CVE-2026-57667 WordPress Groundhogg plugin <= 4.5 - SQL Injection vulnerability

Sales Representative SQL Injection in Groundhogg = 4.5 versions...

EUVD-2026-39671

Sales Representative SQL Injection in Groundhogg = 4.5 versions...

CVE-2026-57658 WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability

Administrator Arbitrary File Upload in TemplateSpare = 4.2.0 versions...

CVE-2026-57658

CVE-2026-57658 concerns the WordPress TemplateSpare plugin, specifically versions

EUVD-2026-39770

Unauthenticated Cross Site Request Forgery CSRF in Child Theme Wizard = 1.4 versions...

CVE-2026-57646 WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Majestic Support = 1.1.7 versions...

EUVD-2026-39756

Unauthenticated Cross Site Request Forgery CSRF in Real Estate 7 = 3.5.9 versions...

CVE-2026-57641 WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Real Estate 7 = 3.5.9 versions...

CVE-2026-57638

CVE-2026-57638 concerns a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Fluent Booking affecting versions

EUVD-2026-39753

Unauthenticated Cross Site Request Forgery CSRF in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...

EUVD-2026-39747

Administrator SQL Injection in Popup box = 6.0.1 versions...

CVE-2026-57630 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Blocksy Companion Pro = 2.1.46 versions...

EUVD-2026-39745

Contributor Cross Site Scripting XSS in StatCounter = 2.1.1 versions...

EUVD-2026-39744

Administrator SQL Injection in WP All Import = 4.0.1 versions...

EUVD-2026-39743

Subscriber Server Side Request Forgery SSRF in Kirki = 6.0.11 versions...

EUVD-2026-39739

Author Cross Site Scripting XSS in Featured Image = 2.1 versions...

CVE-2026-57431

Author Cross Site Scripting XSS in Featured Image = 2.1 versions...

CVE-2026-57430

Contributor Broken Access Control in SEOPress PRO = 9.1.1 versions...

CVE-2026-57325

The CVE-2026-57325 covers an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress NanoMag theme versions up to 1.8. The issue affects the NanoMag theme code path exposed to users, enabling XSS payloads without authentication. Documents confirm the affected product (WordPress ...

CVE-2026-57322

CVE-2026-57322 is an Unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress weMail plugin, version &lt;= 2.1.2. The connected documents identify it as a Reflected XSS in weMail