WordPress plugin vulnerabilities: 19 plugins including W3 Total Cache

Between 28 and 31 October 2026, 20 vulnerabilities were disclosed in 19 WordPress plugins. The most serious is an authentication bypass in Uncanny Toolkit for LearnDash (CVSS 9.8). The most widely used affected plugins are W3 Total Cache (900,000 active installations), Ninja Forms (500,000) and Kirki (400,000). None of the vulnerabilities is reported as actively exploited.

Uncanny Toolkit for LearnDash (20,000 active installations)

An authentication bypass in the login handler lets unauthenticated attackers who already know an account's credentials log in to unverified or administrator-suspended accounts. This defeats the plugin's account-approval and account-suspension controls. Versions up to and including 3.8.2 are affected (CVE-2026-119096, CVSS 9.8). Update to the latest version.

Popup Builder (200,000 active installations)

A missing authorization check lets unauthenticated attackers move all published popups on the site to the trash with a single GET request. Versions up to and including 4.4.5 are affected (CVE-2026-89270, CVSS 9.1). Update to the latest version.

WP Booking System – Booking Calendar (10,000 active installations)

A missing capability check lets logged-in users with Subscriber access or higher delete calendar notes belonging to any calendar. Versions up to and including 2.1.0.5 are affected (CVE-2026-116557, CVSS 9.1). Update to the latest version.

NextGEN Gallery (300,000 active installations)

A remote code execution flaw in the render_image function lets authenticated users who own at least one NextGEN gallery execute code on the server. A Subscriber who was ever granted the 'NextGEN Manage gallery' capability keeps this access even after the capability is revoked. Versions up to and including 4.4.1 are affected (CVE-2026-76010, CVSS 8.8). Update to the latest version and review which users own galleries.

User Frontend (20,000 active installations)

A privilege escalation flaw lets logged-in users with Subscriber access or higher place a registration form for the Editor role in a published post. Any visitor can then use the form to create an Editor account. Versions up to and including 4.3.13 are affected (CVE-2026-120070, CVSS 8.8). Update to the latest version and check for unexpected Editor accounts.

Wp Social Login and Register Social Counter (70,000 active installations)

An authentication bypass in the social login lets unauthenticated attackers log in as any existing user, including administrators. The attacker needs an account with a configured Facebook or Twitter login whose email address matches the target's WordPress email address. Versions up to and including 3.2.2 are affected (CVE-2026-103898, CVSS 8.1). Update to the latest version.

Kirki (400,000 active installations)

A broken access control in the page REST API lets users with Kirki edit access, which the Editor role has by default, change the title, slug and publication status of any post, including posts and WooCommerce products they do not own. This can expose private or draft content or remove published content. Versions before 6.4.1 are affected (CVE-2026-112347, CVSS 7.6). Update to version 6.4.1 or later.

Email Templates Customizer and Designer for WordPress and WooCommerce (20,000 active installations)

An authorization bypass lets unauthenticated attackers read the billing name, address, phone number and email address of WooCommerce customers by enumerating order IDs. Versions up to and including 1.5.14 are affected (CVE-2026-107630, CVSS 7.5). Update to the latest version.

FunnelKit Automations (20,000 active installations)

A time-based SQL injection via the 'bwfan_cart_id' parameter lets unauthenticated attackers extract sensitive information from the database. The payload is submitted during a guest checkout and runs later in a scheduled job. Versions up to and including 3.8.5.2 are affected (CVE-2026-119163, CVSS 7.5). Update to the latest version.

Mail logging & Catcher (20,000 active installations)

A sensitive information exposure lets logged-in users with Subscriber access or higher read administrator password-reset keys from the stored email logs and take over an administrator account. This requires that the default_view_role setting was changed to a capability held by low-privileged users; the default restricts log access to administrators. Versions up to and including 2.2.0 are affected (CVE-2026-120040, CVSS 7.5). Update to the latest version and check this setting.

W3 Total Cache (900,000 active installations)

A stored cross-site scripting flaw via the 'comment' parameter can be exploited by unauthenticated attackers under specific conditions: a previously active Pro license with REST caching, Disk Enhanced page caching, and a previously approved commenter identity. Versions up to and including 2.10.7 are affected (CVE-2026-111254, CVSS 7.2). Update to the latest version.

Ninja Forms (500,000 active installations)

Two flaws affect this plugin. A stored cross-site scripting flaw via the 'formData.extra' parameter can be exploited by unauthenticated attackers in a single request; versions up to and including 3.15.5 are affected (CVE-2026-109997, CVSS 7.2). Incomplete validation of list fields allows unauthenticated attackers to plant CSV formula payloads that take effect when an administrator opens exported submissions; versions before 3.15.4 are affected (CVE-2026-67187, CVSS 7.1). Update to the latest version.

PDF Invoices & Packing Slips for WooCommerce (300,000 active installations)

A stored cross-site scripting flaw via billing address fields and the customer note can be exploited by unauthenticated attackers. It is an incomplete fix for CVE-2026-92244. Versions up to and including 5.16.4 are affected (CVE-2026-107750, CVSS 7.2). Update to the latest version.

Relevanssi – A Better Search (100,000 active installations)

A stored cross-site scripting flaw via comments can be exploited by unauthenticated attackers when both comment indexing and comment highlighting are enabled. Versions up to and including 4.28.5 are affected (CVE-2026-116522, CVSS 7.2). Update to the latest version.

SureCart (80,000 active installations)

A stored cross-site scripting flaw via comments can be exploited by unauthenticated attackers if the comment is approved and appears on a page that loads SureCart's components, such as a page with a Buy Button block. Versions up to and including 4.9.4 are affected (CVE-2026-107653, CVSS 7.2). Update to the latest version.

PPWP – Password Protect Pages (30,000 active installations)

A stored cross-site scripting flaw via comments and shortcode attributes can be exploited by unauthenticated attackers who have had a comment approved before. Versions up to and including 1.9.26 are affected (CVE-2026-116520, CVSS 7.2). Update to the latest version.

Shield Security (30,000 active installations)

A stored cross-site scripting flaw via the request URI lets unauthenticated attackers inject scripts into the traffic log view. Versions up to and including 22.3.2 are affected (CVE-2026-118057, CVSS 7.2). Update to the latest version.

ThirstyAffiliates (30,000 active installations)

A stored cross-site scripting flaw via comments can be exploited by unauthenticated attackers on sites with a block theme, if the attacker has had a comment approved before. Versions up to and including 3.12.1 are affected (CVE-2026-119089, CVSS 7.2). Update to the latest version.

Meow Lightbox (10,000 active installations)

A stored cross-site scripting flaw can be exploited by unauthenticated attackers when Output Buffering, the HtmlDomParser engine and Aggressive Resolve are enabled and the site accepts stored HTML, such as anonymous bbPress replies. Versions up to and including 5.6.4 are affected (CVE-2026-109234, CVSS 7.2). Update to the latest version.

How to check your sites

Open Plugins in the WordPress dashboard of each site and compare the installed versions with the affected versions above. With WP-CLI, run wp plugin list to see installed plugins, their versions and available updates, then update with wp plugin update <plugin-slug>. If no update is available for a plugin you use, deactivate and remove it until a fixed version is released.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-103898
• https://nvd.nist.gov/vuln/detail/CVE-2026-107630