WordPress plugin vulnerabilities: 7 plugins including NextGEN Gallery

Eight vulnerabilities in seven WordPress plugins were disclosed between 10 and 13 November 2026. The most serious, with a CVSS score of 8.8, affect Widget Options and SureDash. The most widely used plugin in this list is NextGEN Gallery with 300,000 active installations. None of the vulnerabilities is reported as actively exploited.

Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets (100,000 active installations)

A code injection flaw allows logged-in users with Author-level access and above to inject PHP expressions that run on every front-end page view, which can expose site configuration data and can escalate to unrestricted code execution if another plugin extends the allowed function list. Contributors can also exploit it if an administrator or editor later publishes their submission. All versions up to and including 4.2.6.1 are affected (CVE-2026-116615, CVSS 8.8). Update to the latest version, or deactivate and remove the plugin if no update is available.

SureDash – Community, Courses & Member Dashboard (1,000 active installations)

A privilege escalation flaw lets logged-in users with the Portal Manager role and above change the default role for new registrations to administrator and then register a full administrator account. All versions up to and including 1.13.0 are affected (CVE-2026-123769, CVSS 8.8). Update to the latest version, and review the user list and the plugin's default role setting for unexpected changes.

Everest Forms (90,000 active installations)

Two flaws affect this plugin. CVE-2026-120513 (CVSS 8.2) allows unauthenticated visitors to delete files within wp-content/uploads in versions up to and including 3.6.2, provided the Save-and-Continue addon is active and the target form has 'Disable storing entry information' enabled. CVE-2026-115483 (CVSS 7.5) allows unauthenticated visitors to read arbitrary files such as wp-config.php in versions up to and including 3.6.3; it requires the Everest Forms Pro add-on and a form with file attachments enabled and a signature-type field. Update to the latest version, which must be newer than 3.6.3.

Drag and Drop File Upload for Elementor Forms (1,000 active installations)

An arbitrary file deletion flaw in the remove_files function allows unauthenticated visitors to delete files on the server, which can lead to remote code execution if a file such as wp-config.php is deleted. It is reachable when the "yeepdf_not_save" privacy option is enabled. All versions up to and including 1.6.2 are affected (CVE-2026-124218, CVSS 8.2). Update to the latest version.

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (300,000 active installations)

An arbitrary file deletion flaw in the handle_job function allows logged-in users with the 'NextGEN Manage gallery' capability to delete files on the server, which can lead to remote code execution if a file such as wp-config.php is deleted. This capability belongs to administrators by default but can be delegated to lower roles on the plugin's Roles screen. All versions up to and including 4.5.5 are affected (CVE-2026-118191, CVSS 8.1). Update to the latest version and check which roles have been granted this capability.

Ultra Addons for Contact Form 7 (60,000 active installations)

A directory traversal flaw allows unauthenticated visitors to read arbitrary files on the server, which can contain sensitive information. Exploitation requires the PDF Generator addon to be active and a PDF body template to be enabled for the targeted form. All versions up to and including 3.5.54 are affected (CVE-2026-100386, CVSS 7.5). Update to the latest version, or deactivate and remove the plugin if no update is available.

Gutenverse Form (10,000 active installations)

A CSV formula injection flaw allows unauthenticated visitors to store spreadsheet formulas through form submissions, which execute when an administrator opens an exported CSV file and can lead to data exfiltration or command execution on the administrator's workstation. Versions before 3.2.2 are affected (CVE-2026-124018, CVSS 7.1). Update to version 3.2.2 or later, and treat previously exported CSV files with care.

How to check your sites

In the WordPress dashboard, open Plugins > Installed Plugins on each site and compare the installed versions with those listed above. With WP-CLI, run wp plugin list to see all plugins with their versions and available updates, then update with wp plugin update <plugin-slug>. Where a plugin is installed but not needed, deactivate and remove it.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-100386
• https://nvd.nist.gov/vuln/detail/CVE-2026-115483