200 WordPress Plugin Security Holes in One Week: Is Your Site on the List?

In just six days, security researchers published hundreds of new problems in popular WordPress plugins. Most already have a fix, but a few do not. This guide explains the list in plain words and shows you exactly how to check your site.

What is this list?

Every day, researchers find security mistakes in WordPress plugins. A plugin is an add-on, like a contact form, a shop tool or an SEO helper. When a mistake is found, it gets a public ID number called a CVE, and the plugin’s makers are told to release a fixed version.

The website Plugin Pulse, run by WP Mayor, collects these reports in one place. It shows what the problem is, which versions have it, and which version fixes it. The list we looked at shows 200 recent entries, dated from October 29 to November 3, 2026. The records come from Wordfence Intelligence.

How to read one entry

Each entry looks scary at first, but it follows one simple pattern.

The scariest ones this week

These are marked Critical, the highest level. Most of them need no login at all, which means a stranger on the internet could try them. All have a fixed version, so the cure is simply to update.

Which plugins have no fix yet?

This is the part that needs your attention. In the list, these plugins were marked “No patch available”, so you cannot fix them by updating:

What do the scary words mean?

You will see the same few problem types again and again. Here they are in simple language.

• Cross-Site Scripting (XSS): an attacker hides a small harmful script in a comment, form or link. When you or your visitors view it, the script runs. This was by far the most common type in the list.
• Missing authorization: a door that should be locked is left open. Someone with no permission can still use an action meant for admins.
• SQL injection: an attacker sneaks database commands into a form field or web address and can read or change your site’s data.
• PHP object injection: a sneaky way of feeding a plugin booby-trapped data so it does something it should not.
• Remote code execution (RCE): the worst case. An attacker makes your server run their own code, which can mean full control of your site.
• Privilege escalation and authentication bypass: a normal visitor becomes an admin, or skips the login completely.

You may also see words like “Subscriber+” or “Contributor+”. This tells you who needs an account to use the trick. “Subscriber+” means any logged-in member. “Unauthenticated” means no account at all, and that is the more dangerous kind.

Popular names on the list

These are widely used plugins. Each one already has a fixed version, but your site is exposed until you update:

• Easy Digital Downloads (up to 3.7.2): a stranger could take over an administrator account through guest checkout. Fixed in 3.7.3. Wordfence record.
• SureCart (up to 4.9.5): account takeover without logging in. Fixed in 4.9.6. Wordfence record.
• Formidable Forms (up to 6.35): a logged-in subscriber could install any plugin. Fixed in 7.0. Wordfence record.
• Essential Addons for Elementor (up to 6.8.7): a stranger could raise their permissions. Fixed in 6.8.8. Wordfence record.
• W3 Total Cache, Ninja Forms, The Events Calendar, Gravity Forms, and many more also have new fixed versions.

How to check and fix your site

Step 1: Make a backup

Updates are usually safe, but a backup means you can undo any problem. With WP-CLI (a free tool for managing WordPress from the command line), you can save your database like this:

wp db export backup-before-updates.sql

Also copy your wp-content folder, or use your host’s backup button.

Step 2: See what you have and what needs updating

This shows every plugin, its version, and the new version available:

wp plugin list –fields=name,status,version,update_version

To see only plugins that have an update waiting:

wp plugin list –update=available

No command line? Open your WordPress dashboard and go to Dashboard → Updates. Compare your version with the “Affects <=” number in the list above.

Step 3: Update

Update one plugin, for example the first one on the critical list. Replace plugin-slug with the plugin’s folder name from the list in Step 2:

wp plugin update plugin-slug

Or update everything at once, then check that your site still works:

wp plugin update –all

It is also wise to update WordPress itself:

wp core update

Step 4: Remove plugins that have no fix, or that you do not use

wp plugin deactivate plugin-slug
wp plugin delete plugin-slug
wp plugin list –status=inactive

The last line lists switched-off plugins. Switched-off plugins can still be attacked, so delete the ones you do not need.

Step 5: Turn on automatic updates

Most of the plugins on this list were fixed within days. If your site updates itself, you are protected without lifting a finger. For plugins you trust, you can switch this on with:

wp plugin auto-updates enable –all

Check your shop or forms after big updates, since a rare update can break a feature.

Step 6: Look for signs of a break-in

If one of your plugins was on the critical list and you updated late, take a quick look around:

wp user list –role=administrator
wp core verify-checksums
find media -type f -name “*.php”

You should only see admin users you know. The checksum command should report no changed WordPress files, and the last command should find no PHP files inside uploads. If something looks wrong, change your passwords, restore a clean backup, and ask for help.

The lesson

Seeing 200 problems in six days can feel like too much, but it is normal for a busy ecosystem. It does not mean WordPress is unsafe. It means plugins need regular care. A few simple habits keep you ahead of nearly all of these attacks:

• Update quickly. A fixed version only helps once you install it. Once a problem is public, attackers know exactly where to look.
• Use fewer plugins. Every plugin is another door. Delete the ones you do not need.
• Pick well-maintained plugins. Check how recently a plugin was updated and how fast its makers fix problems.
• Keep backups away from your server. That way, you can always recover.

200 WordPress Plugin Security Vulnerabilities – FAQs