CVE-2026-85307

KP Agent Ready is a WordPress plugin developed by Kevin Pirnie. Versions prior to 1.2.08 are affected by an Insertion of Sensitive Information Into Sent Data vulnerability that allows an unauthenticated remote attacker to retrieve embedded sensitive data. The CVSS v3.1 score is 5.3 (Medium) with ...

CVE-2026-75602

OpenList (a file list program supporting multiple storage backends) versions prior to 4.2.3 are affected by an authenticated path traversal vulnerability in the offline-download feature. When the SimpleHttp tool is used via POST /api/fs/add_offline_download, an attacker-controlled Content-Disposi...

CVE-2026-85306

MountDev AI MCP Connector for WordPress , a plugin by Cascadia Web Services, is affected by a Missing Authorization (Broken Access Control) vulnerability in versions from unspecified up to 1.6.5 . The flaw allows exploitation of incorrectly configured access control security levels, granting a lo...

CVE-2026-85305

A Server-Side Request Forgery (SSRF) vulnerability affects the SEOPress WordPress plugin in versions from n/a through 10.1 . The flaw allows an attacker to force the server to make unintended requests. The CVSS v3.1 score is 5.4 (MEDIUM) , with a network vector, low complexity, low privileges req...

CVE-2026-85303

CVE-2026-85303 affects the Booking and Rental Manager WordPress plugin by Magepeople inc. , with a Stored XSS vulnerability present in versions from unspecified through 2.7.7 . The flaw stems from improper neutralization of input during web page generation, allowing an attacker with low privilege...

CVE-2026-85302

A DOM-Based XSS vulnerability exists in the WPKoi Templates for Elementor WordPress plugin, affecting versions from n/a through 3.7.2 . The flaw stems from improper neutralization of input during web page generation. Exploitation requires low privileges and user interaction , with a changed scope...

CVE-2026-84848

The WordPress Quick Event Manager plugin (versions

CVE-2026-84847

CVE-2026-84847 affects the WordPress Quick Event Manager plugin in versions 9.17 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker with no prior access can exploit it over the network with low complexity and no user interaction. The CVSS 3.1 sco...

CVE-2026-84836

WC Ukraine Shipping is a WordPress plugin affected by an Insecure Direct Object References (IDOR) vulnerability in versions 1.22.3 and earlier . The flaw allows a low-privilege user (Subscriber level) to access restricted objects, resulting in high confidentiality impact and low integrity impact,...

CVE-2026-84834

CVE-2026-84834 affects the WordPress JobSearch plugin in versions ≤ 3.2.0 . The vulnerability is an unauthenticated PHP Object Injection , allowing a remote attacker with no privileges to potentially achieve high impact on confidentiality, integrity, and availability, as reflected by a CVSS 3.1 s...

CVE-2026-84814

CVE-2026-84814 affects the WordPress Bricksforge plugin in versions 3.1.8.8 and below , introducing a Subscriber Privilege Escalation vulnerability. According to the PatchStack CVSS 3.1 assessment, the vulnerability is rated CRITICAL (9.8) with a network attack vector, low complexity, no required...

CVE-2026-84813

An unauthenticated SQL Injection vulnerability affects the WordPress GeoDirectory plugin in versions

CVE-2026-84812

CVE-2026-84812 affects the WordPress BP Better Messages plugin in versions

CVE-2026-84779

Agentimus – AI SEO, llms.txt & MCP for AI Agents WordPress plugin versions

CVE-2026-84778

An unauthenticated Denial of Service vulnerability affects the Migrate Guru – Site Migration & Cloning WordPress plugin in versions

CVE-2026-84777

WordPress Really Simple SSL plugin versions ≤ 9.8.0 are affected by an unauthenticated broken authentication vulnerability described as a 2FA bypass . The flaw allows a network-based attacker (with no prior privileges or user interaction, but high attack complexity) to compromise authentication, ...

CVE-2026-84776

CVE-2026-84776 affects the MalCare Security WordPress plugin in versions ≤ 6.69 , where an unauthenticated Denial of Service (DoS) attack is possible. The vulnerability requires no user interaction and has low attack complexity , with a network-based attack vector. Per the CVSS 3.1 score of 7.5 (...

