CVE-2026-65439 WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65439 WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65438 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-61957 WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...

CVE-2026-61953 WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-61957

CVE-2026-61957 affects the WordPress plugin Miniorange OTP Verification (versions

CVE-2026-61957 WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...

CVE-2026-61953 WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-66473 WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin ShopLentor versions = 3.4.5...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.4.5 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin ShopLentor versions = 3.4.5...

WordPress Advanced Form Integration plugin <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary MailUp OAuth Token Overwrite vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Form Integration versions = 2.6.0...

CVE-2026-66427

Administrator SQL Injection in WP Google Review Slider = 18.4 versions...

CVE-2026-65561

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

CVE-2026-65564

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress = 2.97.6 versions...

CVE-2026-59534

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-66474 WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...

CVE-2026-66474

CVE-2026-66474 is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin Insert Headers and Footers Code – HT Script up to version 1.1.8 . The issue is described as CSRF in versions

CVE-2026-66475

CVE-2026-66475 affects the WordPress plugin “Checkout Field Editor for WooCommerce – Checkout Manager” up to version ≤ 3.0.5. The connected documents describe a Cross Site Scripting (XSS) vulnerability impacting shop manager workflows, but do not provide technical details about the root cause, af...