WordPress plugin vulnerabilities: 13 plugins including TranslatePress

Vulnerabilities have been disclosed in 13 WordPress plugins, most of them on 7 November 2026. The most serious is an authentication bypass in the LatePoint appointment booking plugin (CVSS 9.1), which lets unauthenticated attackers take over customer accounts. The most widely used affected plugin is TranslatePress with 400,000 active installations. None of the vulnerabilities is reported as actively exploited at this time.

LatePoint (100,000 active installations)

The Appointment Booking Plugin – LatePoint is vulnerable to an authentication bypass that allows unauthenticated attackers to overwrite a customer's password and take over the account, including bookings, orders and personal data. When the option to use WordPress users as customers is enabled, the linked WordPress account can be taken over as well. All versions up to and including 5.7.6 are affected (CVE-2026-118066, CVSS 9.1). Update to the latest version; if no fixed version is available for your site, deactivate and remove the plugin.

Amelia (90,000 active installations)

Amelia contains two flaws in versions up to and including 9.9.1. A time-based SQL injection via the tag[] parameter allows unauthenticated attackers to extract sensitive information from the database (CVE-2026-116751, CVSS 7.5). A missing authorization check allows logged-in users with the Amelia customer role to export the full attendee list with personal data for any event (CVE-2026-107616, CVSS 7.5). Update to the latest version, or deactivate and remove the plugin if no update is available.

FunnelKit Payment Gateway for Stripe WooCommerce (20,000 active installations)

An insecure direct object reference allows unauthenticated attackers to read billing data of any store order, including name, email address, phone number and street address, by enumerating order IDs. All versions up to and including 1.15.0.2 are affected (CVE-2026-109991, CVSS 7.5). Update to the latest version, or deactivate and remove the plugin if no update is available.

wpForo Forum (20,000 active installations)

wpForo has three vulnerabilities. A time-based SQL injection via the href[locale] parameter is exploitable by unauthenticated visitors in versions up to and including 3.2.2 (CVE-2026-119155, CVSS 7.5), and a privilege escalation lets logged-in subscribers with at least three approved forum posts become wpForo administrators in the same versions (CVE-2026-119164, CVSS 7.5). A further SQL injection via the data parameter affects versions up to and including 3.2.1 when certain searchable form fields are configured (CVE-2026-95870, CVSS 7.5). Update to the latest version.

TranslatePress (400,000 active installations)

Two stored cross-site scripting flaws via comments allow unauthenticated attackers to inject scripts into pages, in some cases after a previous comment from the same name and email has been approved and a secondary language is configured. All versions up to and including 3.3.8 are affected (CVE-2026-119167 and CVE-2026-120537, both CVSS 7.2). Update to the latest version.

Unlimited Elements for Elementor (300,000 active installations)

A stored cross-site scripting flaw allows unauthenticated attackers to inject scripts through the content of an RSS feed they control, if an administrator has placed the RSS Feed widget pointing at that feed. All versions up to and including 2.0.26 are affected (CVE-2026-116558, CVSS 7.2). Update to the latest version.

Optimole (200,000 active installations)

Optimole has three stored cross-site scripting flaws that unauthenticated attackers can exploit, two via comments and one via a REST endpoint whose required signature is exposed on public pages. CVE-2026-119070 affects versions up to and including 4.2.17, while CVE-2026-120677 and CVE-2026-120739 affect versions up to and including 4.2.18 (all CVSS 7.2). Update to the latest version.

iubenda (200,000 active installations)

The iubenda All-in-one Compliance plugin is vulnerable to stored cross-site scripting through comments, exploitable by unauthenticated attackers after a first comment of theirs has been approved. Versions up to and including 3.13.6 are affected (CVE-2026-120540, CVSS 7.2). Update to the latest version.

Download Manager (90,000 active installations)

A stored cross-site scripting flaw in the registration fields allows unauthenticated attackers to inject scripts, provided public registration is enabled, the plugin's registration form is published and certain packages use the Spotlight link template. All versions up to and including 7.5.9 are affected (CVE-2026-119156, CVSS 7.2). Update to the latest version.

CTX Feed – Product Feed Manager for WooCommerce (90,000 active installations)

A PHP code injection flaw allows logged-in users with Shop Manager access or higher to execute arbitrary PHP code on the server, which can lead to full site takeover; the relevant option is enabled by default. All versions up to and including 8.0.26 are affected (CVE-2026-87964, CVSS 7.2). Update to the latest version, or deactivate and remove the plugin if no update is available, and review which accounts hold the Shop Manager role.

JetFormBuilder (80,000 active installations)

Two stored cross-site scripting flaws allow unauthenticated attackers to inject scripts through form submissions on forms with specific configurations. CVE-2026-111317 affects versions up to and including 3.6.7, and CVE-2026-119183 affects versions up to and including 3.6.8 (both CVSS 7.2). Update to the latest version.

Strong Testimonials (80,000 active installations)

A stored cross-site scripting flaw via the star_rating parameter allows unauthenticated attackers to inject scripts that run when an administrator previews a pending testimonial. All versions up to and including 3.3.16 are affected (CVE-2026-115811, CVSS 7.2). Update to the latest version.

Form Maker by 10Web (30,000 active installations)

A stored cross-site scripting flaw in hidden form fields allows unauthenticated attackers to inject scripts that run when an administrator opens the map link of a submission. All versions up to and including 1.15.50 are affected (CVE-2026-120512, CVSS 7.2). Update to the latest version.

How to check your sites

Open the Plugins page in the WordPress dashboard of each site and look for the plugins listed above and their installed versions. With WP-CLI, run "wp plugin list" to see installed plugins, their versions and available updates, and "wp plugin update " to update a single plugin. Where no fixed version is offered, deactivate and remove the plugin until the developer publishes an update.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-107616
• https://nvd.nist.gov/vuln/detail/CVE-2026-109991