脆弱性アラート
利用者の多いプラグイン・テーマに脆弱性が公表されたとき、 何が起きるのかと、いま何をすべきかをまとめています。毎日更新しています。
掲載の基準は利用サイト数1万以上、または悪用される確率が高いと推定されるもの （EPSS 1%以上）、または実際の悪用が確認されたもの（CISA KEV 掲載）です。
- HivePress – Business Directory, Listings & Classified Ads Plugin — CVE-2026-107657
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) — CVE-2026-96765
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-96662
- WP Photo Album Plus — CVE-2026-96278
- WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels — CVE-2026-93746
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) — CVE-2026-104759
- Kirki – Freeform Page Builder, Website Builder & Customizer — CVE-2026-102291
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — CVE-2026-101921
- Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress — CVE-2026-101920
- FunnelKit – Funnel Builder for WooCommerce Checkout — CVE-2026-100147
- SiteOrigin Widgets Bundle — CVE-2026-97348
- Post Grid Gutenberg Blocks – PostX — CVE-2026-96840
- User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission — CVE-2026-96574
- WP Meteor Website Speed Optimization Addon — CVE-2026-96572
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker — CVE-2026-96558
- Payment Plugins for Stripe WooCommerce — CVE-2026-89100
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — CVE-2026-15178
- Online Scheduling and Appointment Booking System – Bookly — CVE-2026-12626
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer — CVE-2026-107742
- WP Booking System – Booking Calendar — CVE-2026-107712
- PPOM – Product Addons & Custom Fields for WooCommerce — CVE-2026-104801
- SpeedyCache – Cache, Optimization, Performance — CVE-2026-104006
- Responsive Lightbox & Gallery — CVE-2026-103897
- Simple Membership — CVE-2026-103427
- Team – Team Members Showcase Plugin — CVE-2026-102402
- LazyLoad Plugin – Lazy Load Images, Videos, and Iframes — CVE-2026-100196
- Photo Reviews for WooCommerce — CVE-2026-100161
- GiveWP – Donation Plugin and Fundraising Platform — CVE-2026-97643
- Presto Player — CVE-2026-96682
- Order Export & Order Import for WooCommerce — CVE-2026-94375
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-91050
- Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files — CVE-2026-18558
- Booking Calendar — CVE-2026-18496
- MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar — CVE-2026-16776
- Brizy – Page Builder — CVE-2026-14882
- Data Tables Generator by Supsystic — CVE-2026-14877
- GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress — CVE-2026-14379
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy — CVE-2026-14335
- Download Manager — CVE-2026-12054
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-104899
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-104766
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor — CVE-2026-104762
- AI Puffer – Chat. Create. Automate. (formerly AI Power) — CVE-2026-104742
- AI Puffer – Chat. Create. Automate. (formerly AI Power) — CVE-2026-104741
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes — CVE-2026-104723
- Smart Popup by Supsystic — CVE-2026-104023
- JetFormBuilder — Dynamic Blocks Form Builder — CVE-2026-103912
- HivePress – Business Directory, Listings & Classified Ads Plugin — CVE-2026-103520
- Simple Newsletter Plugin – Noptin — CVE-2026-103482
- FV Flowplayer Video Player — CVE-2026-97630
- Data Tables Generator by Supsystic — CVE-2026-96648
- Filter Everything — WordPress & WooCommerce Filters — CVE-2026-87869
- Simply Schedule Appointments — CVE-2026-6723
- Hello Plus — CVE-2026-5727
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-104993
- RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator — CVE-2026-104735
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder — CVE-2026-103998
- Download Manager — CVE-2026-103964
- Spam protection, Honeypot, Anti-Spam by CleanTalk — CVE-2026-103424
- Download Manager — CVE-2026-102401
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — CVE-2026-101324
- Table Field Add-on for ACF and SCF — CVE-2026-96743
- Blocksy Companion — CVE-2026-107645
- Online Scheduling and Appointment Booking System – Bookly — CVE-2026-104898
- Advanced Form Integration — Connect Forms to 200+ Apps — CVE-2026-104797
- Online Scheduling and Appointment Booking System – Bookly — CVE-2026-103365
- Redux Framework — CVE-2025-14123
- Favicon Rotator — CVE-2026-5725
- Getwid – Gutenberg Blocks — CVE-2026-91862
- Table Field Add-on for ACF and SCF — CVE-2026-78068
- Graphene — CVE-2026-17025
- Download Manager — CVE-2026-9696
- Scripts n Styles — CVE-2026-62042
- WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce — CVE-2026-62041
- Asgaros Forum — CVE-2026-39779
- Restrict User Access – Ultimate Membership & Content Protection — CVE-2026-62040
- HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player — CVE-2026-62039
- BackWPup – WordPress Backup & Restore Plugin — CVE-2026-86828
- Event Tickets and Registration — CVE-2026-105893
- Visual Composer Website Builder — CVE-2026-106596
- Booking Calendar — CVE-2026-105195
- BackWPup – WordPress Backup & Restore Plugin — CVE-2026-86827
- BackWPup – WordPress Backup & Restore Plugin — CVE-2026-86826
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy — CVE-2026-105194
- Image Photo Gallery Final Tiles Grid — CVE-2026-104645
- Event Tickets and Registration — CVE-2026-105891
- GiveWP – Donation Plugin and Fundraising Platform — CVE-2026-106600
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-105198
- Event Tickets and Registration — CVE-2026-105888
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-105197
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor — CVE-2026-105890
- ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF — CVE-2026-103070
- WP Store Locator — CVE-2026-105078
- Robo Gallery – Photo & Image Slider — CVE-2026-105887
- MasterStudy LMS WordPress Plugin – for Online Courses and Education — CVE-2026-105079
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-105196
- WP 2FA – Two-factor authentication for WordPress — CVE-2026-62142
- Booking Calendar — CVE-2026-105193
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — CVE-2026-106611
- Database Addon For WPForms ( wpforms entries ) – WPFormsDB — CVE-2026-105260