Moatline

WordPress plugins under active attack

Plugins and themes with security holes that attackers are exploiting right now. If you use one of these, update or remove it today, then check your site for anything left behind.

Last updated 19 October 2026 · 34 plugins and themes · Maintained by the Moatline team

Critical

Bricksforge plugin

Anyone can upload a PHP backdoor without logging in. Attacked since 7 October 2026.

Affected
≤ 3.1.8.9
Fixed in
3.1.8.10 or later
CVE
CVE-2026-85097
Slug
bricksforge

How to check your site and clean it →

High

wpForo Forum plugin

Unauthenticated SQL injection. Exploitation attempts seen since July 2026.

Affected
≤ 2.4.14
Fixed in
No fix yet: remove the plugin
CVE
CVE-2026-1581
Slug
wpforo

Read the report →

High

Gravity SMTP plugin

An open REST route leaks your email-sending settings, including SMTP passwords and API keys, to anyone. Mass exploitation since June 2026. After updating, change those passwords and keys.

Affected
≤ 2.1.4
Fixed in
2.1.5 or later
CVE
CVE-2026-4020
Slug
gravitysmtp

Read the report →

High

Essential Plugin backdoor (31 plugins) plugins

One of 31 Essential Plugin plugins that were sold, backdoored and closed on WordPress.org in April 2026. Remove it, even if updated: the forced update stops the backdoor but does not clean the site. Then check wp-config.php and look for a wp-comments-posts.php file in the site root.

Affected
All versions
Fixed in
No fix yet: remove the plugin
Show all 31 plugins
  • Countdown Timer Ultimate countdown-timer-ultimate
  • Popup Anything on Click popup-anything-on-click
  • WP Testimonial with Widget wp-testimonial-with-widget
  • WP Team Showcase and Slider wp-team-showcase-and-slider
  • Responsive WP FAQ with Category sp-faq
  • SP News and Widget sp-news-and-widget
  • WP Blog and Widgets wp-blog-and-widgets
  • Album and Image Gallery plus Lightbox album-and-image-gallery-plus-lightbox
  • Timeline and History Slider timeline-and-history-slider
  • Featured Post Creative featured-post-creative
  • Post Grid and Filter Ultimate post-grid-and-filter-ultimate
  • Footer Mega Grid Columns footer-mega-grid-columns
  • WP Responsive Recent Post Slider wp-responsive-recent-post-slider
  • WP Slick Slider and Image Carousel wp-slick-slider-and-image-carousel
  • WP Featured Content and Slider wp-featured-content-and-slider
  • Hero Banner Ultimate hero-banner-ultimate
  • Preloader for Website preloader-for-website
  • Accordion and Accordion Slider accordion-and-accordion-slider
  • Portfolio and Projects portfolio-and-projects
  • Ticker Ultimate ticker-ultimate
  • WP Trending Post Slider and Widget wp-trending-post-slider-and-widget
  • Woo Product Slider and Carousel with Category woo-product-slider-and-carousel-with-category
  • Audio Player with Playlist Ultimate audio-player-with-playlist-ultimate
  • Meta Slider and Carousel with Lightbox meta-slider-and-carousel-with-lightbox
  • Post Category Image with Grid and Slider post-category-image-with-grid-and-slider
  • Product Categories Designs for WooCommerce product-categories-designs-for-woocommerce
  • Blog Designer for Post and Widget blog-designer-for-post-and-widget
  • HTML5 VideoGallery Plus Player html5-videogallery-plus-player
  • SlidersPack - All in One Image Sliders sliderspack-all-in-one-image-sliders
  • Styles for WP PageNavi - Addon styles-for-wp-pagenavi-addon
  • WP Logo Showcase Responsive Slider and Carousel wp-logo-showcase-responsive-slider-slider

Read the report →

Get warned automatically

The free Moatline plugin checks every plugin and theme on your site against this list twice a day and emails you the moment one is added. Pro adds the full Wordfence Intelligence vulnerability database.

Get it free on WordPress.org

Already hit?

Updating doesn’t remove a backdoor that is already there. Run a free outside check now, or have our team clean the site for you.

Check my site free Get it cleaned
Questions

About this list

What does “under active attack” mean?
Attackers are already using the flaw against real websites, not just that a researcher found it. These are the vulnerabilities to fix today, before the long list of theoretical ones.
My plugin is on the list. Is updating enough?
Updating stops new attacks, but it does not remove anything an attacker already planted, such as a backdoor file or a hidden admin account. If your site ran an affected version after the attacks started, update and then scan the site.
What if there is no fixed version yet?
Deactivate and delete the plugin until the developer releases a fix, or replace it with an alternative. Deactivating alone is not always enough, because some flaws are in files that can be reached directly.
How do I get warned when a plugin I use is added?
Install the free Moatline Malware Scanner plugin. It checks your installed plugins and themes against this list twice a day and emails you the first time one of them appears.
Can I use this list in my own tool?
Yes. The list is published as JSON at moatline.io/feeds/exploited.json. Please link back to this page if you use it.

We add a plugin when there is credible evidence of real-world exploitation (vendor advisories, security researchers, or attacks we see in our own cleanups) and remove it once attacks have stopped and a fix has been out for a while. For every known vulnerability, not just exploited ones, see our WordPress vulnerability scanner page.