WordPress plugin security: ACF, CleanTalk, Optimole and 3 more

Six WordPress plugins used on many business sites have security holes that an attacker can use without logging in. They include Advanced Custom Fields (ACF), CleanTalk anti-spam, Optimole and TranslatePress, plus two WooCommerce add-ons where the hole is more serious. Fixed versions are out for all six. Log in to your WordPress dashboard and update them today.

Which plugins are affected?

Versions were checked on wordpress.org on 7 November 2026.

How serious is it?

Patchstack, the security firm that listed these holes, rates the four cross-site scripting holes as medium. An attacker can save harmful code on your site, but it runs only when an admin or visitor opens the affected page or link. That can be enough to take over an admin login.

The Payever and Printcart holes are rated high (Patchstack gives them its top score of 10). They let anyone upload a file to the site, and in Payever's case that file can run as code. A site with either plugin can be fully taken over. Patchstack expects holes like these to be used in mass attacks. None was reported as being used yet when we checked.

What to do

1. Log in to WordPress, go to Plugins and look for the six names above.
2. Update each one to the version in the table, or newer.
3. If you use Payever or Printcart and cannot update today, switch the plugin off until you can.
4. Delete plugins you no longer use instead of just turning them off.
5. Take a backup with your own backup plugin before you update, or ask your developer to do it.

The rest of this week's smaller plugin holes will be in our Friday WordPress round-up on 13 November.

How SyncTech can help

Many business sites are looked after by their own web developer, so please pass this to whoever looks after yours. If nobody does, our WordPress website care plan includes plugin updates and checks after each update.

Source and credit

We are sharing this news from Patchstack and WordPress.org. This summary is written by Synctech in our own words.

• WordPress Advanced Custom Fields plugin below 6.8.11, unauthenticated stored XSS (CVE-2026-110813), Patchstack: https://patchstack.com/database/wordpress/plugin/advanced-custom-fields/vulnerability/wordpress-advanced-custom-fields-acf-plugin-6-8-11-unauthenticated-stored-xss-vulnerability
• WordPress CleanTalk plugin below 6.91, unauthenticated stored XSS (CVE-2026-115673), Patchstack: https://patchstack.com/database/wordpress/plugin/cleantalk-spam-protect/vulnerability/wordpress-anti-spam-spam-firewall-by-cleantalk-plugin-6-91-unauthenticated-stored-xss-vulnerability
• WordPress Optimole plugin 4.2.18 and older, unauthenticated stored XSS (CVE-2026-120739), Patchstack: https://patchstack.com/database/wordpress/plugin/optimole-wp/vulnerability/wordpress-optimole-optimize-images-convert-webp-avif-cdn-lazy-load-image-optimization-plugin-4-2-18-unauthenticated-stored-cross-site-scripting-vulnerability-2
• WordPress TranslatePress plugin 3.3.8 and older, unauthenticated stored XSS (CVE-2026-119167), Patchstack: https://patchstack.com/database/wordpress/plugin/translatepress-multilingual/vulnerability/wordpress-translatepress-translate-multilingual-sites-with-ai-translation-plugin-3-3-8-unauthenticated-stored-cross-site-scripting-vulnerability
• WordPress Payever WooCommerce Gateway plugin 4.8.0 and older, unauthenticated file upload (CVE-2026-93754), Patchstack: https://patchstack.com/database/wordpress/plugin/payever-woocommerce-gateway/vulnerability/wordpress-payever-checkout-composable-payment-gateway-plugin-4-8-0-unauthenticated-arbitrary-file-upload-leading-to-remote-code-execution-vulnerability
• WordPress Printcart plugin 2.13.2 and older, unauthenticated file upload (CVE-2026-19803), Patchstack: https://patchstack.com/database/wordpress/plugin/printcart-integration/vulnerability/wordpress-printcart-store-web-to-print-product-designer-for-woocommerce-plugin-2-13-2-unauthenticated-arbitrary-file-upload-vulnerability
• Plugin pages and current versions, WordPress.org Plugin Directory: https://wordpress.org/plugins/

Retrieved 7 November 2026. WordPress, WooCommerce and the plugin names are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.