CVE-2026-66677

CVE-2026-66677 is a Broken Authentication vulnerability in the WordPress plugin Leyka affecting versions

CVE-2026-66673 WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...

CVE-2026-66649 WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...

CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66649

The WordPress Directory Pro plugin (versions ≤ 2.5.8) has an unauthenticated SQL injection vulnerability exploitable over the network with low complexity, scoring 9.3 critical. Patchstack advises upgrading to a patched version; no in-the-wild exploitation details are provided in the documents.

CVE-2026-66672

The WordPress Flatastic theme (versions ≤ 2.0) is vulnerable to unauthenticated PHP Object Injection, exploitable over the network without credentials. The Patchstack advisory documents the issue; no exploit code or in-the-wild activity is reported. Affected sites should update to a patched theme...

CVE-2026-66647

CVE-2026-66647 is a Broken Access Control vulnerability in the WordPress Homlisti theme , affecting versions 3.1.2 and below . The flaw allows a user with Subscriber privileges to perform actions beyond their intended access level, resulting in a high integrity impact (CVSS 3.1 score: 6.5 MEDIUM ...

CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

CVE-2026-66615 WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...

CVE-2026-66616 WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...

CVE-2026-66615

Podlove Podcast Publisher WordPress plugin versions ≤ 4.5.4 has an unauthenticated reflected/stored XSS flaw (CVSS 7.1 HIGH, network-exploitable, no auth required). No exploitation data is provided. Update to a patched version beyond 4.5.4; see the Patchstack advisory for details.

CVE-2026-66616

CVE-2026-66616 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Form Maker by 10Web , affecting versions ≤ 1.15.46 . The flaw allows a remote, unauthenticated attacker to inject malicious scripts into the context of a victim's browser, requiring user interact...

EUVD-2026-63298

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...

CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

CVE-2026-66612 WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

EUVD-2026-63297

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

EUVD-2026-63295

Unauthenticated SQL Injection in TheGem Elementor = 5.12.3 versions...

CVE-2026-66609 WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in TheGem Elementor = 5.12.3 versions...

EUVD-2026-63294

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

CVE-2026-66607

The WordPress Advance Product Search plugin (versions ≤ 1.4.8) has an unauthenticated XSS flaw with CVSS 7.1 (HIGH). Patchstack is the source; the Patchstack advisory link is provided in the references. No exploitation evidence is reported in the provided documents.