SYNCTECH
Sign in
Plugin and theme security · · by the Synctech team

WordPress plugin security update: Avada and 30 more to patch

WordPress plugin security update: Avada and 30 more to patch

Makers of the Avada theme and about 30 WordPress plugins released security fixes between 26 and 31 October 2026. The worst holes, in Avada, WP Project Manager and PDF Invoice for WooCommerce, need no login. None was reported as attacked when we checked. Compare the names below with your site and update this week.

Which ones should I update first?

Theme or plugin What Patchstack lists Safe version
Avada theme A visitor could upload files to the site without logging in (high priority) 7.16.4
WP Project Manager A visitor could run code on the site without logging in (high priority) 4.1.2
PDF Invoice for WooCommerce (drag and drop template builder) Harmful data from a visitor could lead to code running on the site (high priority) 7.2.0
Spectra Legacy (Gutenberg blocks) Some theme files could be deleted or changed without a login (high priority) 2.20.5
Uncanny Toolkit for LearnDash The front-end login could be bypassed 3.8.3
Easy Digital Downloads Login check weakness that could lead to an admin account takeover 3.7.3
Essential Addons for Elementor A visitor could gain higher rights through a page setting 6.8.8
Enable Media Replace (4.1.4 to 4.2.2) Harmful data could be pushed into the site 4.2.3
Security and Malware Scan by CleanTalk Login protection could be bypassed 2.191

Avada is sold outside WordPress.org. It updates through its own dashboard once the purchase is registered, or from a fresh ThemeForest download. The others update from the normal WordPress Updates page.

Online shops and payments

Plugin Problem Safe version
PDF Invoices and Packing Slips for WooCommerce Script planted by a visitor 5.16.5 or newer
Welcart e-Commerce Script planted by a visitor 2.12.6
Square for WooCommerce (WC Shop Sync) Settings could be changed through a forged link 4.7.6

Forms, bookings, events and members

Plugin Problem Safe version
JetFormBuilder Permission and content holes 3.6.8
WP User Frontend Script run through a crafted link 4.3.14
User Submitted Posts Script planted by a visitor 20261029
BuddyForms Form settings could be read by visitors 2.10.5
Webba Booking Missing permission check 6.5.5
Timetics Missing permission check on bookings 1.0.66
The Events Calendar Permission and script holes 6.18.3
Event Tickets Missing permission check 5.30.3
FluentCRM Missing permission check 3.3.0 or newer
easy.jobs Script planted by a visitor 2.8.5

Speed, media and other plugins

  • W3 Total Cache 2.10.7 and older has two script holes that need no login. Update to 2.11.0.
  • NextGEN Gallery 4.5.0 closes a file inclusion hole for logged-in users; the current 4.5.5 adds more fixes.
  • FV Flowplayer Video Player 7.5.56.7212, Media Player Addons for Elementor 1.1.11, Firelight Lightbox 2.3.25 and Joinchat 6.4.2 fix script holes.
  • WP Visitor Statistics 8.8 fixes a script hole and a database hole (8.9 is current).
  • AI Engine 3.8.9 and Content Pilot 2.2.5 also carry security fixes.

What to do

  1. Log in to WordPress and open Plugins > Installed Plugins, then Appearance > Themes.
  2. Compare the names and versions above with your list.
  3. Take a backup first, then update one at a time. After each one, open your contact form, checkout or booking page.
  4. Remove plugins you no longer use. The files of a switched-off plugin stay on the server.
  5. If you use Avada, WP Project Manager or the PDF invoice plugin and cannot update today, ask your web designer to do it first thing.

How SyncTech can help

If a designer looks after your site, forward this page to them. Theme and plugin updates are part of our website maintenance plans, and if you think a site was already changed, our help centre shows how to reach us.

Source and credit

We are sharing this news from Patchstack and from the plugin makers. This summary is written by Synctech in our own words.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.