CVE-2026-84774

WP Statistics (WordPress plugin) versions

CVE-2026-84769

CVE-2026-84769 affects the WordPress Business Directory plugin in versions

CVE-2026-84773

EWWW Image Optimizer for WordPress (versions

CVE-2026-84768

CVE-2026-84768 affects the WordPress VikAppointments Services Booking Calendar plugin in versions 1.2.20 and earlier . The vulnerability is an unauthenticated SQL Injection , meaning an attacker can exploit it without prior access or credentials. The CVSS 3.1 base score is 9.3 (CRITICAL) , with a...

CVE-2026-84766

An unauthenticated bypass vulnerability exists in the FluentBooking Pro WordPress plugin in versions 2.2.1 and below , as reported by Patchstack. The CVSS 3.1 score is 5.9 (Medium) , with a network attack vector, high complexity, no privileges required, and a high integrity impact but no confiden...

CVE-2026-84767

An unauthenticated bypass vulnerability affects the WordPress BookIt plugin in versions ≤ 2.6.0.3 . The flaw allows a remote attacker with no prior authentication or user interaction to trigger the bypass over the network with low complexity. The CVSS 3.1 score is 5.3 (Medium) , reflecting a low ...

CVE-2026-84765

Breadcrumb NavXT , a popular WordPress plugin, is affected by an unauthenticated Cross-Site Scripting (XSS) vulnerability in versions 7.5.1 and earlier . The flaw is classified with a CVSS 3.1 score of 7.1 (HIGH) , reflecting a network attack vector, low complexity, no privileges required, but re...

CVE-2026-84763

CVE-2026-84763 affects the RTMKit (Rome Theme for Elementor) WordPress plugin, versions 2.1.5 and earlier . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, scored CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The changed scope indicates the im...

CVE-2026-84762

CVE-2026-84762 affects the WP EasyPay WordPress plugin in versions 4.5.3 and earlier . The vulnerability is an unauthenticated bypass that allows a remote attacker with no privileges and no user interaction to achieve low integrity impact , scoring CVSS 5.3 (Medium) . The specific component or ro...

CVE-2026-84761

CVE-2026-84761 affects the WordPress LiteSpeed Cache plugin in versions 7.9 and earlier , where an unauthenticated Server Side Request Forgery (SSRF) flaw is present. The CVSS v3.1 score is 7.2 (HIGH) with a Changed scope and low impacts to both confidentiality and integrity, while availability i...

CVE-2026-84758

An unauthenticated Broken Access Control vulnerability affects the WordPress Business Directory plugin in versions 6.4.26 and earlier . A remote attacker with no prior access can exploit this flaw over the network with low complexity and no user interaction, resulting in low integrity and low ava...

CVE-2026-84757

CVE-2026-84757 affects the WordPress WP Compress plugin in versions 7.21.28 and earlier . The vulnerability is an unauthenticated Settings Change , meaning an attacker with no prior access can modify plugin settings over the network without any user interaction. This yields a CVSS 3.1 base score ...

CVE-2026-84756

CVE-2026-84756 is a privilege escalation vulnerability affecting the WCFM Membership WordPress plugin in versions 2.11.11 and below . The flaw allows a user with Subscriber privileges to escalate their access level. The vulnerability is rated HIGH (CVSS 3.1: 7.1) , with a network attack vector, l...

CVE-2026-84755

Mail Mint is a WordPress plugin affected by an unauthenticated Broken Access Control vulnerability in versions 1.31.0 and below . The flaw allows a remote attacker with no prior access to perform unauthorized actions on the plugin, resulting in low confidentiality and low integrity impact with no...

CVE-2026-84754

CVE-2026-84754 affects the WordPress WPFunnels plugin in versions ≤ 3.12.13 , where an unauthenticated broken access control flaw allows a remote attacker to manipulate integrity and availability of the target system without any user interaction. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector o...

CVE-2026-84753

CVE-2026-84753 affects the WordPress Mail Mint plugin in versions 1.31.0 and below , where an unauthenticated PHP Object Injection flaw allows a remote attacker to inject arbitrary serialized objects into the application. The vulnerability is rated CVSS 9.8 (CRITICAL) with high impact to confiden...

