Moatline

WordPress plugin security updates you shouldn’t skip: November 2026

Big plugins fix security flaws every month, and most never get attacked. But once a fix is public, attackers can compare the old and new code and work out the flaw, so the gap between “fixed” and “attacked” can be days. These are the recent fixes we would install first, with the version each plugin needs. We update this list every month.

By the Moatline team at Next Nova Technologies · Published 4 November 2026 · 4 min read

Not sure what your site runs?See what your visitors and Google see right now. Free, no sign-up, about 20 seconds.
Check my site free

Short answer

  • Update first: LiteSpeed Cache 7.9.2, All in One SEO 5.0.4, Duplicator 5.0.0, MainWP Child 6.2.2, Forminator 1.58.2. Anyone can try these, no login needed.
  • Then: WooCommerce 11.1.3, Elementor 4.3.5, Rank Math 1.0.280.
  • Not attacked yet as far as we know (4 November 2026). Fix before that changes.

Checked on 4 November 2026. Versions are the first release with the fix; anything newer is fine. Install counts are from WordPress.org and Sucuri.

Update these first: no login needed

Anyone on the internet can try these, so they matter on every site that runs the plugin.

PluginUpdate toWhat an attacker could do
LiteSpeed Cache (7M+ sites)7.9.2Plant scripts that run in visitors’ and admins’ browsers, and read some private information.
All in One SEO (2M+)5.0.4Run shortcodes through the search box and see private information.
Duplicator (1M+)5.0.0Hide code in a comment that runs later if an admin migrates the site with Duplicator (CVE-2026-82814).
Essential Addons for Elementor (1M+)6.8.8Read private information; several smaller fixes too.
Complianz cookie banner (1M+)7.5.6Plant scripts through a comment.
W3 Total Cache (900K+)2.10.8Plant scripts, including through comments (two flaws).
MainWP Child (700K+)6.2.2Send crafted data the plugin unpacks unsafely (PHP object injection). Agencies: this runs on every managed site.
Forminator (600K+)1.58.2Gain higher access, run shortcodes, plant scripts and delete some files.
The Events Calendar (600K+)6.17.5Send crafted data the plugin unpacks unsafely (PHP object injection).
Royal Addons for Elementor (600K+)1.7.1070Read private information, send email through your site, open other users’ records.
Click to Chat (600K+)4.45Run shortcodes through the page address.
Database Addon for Contact Form 7 (600K+)1.4.2Delete some files through a form submission.
Ninja Forms (500K+)3.15.6Plant scripts through form fields.
Broken Link Checker (500K+)2.4.14.2Run shortcodes.
Kirki (400K+)6.3.3Run shortcodes, plant scripts and read private information.
Ocean Extra (400K+)2.6.1Run shortcodes.
TranslatePress (400K+)3.3.8Plant scripts through comments.
BackWPup (400K+)5.7.7Read private information.
Jetpack (3M+)16.3Use a feature that skips a permission check (rated medium).
Autoptimize (800K+)3.1.15.2Plant scripts through a comment’s author name (rated medium).
“Plant scripts” (stored cross-site scripting) sounds minor, but it’s how last month’s Ninja Forms attacks started: the script ran when an admin opened the form entries, created a hidden administrator and installed a backdoor. See admins hidden from the Users screen.

Fixes that need an account

These need someone to be logged in, so they matter most on shops, membership sites and sites with several writers:

PluginUpdate toWho could misuse it
WooCommerce (7M+)11.1.3A Shop Manager could give themselves more power.
Elementor (10M+)4.3.5Contributors and authors could plant scripts.
Rank Math SEO (4M+)1.0.280A Contributor could run code on the server (fixed in 1.0.277), plus admin-only fixes.
Code Snippets (1M+)3.9.1Authors could reach settings they shouldn’t.
Speed Optimizer (1M+)7.8.5Authors could reach settings they shouldn’t.
Kadence Blocks (600K+)3.8.0.2Contributors could plant scripts.
Polylang (900K+)3.8.10Editors could send crafted data the plugin unpacks unsafely.

Update quickly and safely

  1. Back up first, files and database.
  2. See what’s out of date: Dashboard → Updates, or wp plugin list --update=available over SSH.
  3. Update the “no login needed” plugins first, then the rest.
  4. Check paid plugins separately. Premium versions only show updates while their license is active.
  5. Open the site and test the checkout, forms and anything the updated plugins power.

Looking after many sites? Do the ones with open registration, shops and forms first, because those give attackers an account or a form to work with.

Already under attack?

This page lists fixes nobody is known to be attacking yet. Plugins with confirmed attacks are on our live list of WordPress plugins under active attack. Ninja Forms below 3.15.4 is on it now.

The free Moatline Malware Scanner checks your plugins against that list twice a day and warns you on its Overview if one of yours is on it. If a plugin from either list was out of date for a while, run a full scan after updating: an update closes the hole, but doesn’t remove anything planted before.

Sources: Sucuri’s October 2026 roundup, SecurityOnline (Duplicator) and Patchstack (LiteSpeed Cache). Current versions and install counts from WordPress.org.

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

Are these plugins being attacked?
We haven’t seen reports of attacks on the flaws listed here as of 4 November 2026. That can change quickly. Plugins with confirmed attacks are on our separate list of WordPress plugins under active attack, which the free Moatline plugin checks your site against.
Do I need to update if the flaw needs a login?
Yes, if other people have accounts on your site. “Subscriber” means anyone who can register, and WooCommerce customers have accounts too. On a site where only you log in, those fixes are less urgent, but still worth installing.
Is it safe to turn on automatic updates?
For well-maintained plugins, usually yes, and it closes the gap fastest. Keep daily backups so you can roll back if an update breaks something. For WooCommerce and page builders on busy shops, many people prefer to update by hand after a quick test.
I use the Pro version of one of these plugins. Does this apply?
Usually. Pro add-ons often share code with the free plugin, and their updates only appear while the license is active. If a paid plugin shows no update, check its license or download the latest version from the vendor’s account page.
How often is this list updated?
Once a month, from the major vulnerability databases, plus anything urgent in between. Anything that starts being attacked moves to the under-attack list straight away.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →