WordPress · week of 12 Oct 2026
WordPress security note
Records on this stack that changed between 12 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.
What changed
CVE-2025-13342 — Patch now
dynamiapps frontend_admin Missing Authorization
Affected: <= 3.28.20
CVE-2025-13390 — Patch now
wpdirectorykit wp_directory_kit Incorrect Implementation of Authentication Algorithm
Affected: <= 1.4.4
CVE-2026-89079 — Patch now
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1.
Affected: <= 7.2.1
CVE-2026-109515 — Patch now
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
Affected: <= 1.2.78
CVE-2026-103895 — Patch now
Improper Authentication
Affected: <= 5.5.8
CVE-2026-97668 — Patch now
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value
Affected: <= 10.8.0
CVE-2026-74920 — Patch now
Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute
Affected: <= 5.1.1
CVE-2022-42699 — Patch now
wp-ecommerce easy_wp_smtp Improper Control of Generation of Code ('Code Injection')
Affected: <= 1.5.1
What we still do not know
CVE-2025-13486 — Patch now
acfextended advanced_custom_fields_extended Improper Control of Generation of Code ('Code Injection')
No version range is stored, so an installed version cannot be checked.
CVE-2026-15382 — Patch now
External Control of File Name or Path
No version range is stored, so an installed version cannot be checked.
CVE-2026-92438 — Patch now
ninjaforms ninja_forms Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
No version range is stored, so an installed version cannot be checked.
CVE-2023-51501 — Patch now
undsgn uncode Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
No version range is stored, so an installed version cannot be checked.
CVE-2023-6063 — Patch now
wpfastestcache wp_fastest_cache Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
No version range is stored, so an installed version cannot be checked.
CVE-2024-1756 — Patch now
vanquish woocommerce_customers_manager Cross-Site Request Forgery (CSRF)
No version range is stored, so an installed version cannot be checked.
CVE-2024-30492 — Patch now
WebToffee import_export_wordpress_users Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
No version range is stored, so an installed version cannot be checked.
CVE-2024-4180 — Patch now
StellarWP the_events_calendar Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
No version range is stored, so an installed version cannot be checked.
Share this note
WordPress security note, week of 12 Oct 2026: 8 records have a version a customer can check, and 8 still do not. https://zerodayfindings.com/technologies/wordpress/notes/2026-W42