WordPress plugin vulnerabilities: 10 plugins, including Welcart e-Commerce

Vulnerabilities have been disclosed in ten WordPress plugins, most of them in the last days of October 2026. Nearly all of them can be exploited by unauthenticated attackers. The most serious is a remote code execution flaw in Project Manager with a CVSS score of 9.8. None of the vulnerabilities is listed as actively exploited, but we recommend checking all sites that use these plugins.

Project Manager – AI Powered Project Management (5,000 active installations)

The plugin is vulnerable to remote code execution via the 'id' parameter of a REST route, which unauthenticated attackers can use to execute code on the server, because the vulnerable validation runs before the permission check. All versions up to and including 4.1.1 are affected. The vulnerability is tracked as CVE-2026-116512 with a CVSS score of 9.8. Update to the latest version immediately; if no update is available on a site, deactivate and remove the plugin.

Rox Appointment Booking (2,000 active installations)

A mass assignment flaw in the public booking REST endpoint lets unauthenticated attackers store an arbitrary WordPress user ID with an email address of their choice. When an administrator opens and saves the poisoned customer record, the targeted account's email address is overwritten, which allows account takeover via password reset. All versions up to and including 1.3.1 are affected (CVE-2026-104012, CVSS 8.8). Update to the latest version, or deactivate and remove the plugin if no update is available.

WP Directory Kit (2,000 active installations)

The plugin is vulnerable to SQL injection via the 'idfield' parameter, allowing unauthenticated attackers to extract sensitive information from the database. All versions up to and including 1.6.0 are affected (CVE-2026-109197, CVSS 7.5). Update to the latest version, or deactivate and remove the plugin if no update is available.

MembershipWorks (2,000 active installations)

An information disclosure flaw allows unauthenticated attackers to read member-only content through the WordPress REST API, bypassing the plugin's content protection. Versions before 6.17 are affected (CVE-2026-112355, CVSS 7.5). Update to version 6.17 or later.

Welcart e-Commerce (10,000 active installations)

Unauthenticated visitors can store malicious scripts via the 'gid' parameter by forging a ROBOT PAYMENT return request; the script runs when an administrator opens the affected order. All versions up to and including 2.12.5 are affected (CVE-2026-118070, CVSS 7.2). Update to the latest version.

WPO365 | Microsoft 365 Graph Mailer (10,000 active installations)

The plugin is vulnerable to stored cross-site scripting via the mail subject, which unauthenticated attackers can supply through forms such as Contact Form 7 when the Graph Mailer is enabled but OAuth authorization has not been completed. All versions up to and including 6.2 are affected (CVE-2026-107759, CVSS 7.2). Update to the latest version.

User Submitted Posts (10,000 active installations)

Unauthenticated attackers can inject scripts via the 'user-submitted-content' parameter (stored DOM-based cross-site scripting). By default submissions need approval, but with the "publish immediately" option enabled the payload goes live without moderation. All versions up to and including 20260916 are affected (CVE-2026-119162, CVSS 7.2). Update to the latest version.

Debug Log Manager (10,000 active installations)

The plugin is vulnerable to stored cross-site scripting via the 'message' and 'pageUrl' parameters, exploitable by unauthenticated attackers when debug logging with JS error logging is enabled. All versions up to and including 2.5.2 are affected (CVE-2026-120114, CVSS 7.2). Update to the latest version, and disable JS error logging if you do not need it.

FeedWordPress (8,000 active installations)

Syndicated RSS/Atom content is imported without proper filtering, so an attacker who controls a feed the site already subscribes to can inject scripts (stored cross-site scripting). Versions up to and including 2026.0517 are affected (CVE-2026-110530, CVSS 7.2). Update to the latest version and review which external feeds your sites subscribe to.

VikRentCar Car Rental Management System (4,000 active installations)

Two stored cross-site scripting flaws allow unauthenticated attackers to inject scripts: one via the 'poplink' parameter in versions up to and including 1.4.9 (CVE-2026-115840), and one via the 'optionals' parameter in versions up to and including 1.4.10 (CVE-2026-116548). Both have a CVSS score of 7.2. Update to the latest version, or deactivate and remove the plugin if no update is available.

How to check your sites

In the WordPress dashboard, open Plugins > Installed Plugins and look for the plugins listed above and their version numbers. With WP-CLI, run "wp plugin list" to see installed plugins, their versions and available updates, then update with "wp plugin update ". Where no fixed version is available, deactivate and remove the plugin until the developer releases an update.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-104012
• https://nvd.nist.gov/vuln/detail/CVE-2026-107759