SYNCTECH
Sign in
Plugin and theme security · · by the Synctech team

WordPress plugin security round-up: 24 to 30 October 2026

WordPress plugin security round-up: 24 to 30 October 2026

Makers of more than 30 WordPress plugins fixed security holes between 24 and 30 October 2026. Gravity Forms and AI Engine are the most serious, and some holes need no login. None was reported as attacked when we checked. Compare the list below with your site and update this week.

Gravity Forms and AI Engine: update first

Patchstack lists two holes in Gravity Forms 3.1.2 and older that need no login. One lets a visitor plant a script through a form, the other can let an attacker push harmful data into the site. Gravity Forms added security fixes in 3.1.3 and again in 3.2.1 (28 October). Update to 3.2.1 from the WordPress Updates page.

In AI Engine 3.8.6 and older, a missing permission check could let a lower-level account take over an administrator account. Version 3.8.8 (27 October) blocks shop managers from editing admin accounts through the AI tools, stops guests from resetting their usage limits, and closes several smaller leaks. If you use AI Engine for a website chatbot, update to 3.8.8.

Forms, members and sign-up plugins

Plugin Problem Safe version
Profile Builder A registration form could give a user a role they should not get 4.0.6
NEX-Forms Script planted through uploaded file details 9.3.3
MW WP Form Visitors could read form data they should not see 5.1.8
Strong Testimonials Script planted through a testimonial 3.3.16
Kit (formerly ConvertKit) Members-only content showed in feeds, search and the shop 3.4.8
Page Restriction WordPress Restricted posts showed on the blog and archive pages 1.6.2
SureDash Permission and script holes 1.12.4
LogixFast Auth Login codes could go to the wrong email 1.0.4
Community Events Script planted by visitors 1.6.0

Online shops

Plugin Problem Safe version
WPFunnels Upsell offers could be changed to any product or price 3.13.6
YITH PayPal Express Checkout for WooCommerce Missing permission check 1.62.1 or newer
Custom Price for WooCommerce Cart data could change product prices 1.1.30
Flexible Quantity for WooCommerce Measurement checks could be skipped 2.3.25 or newer
NewsmanApp Script planted through order details 3.7.32

Food Store (online food delivery and pickup) has been closed on WordPress.org. No safe version is listed, so remove it and pick another ordering plugin.

Page builders and other plugins

  • Elementor add-ons: Happy Addons fixed a Mailchimp widget hole in 3.51.0, The Plus Addons hardened many widgets in 6.6.0, and Greenshift fixed a stored script hole in 13.2.2.
  • Kirki 6.4.1 stops author accounts from changing other users' posts.
  • LiteSpeed Cache: Patchstack lists a script hole in 7.9.1 and older. Version 7.9.2 hardens how pages are rewritten, so update to 7.9.2.
  • Media Library Assistant 3.44 closes two data exposure holes.
  • myCred 4.0.3, WP ERP 1.17.11, EventPrime 4.3.6.1, Events Made Easy 3.3.2 and JoomSport 5.7.15 fix permission, database or script holes.
  • Mapster WP Maps 2.0.6, Extension for Leaflet Map 6.0, Feedzy 5.2.13, StreamCast 2.4.7, Flash and HTML5 Video 2.14.1, Chat AI with Dispatcher 2.4 and Document Library Lite 1.3.2 also carry security fixes.

What to do

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Look for the names above and compare the version under each one.
  3. Take a backup first. Then update one plugin at a time and open your contact forms, checkout and member pages after each update.
  4. Remove Food Store and any plugin you no longer use.
  5. On a shop, look at orders from the last two weeks for odd prices or products.

If a web designer looks after your site, forward this page to them. Plugin updates like these are part of our WordPress website care plans, and our guide on what website maintenance includes lists the monthly checks.

Source and credit

We are sharing this news from the plugin makers and from Patchstack. This summary is written by Synctech in our own words.

Retrieved 30 October 2026. WordPress, WooCommerce, Elementor and the plugin names above are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.