CVE-2026-32564 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32550 WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability

Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...

CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479

CVE-2026-32479 is an unauthenticated SQL Injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro , affecting versions ≤ 11.17 . The vulnerability was discovered by Trương Hữu Phúc (Patchstack). The CVSS 3.1 score is 9.3 (Critical) , with a network attack vector, low complexity ...

CVE-2026-27330 WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

CVE-2026-81279

The WordPress plugin Push Notification for Post and BuddyPress versions

WordPress GeoDirectory plugin < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users vulnerability

Contributor+ User Email Disclosure via geodirjsonsearchusers vulnerability discovered by Vaibhav Narkhede in WordPress Plugin GeoDirectory versions 2.8.168...

WordPress Slim SEO plugin < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure vulnerability

Contributor+ Arbitrary Post Meta Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Slim SEO versions 4.9.11...

WordPress AI Engine plugin < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability

Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...

WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability

Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability discovered by ryan fabella in WordPress Plugin MultiVendorX versions 5.0.11...

WordPress User Registration & Membership plugin < 5.2.6 - Unauthenticated Account Creation While Registration Disabled vulnerability

Unauthenticated Account Creation While Registration Disabled vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin User Registration versions 5.2.6...

WordPress Create Block Theme plugin < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) vulnerability

Admin+ PHP Code Injection via Pattern Save Multisite vulnerability discovered by Pavan Saxena Rootkid in WordPress Plugin Create Block Theme versions 2.10.0...

WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability

Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

WordPress WPC Name Your Price for WooCommerce plugin < 2.2.5 - Unauthenticated Price Manipulation via Select Mode vulnerability

Unauthenticated Price Manipulation via Select Mode vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WPC Name Your Price for WooCommerce versions 2.2.5...

WordPress ImproveSEO plugin <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability

Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability discovered by João Ramos Maciel in WordPress Plugin Improve SEO versions = 2.0.11...

WordPress WP Directory Kit plugin < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure vulnerability

Subscriber+ Plugin Settings and API Key Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions 1.5.5...

WordPress WP Directory Kit plugin < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure vulnerability

Subscriber+ Contact Message and User Data Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions 1.5.5...

WordPress WP Directory Kit plugin < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure vulnerability

Subscriber+ User and Unpublished Listing Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions 1.5.5...