WordPress security today: what to patch, checked daily

Latest critical and high plugin vulnerabilities

Update or replace these plugins first. Ask your agent to check yours with wp_security.

HIGHGiveWPAuthenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter · up to 4.19.1 · fixed in 4.19.1.14 Nov

HIGHLiteSpeed CacheUnauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching · up to 7.9.1 · fixed in 7.9.24 Nov

HIGHMotorsAuthenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter · up to 1.4.128 · fixed in 1.4.1294 Nov

HIGHSAML SP Single Sign OnAllocation of Resources Without Limits or Throttling · up to 6.1.04 Nov

HIGHDoofinder for WooCommerceInsertion of Sensitive Information into Externally-Accessible File or Directory · up to 2.17.24 Nov

HIGHWCFM MarketplaceMissing Authorization · up to 3.8.24 Nov

HIGHStape Conversion TrackingServer-Side Request Forgery · before 2.3.114 Nov

HIGHNoptinCross-site Scripting · up to 4.4.24 Nov

HIGHWP Customer AreaCross-site Scripting · up to 8.4.14 Nov

HIGHWP Booking SystemCross-site Scripting · up to 2.1.0.64 Nov

Is your site affected?Paste this to your agent. It reads your versions with WP-CLI and checks every plugin and theme in one call.

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

What to do now

2 NovSecurity

HTTP2Shell: critical Brotli flaw reachable through WordPress

Ask the host whether the Brotli decoder serving the site is patched for CVE-2026-111497 and the services were restarted after the update (on a VPS, update the system packages, then restart). Blocking unauthenticated XML-RPC pingbacks removes only the route shown in the public exploit and may break integrations; the xmlrpc_enabled filter and the Settings > Discussion option do not block them. Source

29 OctSecurity

Core Security Initiative: security releases now come often

Keep automatic minor (security) updates on, and expect more security releases: apply each one quickly rather than batching updates. Source

28 OctSecurity

WordPress 7.1.4 security release

Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7. Source

21 OctPHP

Critical PHP security release

Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server). Source

16 OctMCP

MCP Adapter 0.7.1 and 0.6.2 security fixes

Update to MCP Adapter 0.7.1 (or 0.6.2 for Composer users on 0.6.x) and stop matching on ability_not_public_mcp. Source

6 OctSecurity

WordPress 7.1.3 security and maintenance release

Update to WordPress 7.1.3 or later (7.1.4 is current). Source

Check your plugins and themes

Give your agent the plugins and themes on your site. It gets, for each one, the latest version, whether you are behind, and what to watch.

Formulo2.1 → 2.3Update due

Pebble Forms1.1Up to date

Formwise3.8Not tested with WordPress 7.1

What your agent gets from wp_security

List the plugins on my site with their versions, then check them with Today WP.

Is any plugin on my site out of date or untested with today's WordPress?

WordPress security, today.