# PickPlugins vulnerabilities

Source: https://junglewise.ai/threats/vendors/pickplugins  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 12 November 2026, 07:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/pickplugins.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 7 vulnerabilities in PickPlugins: 1 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-76792, was published on 12 November 2026. 2 vulnerabilities in the last four weeks, up from none in the four before.

## Counts

- Last 7 days: 1
- Last 30 days: 3
- Last 90 days: 3
- All time: 7 (0 critical, 0 exploited in the wild)

## About PickPlugins

PickPlugins is a developer of plugins and extensions for the WordPress content management system.

## Latest PickPlugins vulnerabilities

- [CVE-2026-76792: User Verification plugin authentication bypass in OTP verification](https://junglewise.ai/threats/cve-2026-76792-the-user-verification-by-pickplugins-wordpress-plugin-before-2-0) (info, published 12 Nov 2026)
- [CVE-2026-116392: PickPlugins Accordion object injection via untrusted deserialization](https://junglewise.ai/threats/cve-2026-116392-deserialization-of-untrusted-data-vulnerability-in-pickplugins) (high, CVSS 7.2, published 28 Oct 2026)
- [CVE-2026-87844: PickPlugins Product Designer for WooCommerce unauthenticated metadata injection](https://junglewise.ai/threats/cve-2026-87844-the-pickplugins-product-designer-for-woocommerce-wordpress-plugin) (info, published 18 Oct 2026)
- [CVE-2026-10207: PickPlugins Question Answer SQL injection in qa_user_profile_card](https://junglewise.ai/threats/cve-2026-10207-pickplugins-question-answer-sql-injection-in-qa-user-profile-card) (high, CVSS 7.5, published 28 Jul 2026)
- [CVE-2026-65456: PickPlugins Product Slider for WooCommerce IDOR in WordPress](https://junglewise.ai/threats/cve-2026-65456-pickplugins-product-slider-for-woocommerce-idor-in-wordpress) (medium, CVSS 4.3, published 23 Jul 2026)
- [CVE-2026-10862: WordPress Accordions plugin stored XSS in Accordion body field](https://junglewise.ai/threats/cve-2026-10862-wordpress-accordions-plugin-stored-xss-in-accordion-body-field) (medium, CVSS 6.4, published 9 Jun 2026)
- [CVE-2025-62745: PickPlugins Team Showcase Stored XSS](https://junglewise.ai/threats/cve-2025-62745-pickplugins-team-showcase-stored-xss) (medium, CVSS 6.5, published 25 May 2026)

## Most severe PickPlugins vulnerabilities

- [CVE-2026-10207: PickPlugins Question Answer SQL injection in qa_user_profile_card](https://junglewise.ai/threats/cve-2026-10207-pickplugins-question-answer-sql-injection-in-qa-user-profile-card) (high, CVSS 7.5, published 28 Jul 2026)
- [CVE-2026-116392: PickPlugins Accordion object injection via untrusted deserialization](https://junglewise.ai/threats/cve-2026-116392-deserialization-of-untrusted-data-vulnerability-in-pickplugins) (high, CVSS 7.2, published 28 Oct 2026)
- [CVE-2025-62745: PickPlugins Team Showcase Stored XSS](https://junglewise.ai/threats/cve-2025-62745-pickplugins-team-showcase-stored-xss) (medium, CVSS 6.5, published 25 May 2026)
- [CVE-2026-10862: WordPress Accordions plugin stored XSS in Accordion body field](https://junglewise.ai/threats/cve-2026-10862-wordpress-accordions-plugin-stored-xss-in-accordion-body-field) (medium, CVSS 6.4, published 9 Jun 2026)
- [CVE-2026-65456: PickPlugins Product Slider for WooCommerce IDOR in WordPress](https://junglewise.ai/threats/cve-2026-65456-pickplugins-product-slider-for-woocommerce-idor-in-wordpress) (medium, CVSS 4.3, published 23 Jul 2026)
- [CVE-2026-76792: User Verification plugin authentication bypass in OTP verification](https://junglewise.ai/threats/cve-2026-76792-the-user-verification-by-pickplugins-wordpress-plugin-before-2-0) (info, published 12 Nov 2026)
- [CVE-2026-87844: PickPlugins Product Designer for WooCommerce unauthenticated metadata injection](https://junglewise.ai/threats/cve-2026-87844-the-pickplugins-product-designer-for-woocommerce-wordpress-plugin) (info, published 18 Oct 2026)

## Vulnerabilities per week

2 vulnerabilities in the last four weeks, up from none in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 1 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 1 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 1 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "PickPlugins vulnerabilities", https://junglewise.ai/threats/vendors/pickplugins, 12 November 2026.