SYNCTECH
Sign in
Plugin and theme security · · by the Synctech team

WordPress plugin security: FormFlow, Relevanssi and 11 more

WordPress plugin security: FormFlow, Relevanssi and 11 more

Thirteen WordPress plugins released security fixes in October 2026, listed by Patchstack on 31 October. The most serious, in FormFlow and WP Directory Kit, need no login. Two payment plugins let a visitor tamper with order payments. None was reported as attacked when we checked. If you use any of them, update this week.

Which plugins should I update first?

Plugin What Patchstack lists Safe version
FormFlow (SimpleForm) A visitor could upload files to the site without logging in 3.11.0
WP Directory Kit A visitor could reach the site database without logging in 1.6.1
Payable Payment Gateway for WooCommerce Order payments could be faked by a visitor 1.3.1
Premium Packages (WP Download Manager) A visitor could change an order total 7.2.2, current 7.3.2
NextGEN Gallery A user with special gallery rights could run code on the site 4.5.0, current 4.5.5
Security Optimizer by SiteGround Two-step login could be skipped by a logged-in user 1.6.9

Script holes that need no login

In these plugins a visitor could plant a script that later runs when an admin or customer opens a page:

Plugin Safe version
Relevanssi (site search) 4.28.6, current 4.28.8
WP Activity Log 5.6.2, current 5.6.8
Debug Log Manager 2.5.3
FeedWordPress 2026.1016, current 2026.1030

Private content shown to visitors

  • Quick Event Manager 8.4.6 to 9.18 could show private and draft events. Update to 9.19 or newer.
  • All-in-One Video Gallery before 5.0.0 could show private and draft videos. Update to 5.0.0.
  • Payment Forms for Paystack before 4.0.6 let contributors see payment details. Update to 4.0.6 or newer.

PDF Invoices and Packing Slips, Essential Addons for Elementor and Firelight Lightbox were also listed again this week. The safe versions are in our 31 October plugin update.

What to do

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Compare the names with the tables above. Note the version shown under each plugin.
  3. Take a backup, then update one plugin at a time. After each one, test your contact form, search box or checkout.
  4. If you use FormFlow, WP Directory Kit or a payment plugin above and cannot update today, switch it off until you can.
  5. Delete plugins you no longer use. A switched-off plugin still sits on the server.

How SyncTech can help

If someone else maintains your site, forward this list to them today. Plugin checks and safe updates are part of our WordPress maintenance and care plans, and our help centre shows how to reach us if a site already looks changed.

Source and credit

We are sharing this news from Patchstack and the plugin makers. This summary is written by Synctech in our own words.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.