Multiple XSS vulnerabilities patched in WordPress plugins October 2026
Original title: Vulnerability & Patch Roundup — October 2026
Sucuri publishes October 2026 roundup of medium and high-risk flaws in Elementor, LiteSpeed Cache, and WooCommerce.
Sucuri's Vulnerability & Patch Roundup details several XSS and privilege escalation vulnerabilities in major WordPress plugins. Affected versions include Elementor Website Builder up to 4.3.4, LiteSpeed Cache up to 7.9.1, and WooCommerce 9.8.0-11.1.2. Patches released for all listed CVEs; Sucuri Firewall already protects clients.
- Elementor Website Builder hit by authenticated XSS (CVE-2026-81812, CVE-2026-81813)
- LiteSpeed Cache vulnerable to unauthenticated stored XSS (CVE-2026-116763)
- WooCommerce affected by authenticated privilege escalation (CVE-2026-106608)
- Millions of installations impacted across plugins
Impact: cross-site scripting and privilege escalation in web applications
| Product | Affected | Fixed in |
|---|---|---|
| Elementor Website Builder | ≤ 4.3.4 | 4.3.5 |
- 1.Update Elementor Website Builder to 4.3.5 or greater
- 2.Update LiteSpeed Cache to 7.9.2 or greater
- 3.Update WooCommerce to 11.1.3 or greater
- CVEs
- CVE-2026-81812CVE-2026-81813CVE-2026-11905CVE-2026-109215CVE-2026-116763CVE-2026-113500CVE-2026-113501CVE-2026-114190CVE-2026-106608CVE-2026-101921CVE-2026-1928
- Vendors
- Sucuri
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101921 | Reflected XSS in WPForms before 2.0.2.1 | 4.7 | — | ||
| CVE-2026-106608 | Incorrect Privilege Assignment in WooCommerce | 7.2 | — | ||
CVE-2026-109215+1 related CVE | Stored XSS in LiteSpeed Cache WordPress plugin before 7.9.1 | 6.4 group max | — | ||
| CVE-2026-113500 | Stored XSS in LiteSpeed Cache before 7.9.2 | 7.5 | — | ||
| CVE-2026-113501 | Missing authorization in LiteSpeed Cache WordPress plugin before 7.9.2 | 3.1 | — | ||
| CVE-2026-114190 | Sensitive Data Exposure in LiteSpeed Cache before 7.9 | 5.9 | — | ||
| CVE-2026-11905 | Sensitive Information Exposure in Elementor Website Builder up to 4.2.3 | 4.3 | — | ||
| CVE-2026-1928 | PHP object injection in Rank Math SEO via updateMeta | 8.8 | — | ||
CVE-2026-81813+1 related CVE | Stored XSS in Elementor Website Builder WordPress plugin before 4.3.5 | 6.8 group max | — |
From the original article
11 min read at blog.sucuri.net
If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation following an attack. Most security breaches we observe originate from automated attacks that exploit known software vulnerabilities, often the same ones that have been previously reported and disclosed.
By Sucuri Malware Research Team · blog.sucuri.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.