WordPress plugin vulnerabilities: 6 plugins including User Frontend

Seven vulnerabilities in six WordPress plugins were disclosed between 6 and 7 November 2026. The most serious is an incorrect authorization flaw in WP Data Access (CVSS 8.1) that can allow attackers to take over the administrator account. The other six are stored cross-site scripting (XSS) flaws rated CVSS 7.2 that unauthenticated attackers can exploit. None of them is reported as actively exploited.

WP Data Access (10,000 active installations)

The write endpoints of WP Data Access do not enforce the row filters and column restrictions that apply to the read endpoints. Authenticated attackers with Subscriber-level access and above can write to arbitrary rows and columns, including the administrator password in wp_users, and then log in as the administrator. Exploitation requires a published Data App that enables write transactions for subscribers; if such an app allows anonymous access, unauthenticated attackers can exploit it as well. All versions up to and including 5.5.89 are affected (CVE-2026-118267, CVSS 8.1); update to the latest version.

User Frontend (20,000 active installations)

The User Frontend plugin (Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission) contains a stored XSS flaw in the taxonomy field parameter that unauthenticated attackers can use to inject scripts into pages. Exploitation requires a Taxonomy field in text-input mode and guest post submission enabled on at least one frontend form. All versions up to and including 4.3.13 are affected (CVE-2026-109214, CVSS 7.2); update to the latest version.

WP Visitor Statistics (Real Time Traffic) (20,000 active installations)

Two stored XSS flaws allow unauthenticated attackers to inject scripts through the public visitor tracking endpoint. The scripts execute in the administrator's browser when the statistics are viewed. CVE-2026-109230 (the 'browser' parameter) affects versions up to and including 8.7.1, and CVE-2026-111370 (the 'os', 'browser' and 'res' parameters) affects versions up to and including 8.9.0, both rated CVSS 7.2. Update to the latest version, which must be newer than 8.9.0, or deactivate and remove the plugin if no such update is available.

GeoDirectory (10,000 active installations)

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory contains a stored XSS flaw in the 'post_content' parameter. Unauthenticated attackers can use nested shortcodes to bypass the plugin's shortcode filtering and inject scripts. All versions up to and including 2.8.200 are affected (CVE-2026-120082, CVSS 7.2); update to the latest version.

Graphina – Charts and Graphs For Elementor (9,000 active installations)

Graphina contains a stored XSS flaw in chart settings such as the tree chart node font family. According to the advisory, unauthenticated attackers can inject scripts that Elementor's sanitization does not remove. All versions up to and including 3.1.13 are affected (CVE-2026-110291, CVSS 7.2); update to the latest version.

Flying Images (2,000 active installations)

Flying Images: Optimize and Lazy Load Images for Faster Page Speed contains a stored XSS flaw in the 'comment' parameter that unauthenticated attackers can exploit. With default settings, a first comment needs approval, but later comments from the same name and email bypass moderation, and the injected script runs for every visitor, including administrators. All versions up to and including 2.4.15 are affected (CVE-2026-119175, CVSS 7.2); update to the latest version.

How to check your sites

Open Plugins > Installed Plugins in the WordPress dashboard of each site and look for the plugins listed above and their version numbers. With WP-CLI, run "wp plugin list" to see installed plugins, their versions and available updates, then update with "wp plugin update ". The slugs are wp-data-access, wp-user-frontend, wp-stats-manager, geodirectory, graphina-elementor-charts-and-graphs and nazy-load. If no fixed version is available for a plugin you use, deactivate and remove it until an update is released.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-109214
• https://nvd.nist.gov/vuln/detail/CVE-2026-109230