脆弱性アラート
利用者の多いプラグイン・テーマに脆弱性が公表されたとき、 何が起きるのかと、いま何をすべきかをまとめています。毎日更新しています。
掲載の基準は利用サイト数1万以上、または悪用される確率が高いと推定されるもの （EPSS 1%以上）、または実際の悪用が確認されたもの（CISA KEV 掲載）です。
- Twenty20 Image Before-After — CVE-2026-92767
- Beaver Builder Page Builder – Drag and Drop Website Builder — CVE-2026-92084
- Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) — CVE-2026-97343
- WP Visitor Statistics (Real Time Traffic) — CVE-2026-96267
- WPFront Notification Bar — CVE-2026-93896
- Mail logging – WP Mail Catcher — CVE-2026-93889
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery — CVE-2026-92974
- Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) — CVE-2026-18443
- Responsive Starter Templates – Elementor Templates & Starter Sites — CVE-2026-15795
- WPC Estimated Delivery Date for WooCommerce — CVE-2026-104313
- WP Ultimate Review — CVE-2026-103519
- WP Ultimate Review — CVE-2026-100157
- Wp Social Login and Register Social Counter — CVE-2026-97344
- Visitor Traffic Real Time Statistics — CVE-2026-97341
- Simple Membership — CVE-2026-97337
- Strong Testimonials — CVE-2026-96650
- SEOPress – AI SEO Plugin & On-site SEO — CVE-2026-96564
- Alt Text AI – Automatically generate image alt text for SEO and accessibility — CVE-2026-91108
- Welcart e-Commerce — CVE-2026-87091
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVE-2026-103913
- Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More — CVE-2026-103909
- WPC Smart Quick View for WooCommerce — CVE-2026-103888
- Photo Reviews for WooCommerce — CVE-2026-101923
- SEOPress – AI SEO Plugin & On-site SEO — CVE-2026-101357
- All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) — CVE-2026-100152
- WPZOOM Connect: Social Icons Widget, Share Buttons & Click to Chat — CVE-2026-100149
- Rich Showcase for Google Reviews — CVE-2026-100148
- Real Cookie Banner: GDPR & ePrivacy Cookie Consent — CVE-2026-92977
- EWWW Image Optimizer — CVE-2026-92826
- EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents — CVE-2026-92727
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — CVE-2026-92551
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — CVE-2026-92538
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — CVE-2026-92536
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — CVE-2026-96270
- Beaver Builder Page Builder – Drag and Drop Website Builder — CVE-2026-95865
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent — CVE-2026-94539
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent — CVE-2026-94378
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — CVE-2026-93428
- Ivory Search – WordPress Search Plugin — CVE-2026-92243
- Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress — CVE-2026-100180
- WP Statistics – Simple, privacy-friendly Google Analytics alternative — CVE-2026-97652
- W3 Total Cache — CVE-2026-87920
- All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) — CVE-2026-85492
- Customer Reviews for WooCommerce — CVE-2026-97663
- Relevanssi – A Better Search — CVE-2026-97641
- Event Tickets and Registration — CVE-2026-97634
- JetFormBuilder — Dynamic Blocks Form Builder — CVE-2026-97342
- Download Manager — CVE-2026-97338
- CMB2 — CVE-2026-97336
- MW WP Form — CVE-2026-96567
- Newsletter – Send awesome emails from WordPress — CVE-2026-96566
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-94432
- Greenshift – animation and page builder blocks — CVE-2026-93880
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress — CVE-2026-93756
- CMB2 — CVE-2026-102772
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE — CVE-2026-102002
- Download Monitor — CVE-2026-100182
- Kubio AI Page Builder — CVE-2026-100107
- BA Book Everything — CVE-2026-102565
- SiteOrigin Widgets Bundle — CVE-2026-92174
- Ninja Forms – The Contact Form Builder That Grows With You — CVE-2026-90438
- Autoptimize — CVE-2026-78471
- Prime Mover – Backup and Migration — CVE-2026-101890
- Prime Mover – Backup and Migration — CVE-2026-101889
- Prime Mover – Backup and Migration — CVE-2026-101888
- Iptanus File Upload — CVE-2026-62071
- Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns — CVE-2026-96256
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — CVE-2026-92144
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder — CVE-2026-96813
- Appointment Hour Booking – Booking Calendar — CVE-2026-96573
- PDF Invoices & Packing Slips for WooCommerce — CVE-2026-92244
- Redux Framework — CVE-2026-90992
- Ad Inserter – Ad Manager & AdSense Ads — CVE-2026-89427
- Duplicate Post — CVE-2026-89424
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — CVE-2026-85235
- Autoptimize — CVE-2026-14995
- Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More — CVE-2026-100184
- Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More — CVE-2026-100179
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — CVE-2026-93882
- Social Media Share Buttons & Social Sharing Icons — CVE-2026-89047
- Ad Inserter – Ad Manager & AdSense Ads — CVE-2026-19902
- Redux Framework — CVE-2026-88999
- Extendify — CVE-2026-85679
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — CVE-2026-92966
- WP Popular Posts — CVE-2026-92548
- Advanced Woo Labels – Product Labels & Badges for WooCommerce — CVE-2026-12241
- AI Engine – The Chatbot, AI Framework & MCP for WordPress — CVE-2026-96561
- Simply Schedule Appointments — CVE-2026-92245
- Simply Schedule Appointments — CVE-2026-91109
- Newsletter – Send awesome emails from WordPress — CVE-2026-92537
- Astra — CVE-2026-27085
- Bold Page Builder — CVE-2026-88037
- Bold Page Builder — CVE-2026-6173
- Bold Page Builder — CVE-2026-6172
- Bold Page Builder — CVE-2026-6171
- Bold Page Builder — CVE-2026-6170
- Smart Slider 3 — CVE-2026-14876
- Simply Schedule Appointments — CVE-2026-89294
- EWWW Image Optimizer — CVE-2026-97067
- Polylang — CVE-2026-97279