VulnerabilitiesJul 31, 2026

Vulnerability & Patch Roundup — July 2026

Sucuri details July 2026 WordPress plugin vulnerabilities including XSS and RCE.

Sucuri's July 2026 roundup highlights several critical vulnerabilities affecting popular WordPress plugins. These include multiple Stored Cross-Site Scripting (XSS) flaws in Yoast SEO, WPForms, Ultimate Addons for Elementor, and Essential Addons for Elementor, as well as an Account Takeover vulnerability in Essential Addons for Elementor. A high-risk Cross-Site Request Forgery (CSRF) to Remote Code Execution (RCE) vulnerability in Loco Translate is also detailed. Sucuri states its firewall virtually patches these for clients, but recommends updating affected plugins.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Sucuri?

Get an email when a new story names Sucuri, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Multiple popular WordPress plugins — including Yoast SEO, WPForms, and Essential Addons for Elementor — were found to contain serious vulnerabilities such as Stored XSS, Account Takeover, and a CSRF-to-RCE chain in Loco Translate. These flaws exist because plugin code failed to properly sanitize user input and validate request origins, leaving millions of WordPress sites exposed. The account takeover and RCE vulnerabilities are especially dangerous, as they can allow unauthenticated attackers to fully compromise a site without any user interaction beyond a single page visit. This roundup underscores how third-party plugins dramatically expand the attack surface of any CMS-based website, making timely patching non-negotiable.

What helps against this

How we list vendors

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleAxonius Exposures Qualys VMDR Holm Security Platform all options
Automated patch management
Known holes get closed in days, not months.
For exampleMicrosoft Intune Ivanti Neurons for Patch Management Action1 Patch Management all options
Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
For exampleAkamai App & API Protector Cloudflare WAF and DDoS protection Imperva Cloud WAF all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-15425
cve — CVE-2026-15782
cve — CVE-2026-15155
cve — CVE-2026-15787
cve — CVE-2026-15145
cve — CVE-2026-15156
cve — CVE-2026-6459

Entities

Yoast SEO (product)WPForms (product)Essential Addons for Elementor (product)Ultimate Addons for Elementor (product)Loco Translate (product)Sucuri (vendor)