5 Urgent WordPress Vulnerabilities to Patch (Winter 2026)

WordPress still powers a huge chunk of the internet in 2026, which is exactly why attackers keep targeting it.

More often than not, the biggest vulnerabilities lie in plugins, opening the door to admin takeovers, malicious uploads, injected scripts, or full site compromise.

At WHC, we keep a close eye on the WordPress ecosystem so customers can patch fast, stay secure, and avoid painful downtime.

Here are five high-risk plugin vulnerabilities hosting teams are watching this winter, and what you should do about them.

1. WPvivid Backup & Migration (CVE-2026-1357)

• Affected versions: <= 0.9.123
• Patched in: 0.9.124
• Active installs: 900,000+
• Severity (CVSS): 9.8 / 10 (Critical)

What’s the risk?

This vulnerability allows unauthenticated file uploads, potentially leading to remote code execution and full site takeover.

The biggest exposure pops up when WPvivid’s “receive backup from another site” feature is enabled. Though it’s off by default, sites that enable it may be exposed.

What to do now

• Update to 0.9.124 or newer immediately.
• Disable “receive backups” if you don’t actively use it
• Remove unused backup and migration plugins

2. Advanced Custom Fields: Extended (CVE-2025-14533)

• Affected versions: <= 0.9.2.1
• Patched in: 0.9.2.2
• Active installs: 100,000+
• Severity (CVSS): 9.8 / 10 (Critical)

What’s the risk?

This is an unauthenticated privilege escalation flaw in Advanced Custom Fields: Extended, a WordPress plugin with more than 100,000+ active installations.

If a user-action form exposes or improperly maps a “role” field, an attacker could grant themselves administrator access. From there, it’s game over.

What to do now

• Update to 0.9.2.2 or newer
• Audit all ACFE forms and user actions
• Remove role selection or mapping unless absolutely required

If your forms touch user roles, double-check them today.

3. CleanTalk Anti-Spam (CVE-2026-1490)

• Affected versions: <= 6.71
• Patched in: 6.72
• Active installs: 200,000+
• Severity (CVSS): 9.8 / 10 (Critical)

What’s the risk?

An authorization bypass tied to reverse DNS checks.

In vulnerable versions of CleanTalk, an unauthenticated attacker may be able to trigger arbitrary plugin installation, which can be leveraged into a full compromise.

Even if scoring varies between security researchers, the takeaway is simple: this is serious.

What to do now

• Update to 6.72 or newer immediately
• Review installed plugins after updating
• Remove anything unexpected or unused

Unexpected plugins are often the first sign something went wrong.

4. PixelYourSite (CVE-2026-1841)

• Affected versions: <= 11.2.0
• Patched in: 11.2.0.1
• Active installs: 500,000+
• Severity (CVSS): 7.2 / 10 (High)

What’s the risk?

PixelYourSite contains an unauthenticated stored XSS vulnerability.

In plain English: attackers may be able to inject scripts that run in visitors’ browsers.

That can lead to:

• Stolen admin sessions
• Redirect spam
• SEO problems
• Malware warnings in search results

What to do now

• Update to 11.2.0.1 or newer
• Check for unfamiliar scripts or redirects
• Review tracking snippets and custom code areas

XSS often hides quietly. A quick review now can save hours of cleanup later.

5. Starter Templates (Astra Sites) Plugin (CVE-2025-13065)

• Affected versions: <= 4.4.41
• Patched in: 4.4.42
• Active installs: 2+ million
• Severity (CVSS): 8.8 / 10 (High)

What’s the risk?

The Starter Templates (Astra Sites) plugin contains an authenticated arbitrary file upload vulnerability affecting Author+ roles.

If an attacker gains author-level access (through phishing, password reuse, or another plugin flaw), they may be able to upload dangerous files and escalate further.

This turns a small breach into a major one.

What to do now

• Update to 4.4.42 or newer
• Limit author accounts
• Remove old contributors
• Disable unused user accounts
• Enforce strong passwords and 2FA

Final tips to stay secure

Security vulnerabilities don’t just mean “technical issues.”

They can lead to:

• Defaced pages
• Stolen customer data
• SEO penalties
• Blacklisted domains
• Real revenue loss

And cleanup is always more expensive than prevention.

Here’s your winter security checklist:

• Keep WordPress core, plugins, and themes updated
• Enable auto-updates where appropriate
• Remove unused plugins and themes (inactive ≠ safe)
• Maintain tested backups
• Use strong passwords and enable 2FA
• Add a Web Application Firewall (WAF)
• Monitor logs for unusual activity

Small habits prevent big incidents.

Need a hand?

At WHC, we help customers stay ahead of WordPress security threats every day.

From Managed WordPress Hosting to malware scanning and hands-on support, our team is here when something looks off.

Security isn’t a one-time task. It’s ongoing.

And we’ve got your back.