in version 4.2.3.
  • This week Someone with an author account on your site could do things on your site they should not be allowed to. Fixed in version 4.2.3.

The Events Calendar plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 6.18.3.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 6.18.3.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 6.18.3.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 6.18.3.

Forminator Forms plugin

  • This week A stranger could use it to harm your site. Fixed in version 1.58.0.
  • This week A stranger could use it to harm your site. Fixed in version 1.55.1.

Kadence Blocks plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 3.8.1.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 3.8.0.2.

Royal Addons for Elementor plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 1.7.1070.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 1.7.1070.
  • This week A stranger could use it to harm your site. Fixed in version 1.7.1070.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 1.7.1070.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 1.7.1070.
  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 1.7.1070.
  • This week A stranger could use it to harm your site. Fixed in version 1.7.1070.
  • This week A stranger could use it to harm your site. Fixed in version 1.7.1070.

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin

  • This week Anyone with an account on your site, even a basic one could use it to harm your site. Fixed in version 3.15.6.
  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 3.15.6.
  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 3.15.6.
  • This week A stranger could use it to harm your site. Fixed in version 3.15.6.
  • This week A stranger could use it to harm your site. Fixed in version 3.15.4.

SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 2.13.0.
  • This week A stranger could use it to harm your site. Fixed in version 2.13.0.

GoSMTP – SMTP for WordPress plugin

  • This week Someone could take over your site as an admin. Fixed in version 1.2.5.

MailPoet – Newsletters, Email Marketing, and Automation plugin

  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 5.14.2.

Meta Box plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 5.15.3.

And 331 more products with new problems. Search for yours on the full list. All plugins and themes

What to do

  1. Check whether your site uses any of the plugins or themes on this page.
  2. If it does, update them to the fixed version or newer. Start with the ones marked Today.
  3. If there is no fixed version yet, think about turning the plugin off or replacing it until a fix comes out.
  4. Not sure which versions you have? Watchfox AI checks them every day and emails you only when something needs fixing.

Earlier weeks

All plugins and themes

Get this list every Monday

Every Monday the fox reads the week’s new WordPress security problems and sends you the short list, in plain words. Every week the fox reads them all.

One email a week. Unsubscribe any time. Privacy

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)