SYNCTECH
Sign in
Plugin and theme security · · by the Synctech team

WordPress plugin security round-up: 31 Oct to 6 Nov 2026

WordPress plugin security round-up: 31 Oct to 6 Nov 2026

Patchstack listed security holes in more than 20 WordPress plugins between 31 October and 6 November 2026. Most already have a fixed version on WordPress.org. Two backup plugins found on many business sites, Duplicator and WPvivid, are on the list. Three plugins have no fix at all, so remove them. None of these was reported as attacked when we checked.

Which plugins have no fix?

Patchstack lists no official fix for these, and we could not find them on WordPress.org when we checked on 6 November:

  • Ultimate Security For WooCommerce (IP Restriction, Password Policy and More) 1.0.10 to 1.0.16: a visitor without a login could gain higher rights on the site. Patchstack scores it 9.8 out of 10.
  • Slim Jetpack 2.7.0.1 and older: a visitor could plant a script on the site.
  • Remove Google Fonts (Bunny Fonts) 1.7 and older: a visitor could plant a script on the site.

If you use any of them, switch it off and remove it, then pick a maintained plugin that does the same job.

Backup plugins: Duplicator and WPvivid

Duplicator and Duplicator Pro before 5.1.0 have a hole where a crafted link could run a script in the browser of a logged-in admin. WordPress.org now lists Duplicator 5.1.1, so update to that.

WPvivid Backup and Migration before 0.9.138 had a hole that an administrator account could use to reach files outside the plugin's own folders. Version 0.9.138 fixed it, and 0.9.139 fixes an install problem in 0.9.138, so go straight to 0.9.139.

Holes that need no login

Plugin What Patchstack lists Safe version
Form Maker by 10Web A visitor could plant a script through a form 1.15.51
Booking Package A booking could skip payment 1.7.34, current 1.7.44
MembershipWorks A membership or event payment could be skipped 6.17
My Calendar 3.8.8 to 3.8.10 A visitor could make the site run shortcodes 3.8.11, current 3.8.13
WP Event Manager A visitor could overwrite unpublished event posts 3.4.2
Stape Conversion Tracking (GTM Server Side) The site could be made to fetch other addresses 2.3.11
Kirki The reCAPTCHA check on forms could be skipped 6.2.5, current 6.4.1

For the booking and membership plugins, compare recent paid orders with your payment provider's records after you update.

Patchstack also published an entry for an old 2017 hole in Woody ad snippets, now called Woody Code Snippets, with "update to 3.3.1" as the fix. The current version on WordPress.org is 2.7.10, so the version numbers do not match. If you use Woody, keep it on the latest version and ask the maker, Themeisle, if you are unsure.

Holes that need a logged-in user

These matter most on sites where staff, writers, members or customers have their own logins.

Plugin What Patchstack lists Safe version
GiveWP A user could give new donors a higher role 4.19.1.1
Import and export users and customers A user with a custom role could raise their rights 2.5.12, current 2.5.13
Redux Framework Script planted through profile and other fields 4.5.17
Customer Reviews for WooCommerce Contributor could plant a script 5.127.0
Simple CAPTCHA with Cloudflare Turnstile Contributor could plant a script 1.44.4, current 1.44.5
Easy Social Icons Author could plant a script through an SVG icon 4.0.3
Permalink Manager Lite Author could plant a script through a URL 2.6.2
YaySMTP Admin-only database hole in the email log search 2.7.9
Simple Download Monitor Contributor could see private download details 4.1.3
Posts Table with Search and Sort Contributor could plant a script 1.4.15
Travelly (WpTravelly) Contributor could see saved payment gateway keys 2.3.12

If you use Travelly, also change the payment gateway keys in your PayPal or Stripe account after updating, since they may have been visible to other users.

What to do

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Remove Ultimate Security For WooCommerce, Slim Jetpack and Remove Google Fonts if you have them.
  3. Take a backup, then update Duplicator, WPvivid and the plugins in the tables, one at a time.
  4. After each update, test your contact form, booking page or checkout.
  5. Delete plugins you no longer use. A switched-off plugin still sits on the server.

How SyncTech can help

If a web designer looks after your site, forward this list to them. Weekly plugin checks are part of our WordPress website care plans. Not sure whether to handle updates in-house? Read website maintenance: do it yourself or outsource.

Source and credit

We are sharing this news from Patchstack and the plugin makers. This summary is written by Synctech in our own words.

Retrieved 6 November 2026. WordPress, WooCommerce, Cloudflare, PayPal, Stripe and the plugin names above are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.