WordPress and WooCommerce Plugin Vulnerabilities

Most WordPress vulnerabilities are found in plugins, not the core. This page collects fresh vulnerabilities in plugins and WooCommerce extensions: for each one you see the affected versions, how to check your site and what to update. If a plugin is visible from outside, Shield detects its version when it checks your site.

All 92 Articles 49 News 43 Threats 30
All notes ✅ Checked by Shield · Checked only Check your site in Shield
What the badges mean
✅ Checked by Shield Shield already looks for this in site checks: it will find it and show it in the report.
⏳ Not checked yet Not visible from outside yet, or not added to the checks: check it yourself using the note.
Check your site in Shield →
November 1, 2026 🔴 Critical ✅ Checked by Shield
FunnelKit Automations: untrusted deserialization (CVE-2026-39738)
October 31, 2026 🔴 Critical ✅ Checked by Shield
PDF Invoice for WooCommerce: PHP Object Injection (CVE-2026-109220)
October 31, 2026 🔴 Critical ✅ Checked by Shield
Project Manager for WordPress: remote code execution (CVE-2026-116512)
October 30, 2026 🔴 Critical ✅ Checked by Shield
Gravity Forms: PHP Object Injection (CVE-2026-103039)
October 29, 2026 🔴 Critical ✅ Checked by Shield
Frontend Dashboard and ProfileGrid: PHP object injection (CVE-2026-103693)
October 29, 2026 🔴 Critical ✅ Checked by Shield
Chat AI with Dispatcher: arbitrary file upload (CVE-2026-115245)
October 28, 2026 🔴 Critical ✅ Checked by Shield
Jupiter X Core: authentication bypass via Twitter/X login (CVE-2026-106013)
October 28, 2026 🔴 Critical ✅ Checked by Shield
Pie Register Premium: unauthenticated unrestricted file upload (CVE-2026-84999)
October 28, 2026 🔴 Critical ✅ Checked by Shield
FunnelKit Automations: Blind SQL Injection (CVE-2026-111411)
October 26, 2026 🔴 Critical ✅ Checked by Shield
rtMedia: Blind SQL Injection (CVE-2026-66592)
October 25, 2026 🔴 Critical ✅ Checked by Shield
Booster for WooCommerce: customer arbitrary file upload (CVE-2026-56027)
October 25, 2026 🔴 Critical ✅ Checked by Shield
BuddyBoss Platform: Subscriber PHP Object Injection (CVE-2026-56032)
Free · no sign-up

How many clicks is your site missing?

The SEO Radar shows in a minute which pages sit near the top of Google and what keeps them from moving up.

An estimate from positions, not a promise
First publication freeA link on a trusted site after sign-up. Cascades from $30.Claim ShieldCheck your site for hacks and malicious code.Check Keyword StudioQueries, volumes and clusters for your article.Open AppProjects and reports in your pocket, iOS and Android.Download
SEO tools
SEO Audit Backlinks Trust Speed AI Detector Humanizer All 120+
New articles by email