Plugin and theme updates, week 41 of 2026

Notable updates

• Rank Math SEO PRO3.0.123
• JetEngine3.8.16.1
• Divi Theme5.15.0
• Perfmatters2.6.9
  • Security Security updates to improve escaping across the admin UI, including settings helpers, Script Manager, code snippets, license, support, and related screens.
  • New Added new perfmatters_rucss_per_id_post_types filter which allows for unique used CSS files per post ID for provided post types.
  • New Added a REST API exception for GenerateBlocks Pro.
  • New Added built-in Remove Unused CSS exclusions for Elementor's new local and global per-document stylesheets.
• WooCommerce Subscriptions9.3.0
• FluentCart Pro1.7.1
• ColorMag Pro5.2.5
  • New Author bio card on the author archive page, with avatar, role, bio, expertise, and social links.
• BuddyBoss Theme2.22.2
• Happy Elementor Addons Pro4.1.0
• The Plus Addon6.5.3
  • New UiChemy: Dismissible admin notice and editor hints that install UiChemy and open its AI Website Creator, only when an administrator clicks
• Jet Elements For Elementor2.9.2.4
• Unlimited Elements Widgets for Elementor2.0.23

Security fixes

• Gallery Custom Links Pro2.3.4
  • Security Prevent crafted text from injecting scripts through the HTML page parser.
  • Security Prevent text in a comment from being turned into a script when the page is parsed for gallery links.
• HUSKY - Products Filter Professional for WooCommerce3.4.6
  • Security Security fix. Thanks to Sawyer for the responsible disclosure and to Wordfence for coordinating it
• Meow Lightbox Pro5.6.3
  • Security Crafted comment text could inject script through the page parser.
• WP Job Manager2.4.8
  • Security Fix the reCAPTCHA deprecation notices naming a non-existent replacement method.
• Bricksforge4.0.1
  • Security Security fix for the Pro Forms file upload.
• FiboSearch1.34.3
  • Security Stored XSS in the WordPress admin panel. The script can run only in the browser of a logged-in administrator or shop manager. Thanks to daroo and the Wordfence team for the responsible disclosure.
• Ninja Tables Pro5.2.18
  • Security Improved security and data handling.
• The Grid2.8.2
  • Security Fixed an unauthenticated remote code execution vulnerability.
• Bit Form Pro3.3.2
  • Security Blocked IP Message: The visitor's IP address in the blocked-IP message is now escaped.
  • Security Forgot Password: The form gives the same answer whether or not an account exists, so it can no longer reveal which usernames and emails are registered. No email is sent for unknown accounts.
• Conditional Shipping and Payments3.1.6
  • Security Hardened release artifact verification, release pull request checks, and WordPress test metadata.
• LearnPress Assignments4.2.2
  • Security Fixed security (Props @meganatucker).
• WBW Product Filter PRO3.4.6
  • Security Escaped statistics values.
• Bit Integrations Pro2.8.6
  • Security Security Fixes: Timeline: Re-executing a log now runs the flow as the user who made the original submission, not as the administrator who presses Re-execute.
  • Security Security Fixes: BuddyBoss: Notification content and links are now sanitized, so HTML from a form submission can no longer run scripts in a user's notifications.
• Directorist - Digital Marketplace2.1.3
  • Security Security issue issue
• Kadence Blocks Pro2.8.20.1
  • Security Improved output escaping for block attributes.
  • Security Improved output handling in multiple blocks.
• Perfmatters2.6.9
  • Security Security updates to improve escaping across the admin UI, including settings helpers, Script Manager, code snippets, license, support, and related screens.
• Relevanssi Premium2.31.5
  • Security Fixes a XSS vulnerability based on click tracking parameters.
• Custom User Registration Fields2.2.5
  • Security Restricted the default registration fields AJAX save action to authorized administrators and valid field posts.
  • Security Added per-item permission checks to registration field and user approval bulk actions.
• LatePoint5.7.4
  • Security Addressed security bugs. Props to WordFence for reporting it.
• UserPro5.1.16
  • Security Security fix: Privilege escalation (CVSS 9.8, unauthenticated). A guest registration could overwrite the new account's wp_capabilities row by posting a field name containing a Unicode homoglyph in place of an ASCII letter (e.g. U+0209 replacing 'i' in wp_capabilities). MySQL's accent-insensitive meta_key collation matched the mutated key to the real wp_capabilities row, and the previous remove_accents() denylist did not cover all characters in that equivalence class.

Every version this week