CVE-2026-66620

The WordPress OptionTree plugin (≤ 2.7.3) is vulnerable to PHP Object Injection via its Editor component. CVSS 7.2 (HIGH) reflects network attack vector, low complexity, and high impact across confidentiality, integrity, and availability, requiring attacker privileges. Exploitation details are no...

CVE-2026-32553

The WordPress OttoKit plugin (versions

EUVD-2026-60912

Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...

CVE-2026-32553 WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...

CVE-2026-32553

Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...

CVE-2026-32549

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32549

The WordPress ThumbPress plugin (

CVE-2026-32549 WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

EUVD-2026-60911

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32547

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

EUVD-2026-60910

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

CVE-2026-32547

BP Better Messages plugin (WordPress) ≤ 2.15.22 has an unauthenticated reflected/stored XSS flaw; attacker-supplied input is not sanitized before output, enabling script injection. CVSS 7.1 (High). Patchstack advisory: https://patchstack.com/database/wordpress/plugin/bp-better-messages/vulnerabil...

CVE-2026-32481

The WordPress Ezoic plugin (versions ≤ 2.22.11) contains an unauthenticated broken authentication flaw discovered by HaiND. CVSS 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) means any remote attacker can bypass authentication and access confidential data without credentials. No fix version or i...

CVE-2026-32481 WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...

EUVD-2026-60909

Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...

CVE-2026-32474

Templatiq is a WordPress plugin affected by an Arbitrary File Upload vulnerability in versions

EUVD-2026-60908

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-32474 WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-32473 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...