CVE-2026-61997

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked.

Here's the deal. Deactivating a vulnerable plugin or theme does NOT remove the files from your server. The code is still sitting there, still reachable, still exploitable in a ton of these cases. Unauthenticated file uploads, PHP object injection, SQL injection

0CVE ID | Nome

CVE-2026-104800 | AGE-GATE

CVE-2026-87855 | JTL- Connector for WooCommerce

CVE-2026-110002 | Snazzy Social Media Feed

CVE-2026-110653 | Appointment Booking Plugin - LatePoint

CVE-2026-62010 | Avventure

CVE-2026-62011 | Bonbon

CVE-2026-62012 | Coinpress

CVE-2026-62013 | Edge Decor

CVE-2026-62014 | EmojiNation

CVE-2026-62009 | Filmax

CVE-2026-62015 | gamezone

CVE-2026-62016 | Gamic

CVE-2026-62017 | Good Homes

CVE-2026-62018 | Gunslinger

CVE-2026-61998 | Le Truffe

CVE-2026-61997 | Legal Stone

CVE-2026-62002 | Meals & Wheels

CVE-2026-62003 | Mission

CVE-2026-62004 | Motorix

CVE-2026-62005 | Muzicon

CVE-2026-62006 | Nuts

CVE-2026-62008 | Orpheus

CVE-2026-104246 | Contact Form 7 Signature Addon

CVE-2026-96661 | Gmedia Photo Gallery

CVE-2026-78193 | JTL- Connector for WooCommerce

CVE-2026-103696 | Mobile Builder

CVE-2026-91833 | WX Subscribe

CVE-2026-109145 | User Rights Access Manager

CVE-2026-103422 | AnyComment

CVE-2026-61988 | Auction Nudge

CVE-2026-108498 | BSK PDF Manager

CVE-2026-83592 | Contact Form DB for Enfold

CVE-2026-93885 | Cryptocurrency Donation Box

CVE-2026-94377 | Verified Reviews (Avis Vérifiés)

CVE-2026-95816 | Smart Forms

CVE-2026-101924 | NewStatPress

CVE-2026-100153 | NewStatPress

CVE-2026-91074 | BSK PDF Manager

CVE-2026-101926 | Hyyan Integration for WooCommerce and Polylang

CVE-2026-104122 | Ukr-To-Lat

CVE-2026-16495 | Countdown Timer - Widget Countdown

CVE-2026-74921 | Document Gallery

CVE-2026-54869 | IMPress for IDX Broker

CVE-2026-97020 | PO/MO Editor

CVE-2026-54867 | Responsive Slider

CVE-2026-103369 | Social Share Buttons & Analytics Plugin

CVE-2026-109702 | Social Share Buttons

CVE-2026-54870 | Weaver Xtreme Theme Support

CVE-2026-89269 | WP Testimonials

CVE-2026-74920 | Document Gallery

CVE-2026-110384 | Fancy Comments WordPress

CVE-2026-110762 | bbPress

CVE-2026-106010 | BDM Digital Payment Gateway

CVE-2026-103311 | Coinbase Commerce Payment Gateway for WooCommerce

CVE-2026-92427 | Coinsnap Bitcoin Crowdfunding

CVE-2026-74923 | Document Gallery

CVE-2026-74922 | Document Gallery

CVE-2026-91047 | ElementsReady Addons for Elementor

CVE-2026-42689 | Events Manager

CVE-2026-106014 | Gateway for Vantiv on WC

CVE-2026-87844 | Product Designer

CVE-2026-110227 | Restricted Site Access

CVE-2026-91046 | ElementsReady Addons for Elementor

CVE-2026-105974 | Visual Form Builder

CVE-2026-105973 | Visual Form Builder

CVE-2026-61994 | WP-Members Membership Plugin

CVE-2026-111413 | aThemeArt Theme Helper

CVE-2026-109703 | WPGraphQL

CVE-2026-111409 | YITH PayPal Express Checkout for WooCommerce

​Join us at r/stopbadbots and help protect the people who build the internet.