WordPress vulnerabilities hit 362, with 43 unpatched
WordPress vulnerabilities, meaning software weaknesses that may expose a website or its data, totalled 362 in disclosures added to the Wordfence Intelligence Vulnerability Database from September 14 to September 20, 2026. Wordfence attributed the issues to 247 plugins and four themes, with contributions from 186 vulnerability researchers. Of the disclosed flaws, 319 were marked patched and 43 remained unpatched.
The severity breakdown included 18 critical, 74 high, 266 medium and four low-severity vulnerabilities. Wordfence uses the Common Vulnerability Scoring System (CVSS), a standard scale for rating the potential impact and exploitability of security flaws. Cross-site scripting was the largest weakness category, accounting for 94 entries. This type of flaw allows unsafe content to be stored or displayed in a web page. Missing authorization followed with 69 entries, while SQL injection, in which crafted input can interfere with database commands, accounted for 35. Other prominent categories included 27 authorization bypasses involving user-controlled keys, 27 sensitive-information exposures, 19 privilege-management flaws, 13 code-injection issues and 12 dangerous file-upload weaknesses.
A high-severity WordPress Core vulnerability was among the disclosures. WordPress versions up to and including 7.1 were affected by unauthenticated stored cross-site scripting in the wpautop() handling of blockquotes. Unauthenticated means that an attacker would not need to sign in first. The issue, tracked as CVE-2026-93485 with a CVSS score of 7.2, was marked patched. Wordfence said it deployed additional web application firewall protection, which filters potentially harmful website requests, immediately to its Premium, Care and Response customers. Free users were scheduled to receive that protection after 30 days.
Wordfence also deployed a separate rule identified as WAF-RULE-957 but withheld its technical details while working with the relevant vendor on a patch. That means administrators cannot use the public description to identify the affected software. The disclosure should not be confused with the WordPress Core issue, which Wordfence named separately and marked patched.
Eleven of the 18 critical vulnerabilities were listed as patched. They included unauthenticated remote code execution in Advanced Custom Fields: Extended PRO through version 0.9.2.6 and Migratico Lite through version 2.6.8. Remote code execution means that someone can make the server run software commands from elsewhere. Wordfence also recorded critical privilege-escalation flaws in Choose User Role at Registration for WooCommerce through version 1.3.2 and JetFormBuilder through version 3.6.2, plus an unauthenticated file-upload flaw in Gravity Forms through version 3.1.0.4.
Other patched critical entries affected TrueBooker through version 1.2.3, Ultimate Addons for Contact Form 7 versions 3.2.4 through 3.5.50, WooCommerce Online Product Designer through version 2.14.0 and wpShopGermany IT-RECHT KANZLEI through version 2.3. Forminator Forms through version 1.57.2 and WP Recipe Maker through version 10.8.1 were affected by unauthenticated arbitrary shortcode execution, which can cause WordPress to process site instructions supplied through an unsafe input.
Seven critical entries remained unpatched. Admin Menu Editor Pro versions 2.35 through 2.36 were listed as backdoored software. DS Ad Rotator through version 0.8, Multi Uploader for Gravity Forms through version 1.1.9 and WP images upload on piclect through version 1.0 had unauthenticated arbitrary file-upload vulnerabilities. Login with QR through version 1.0.0, Private Feed Key through version 0.1 and The Pressengine through version 1.0 had authentication-bypass flaws, potentially allowing protected access without the normal sign-in check.
The high-severity findings also covered several common website functions. Consulting theme versions through 6.7.16 had a patched privilege-escalation issue available to subscriber-level users. Location Manager through version 2.3.38 and Ni WooCommerce Sales Report through version 4.1.0 had patched unauthenticated SQL-injection flaws. Comparable SQL-injection entries remained unpatched in Album Cover Finder through version 0.7.0, Price Drop Alert for WooCommerce through version 1.1, Product Question and Answer through version 1.1.0, SAMO Forms through version 1.0.0 and Yo versions 1.1 through 1.3.1.
The four themes represented in the weekly totals were Bridge, Consulting, Divi and VW Writer Blog. The much larger plugin list covered forms, ecommerce, booking, membership, page-building, galleries, authentication, caching and other website functions. Site owners therefore need to check installed software by exact product and version rather than assuming that WordPress Core is the only component requiring attention.
Administrators should update every entry marked patched, then deactivate and remove unpatched software unless it is essential and can be isolated while awaiting a fix. They should also review administrator accounts, recently uploaded files and unexpected site changes, especially where a flaw allowed authentication bypass, privilege escalation, code execution or arbitrary file upload. For organisations that prefer not to manage WordPress infrastructure alone, AEU Hosting provides managed WordPress hosting secured end to end.
The figures underline the importance of maintaining an accurate plugin and theme inventory. A component that is installed but no longer actively used can still leave vulnerable code on the server, while a security update cannot help a site until the corrected release is actually installed.