Plugin and theme updates, week 42 of 2026
235 new versions from Oct 12 to 18, 2026: 211 plugin releases and 24 theme releases.
211Plugin releases
24Theme releases
26Security fixes
5New to the catalogue
Notable updates
- Gravity Forms3.1.3.4
- New Added aria attributes to the first inputs in fieldsets to ensure screen readers read the labels and descriptions correctly.
- Yoast SEO Premium28.7
- JetEngine3.9.0
- New Nested Repeaters functionality.
- New Repeaters. Additional dynamic tags to get the repeater data.
- New Async Listings module.
- New Admin Pages module.
- Divi Theme5.15.1
- New Added safeguards to avoid variable data loss in the event of an unforeseen future bug leading to incorrect variable array merging.
- Astra Pro4.13.11
- WP All Import Pro6.0.1
- FluentCart Pro1.9.0
- New Adds On-page checkout with custom product selection, single or multiple selection, live totals, selection limits, and separate carts via the Checkout Page block or [fluent_cart_checkout] shortcode.
- BuddyBoss Theme2.22.3
- Essential Addons7.0.6
- ElementsKit Pro4.10.7
- New Copy and Paste actions using Elementor's latest Context Menu API.
- New Cross-domain content transfer using the Clipboard API with a manual paste fallback.
- Premium Addons PRO2.9.68
- PowerPack Elements3.1.1
- Security Animated Gradient Background - Colors are now validated and escaped in the editor preview and on the frontend
- Security PowerPack settings - Only administrators can now change settings, including which widgets and extensions are enabled
Security fixes
- UpdraftPlus - Backup/Restore2.26.10.26
- Security Thanks to Jakub Herman for reporting a second/related instance of the problem patched in 1.26.9. In this related instance, the problem could lead to execution only if the site was restored on a database server which differed in configuration from that on which the backup was taken. Nevertheless, all users should update.
- Directorist - Booking3.1.1
- Security Added guard against unsupported Directorist versions.
- Download Monitor5.3.4
- Security Security update.
- Gimont Theme1.3.2
- Security Update security
- NotificationX Pro3.2.4
- Security Security enhancement.
- PixelYourSite PRO12.6.8
- Security Fixed an XSS issue in noscript pixels.
- PixelYourSite Super Pack6.2.5
- Security Noscript and AMP pixel URLs are escaped.
- Vedhak1.2.8
- Security Update security
- Abandoned Cart Pro for WooCommerce10.8.1
- Security An unauthenticated SQL injection via AES-CTR ciphertext forgery in the recovery link validate parameter was possible.
- Security An unauthenticated authentication bypass was possible due to malleable encryption and a bypassable HMAC in the recovery link validate parameter.
- AutomateWoo6.9.3
- Security Security improvements to pre-submit email capture.
- Essential Grid3.2.4
- Security The admin escapes stored names and settings in its inline scripts, and the grid editor inserts them as text, so a stored value can no longer break the editor or be read as markup
- Security The front-end search script escapes its settings
- fluent campaign pro3.2.6
- Security Changed strings may need retranslation. Your selected language stays unchanged.
- Group Registration4.4.2.1
- Security Hardened the handling of group purchase options when adding products to the cart.
- WooCommerce Lottery2.2.11
- Security Security issue
- WooCommerce Simple Auction3.0.11
- Security Sanitize and escape query parameters and URLs in admin activity and winners list tables (CVE-2026-42635)
- WP Cerber Security9.10
- Security Two-factor authentication is now protected against PIN distributed brute-force attacks with per-account rate limiting. Each account can receive at most 5 new 2FA challenges per rolling hour and 10 per rolling 24 hours.
- Security When an account exceeds a 2FA challenge limit, WP Cerber blocks new sign-ins to that account for 24 hours and notifies the account owner of a possible password compromise.
- Bricks Theme2.4.3
- Security Security fixes for the Form element.
- BuddyBoss Addons1.2.2
- Security Social Login: Fixed a security issue affecting social login.
- Forminator Pro1.58.2
- Security Security hardening
- MainWP UpdraftPlus5.2
- Security Hardened stored UpdraftPlus settings handling to safely reject corrupted or unsafe serialized data.
- Security Improved UpdraftPlus.com account credential protection and prevented stored passwords from being displayed.
- Paid Memberships Pro3.8.9
- Security Fixed an issue where a failed Cloudflare Turnstile check allowed later checkout and billing update submissions in the same session to skip the security check.
- PowerPack Elements3.1.1
- Security Animated Gradient Background - Colors are now validated and escaped in the editor preview and on the frontend
- Security PowerPack settings - Only administrators can now change settings, including which widgets and extensions are enabled
- WooCommerce CyberSource2.13.1
- Security Harden handling of 3D Secure requests for improved security
- LatePoint Addon - Pro Features1.7.3
- Security Addressed security bugs. Props to WordFence for reporting it.
- LaunchGuard Pro1.4.1
- Security Mailchimp key left out of settings exports
- WOOCS - WooCommerce Currency Switcher Professional - Multi Currency2.5.5
- Security Security fix. Thanks to Je22y for the responsible disclosure and to Patchstack for coordinating it
New to the catalogue
- License Manager Plugin
- Live Notify Pro Plugin
- AutomatorWP - MailerPress Plugin
- AutomatorWP - Google Drive Plugin
- AutomatorWP - MetForm Plugin