EN ES
Start free
Menu

WordPress security problems in week 45 of 2026

New security problems in WordPress plugins, themes and WordPress itself, first reported from 2 November to 8 November 2026, in plain words.

Updated

In short

This week: 114 new problems in 88 plugins and themes; none are being attacked as far as we know.

Based on public reports. Check each plugin’s or theme’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

Not ready to install? Get the Monday list.
The Monday list

Every week the fox reads them all.

One email a week. Unsubscribe any time. Privacy

Other new problems

LiteSpeed Cache plugin

  • This week A stranger could use it to harm your site. Fixed in version 7.9.2.

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 2.0.3.1.
  • When you can Someone could use it to harm your site. Fixed in version 2.0.3.1.

CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 3.5.8.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More plugin

  • This week A stranger could use it to harm your site. Fixed in version 5.1.0.
  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 5.1.0.
  • This week Anyone with an account on your site, even a basic one could read or change the data in your site’s database. Fixed in version 5.1.0.

WP Fastest Cache plugin

  • This week A stranger could see private information they should not see. Fixed in version 1.5.4.

WPvivid — Backup, Migration & Staging plugin

  • This week Someone who already has an admin account could read or delete private files on your server. Fixed in version 0.9.138.
  • This week Someone who already has an admin account could run their own code on your site and take it over. Fixed in version 0.9.137.
  • This week Someone who already has an admin account could use it to harm your site. Fixed in version 0.9.137.
  • This week Someone who already has an admin account could read or delete private files on your server. Fixed in version 0.9.137.

Redux Framework plugin

  • This week Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins. Fixed in version 4.5.17.
  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 4.5.17.

Enable Media Replace plugin

  • This week Someone with an author account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 4.2.3.

Forminator Forms plugin

  • This week Anyone with an account on your site, even a basic one could run their own code on your site and take it over. Fixed in version 1.58.4.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 1.58.4.

SEOPress – AI SEO Plugin & On-site SEO plugin

  • This week Someone could plant harmful code that runs for your visitors or admins. Fixed in version 10.4.

Unlimited Elements for Elementor plugin

  • This week A stranger could plant harmful code that runs for your visitors or admins. Fixed in version 2.0.27.

Redirection for Contact Form 7 plugin

  • This week A stranger could do things on your site they should not be allowed to. Fixed in version 3.2.15.

Post Duplicator plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 3.0.17.

Simple CAPTCHA with Cloudflare Turnstile plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 1.44.4.
  • This week A stranger could use it to harm your site. Fixed in version 1.44.2.

GiveWP – Donation Plugin and Fundraising Platform plugin

  • This week Someone could take over your site as an admin. Fixed in version 4.19.1.1.

Parsi Date plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 6.5.

Permalink Manager Lite plugin

  • This week Someone with an author account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 2.6.2.

Mollie Payments for WooCommerce plugin

  • This week Someone could do things on your site they should not be allowed to. Fixed in version 8.2.0.
  • This week Someone could do things on your site they should not be allowed to. Fixed in version 8.2.0.

Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin

  • This week Someone with a shop manager account on your site could run their own code on your site and take it over. Fixed in version 8.0.27.

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin

  • This week Someone could use it to harm your site. Fixed in version 3.6.3.

JetFormBuilder — Dynamic Blocks Form Builder plugin

  • This week A stranger could take over your site as an admin. Fixed in version 3.6.8.

Customer Reviews for WooCommerce plugin

  • This week Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins. Fixed in version 5.127.0.

PowerPack Addons for Elementor plugin

  • This week Someone with a contributor account on your site could make your server visit other addresses on their behalf. Fixed in version 3.1.3.

AMP for WP – Accelerated Mobile Pages plugin

  • This week Anyone with an account on your site, even a basic one could use it to harm your site. Fixed in version 1.1.19.

Import and export users and customers plugin

  • This week Someone could take over your site as an admin. Fixed in version 2.5.12.

And 63 more products with new problems. Search for yours on the full list. All plugins and themes

What to do

  1. Check whether your site uses any of the plugins or themes on this page.
  2. If it does, update them to the fixed version or newer. Start with the ones marked Today.
  3. If there is no fixed version yet, think about turning the plugin off or replacing it until a fix comes out.
  4. Not sure which versions you have? Watchfox AI checks them every day and emails you only when something needs fixing.

Earlier weeks

All plugins and themes

Get this list every Monday

Every Monday the fox reads the week’s new WordPress security problems and sends you the short list, in plain words. Every week the fox reads them all.

One email a week. Unsubscribe any time. Privacy

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)