CVE-2026-84752

CVE-2026-84752 affects the WordPress RTMKit plugin (Rometheme for Elementor) in versions 2.1.5 and earlier . The vulnerability is a PHP Object Injection that can be exploited by a user with Contributor privileges, resulting in high impact on confidentiality, integrity, and availability (CVSS 8.8 ...

CVE-2026-84238

CVE-2026-84238 affects the YITH Request a Quote for WooCommerce Premium WordPress plugin in versions prior to 4.46.0 . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker can exploit it over the network without any prior access or user interaction. The CVSS 3.1...

CVE-2026-84215

CVE-2026-84215 affects the WordPress Timetics plugin in versions 1.0.61 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. This means an unauthenticated network-based attacker can exploit ...

CVE-2026-81776

CVE-2026-81776 affects the WordPress WP QuickLaTeX plugin in versions

CVE-2026-81773

CVE-2026-81773 affects the WordPress Ninja Forms File Uploads Extension plugin in versions 3.3.26 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning no prior authentication is required to exploit it. The CVSS 3.1 base score is 7.1 (HIGH) with a vector of ...

CVE-2026-81300

CVE-2026-81300 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the Calculation For Contact Form 7 WordPress plugin in versions ≤ 1.0 . The CVSS v3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-based attack with low comple...

CVE-2026-81295

CVE-2026-81295 affects the WordPress Under Construction plugin (versions ≤ 5.82 ) with an unauthenticated Cross-Site Scripting (XSS) flaw, as identified by Patchstack. The CVSS 3.1 score is 7.1 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-based attack with low ...

CVE-2026-81292

WordPress Simple Payment plugin versions ≤ 2.5.1 are affected by an unauthenticated Cross Site Scripting (XSS) vulnerability, as reported by Patchstack. The flaw requires user interaction but no prior authentication, and operates over the network with low complexity. The CVSS 3.1 base score is 7....

CVE-2026-81282

Product Variations Swatches for WooCommerce (WordPress plugin) versions

CVE-2026-81281

CVE-2026-81281 is a Cross-Site Scripting (XSS) vulnerability in the Graphene WordPress theme , affecting versions 2.9.4 and earlier . The vulnerability requires a subscriber-level account (low privileges) and user interaction to be exploited. The CVSS v3.1 base score is 6.5 (MEDIUM) with a vector...

CVE-2026-84849

CVE-2026-84849 affects the Pre-Orders for WooCommerce WordPress plugin in versions 2.3 and earlier . The vulnerability is an unauthenticated bypass , meaning no prior login is required to exploit it. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicati...

CVE-2026-85242

PlaywrightCapture is vulnerable to a server-side request forgery (SSRF) in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL against localhost, loopback, and other non-public addresses, but redirects followed by aiohttp were...

CVE-2026-84736

Eclipse aeriOS (current development version, no official release published) has a vulnerability in its Federator component where TLS certificate validation is disabled by default for outbound HTTPS connections. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the...

CVE-2026-85138

SeaCMS versions up to 13.6 contain a SQL injection vulnerability in the WeChat Module (file weixin/index.php). The root cause lies in the addslashes function, where improper handling of the Content argument allows remote, unauthenticated attackers to inject SQL. The attack vector is network-based...

CVE-2026-85239

MISP is vulnerable to a validation bypass in its event template handling. The EventTemplate::beforeValidate() method only applied semantic validation when the definition was already an array; a caller supplying a pre-encoded string (including malformed JSON ) bypassed validateDefinition() and onl...

CVE-2026-85238

MISP contains a session fixation vulnerability in its CustomAuth authentication flow (a custom configuration). The root cause is that __customAuthentication() wrote the authenticated user into the existing CakePHP session without first calling Session->renew(), which had been disabled. An atta...

CVE-2026-53720

pymonocypher (Python bindings to the Monocypher C library) is vulnerable to a heap buffer overflow in the argon2i_32 function prior to version 4.0.2.8 . The root cause is a missing validation of the nb_blocks buffer size: if the caller supplies a buffer smaller than required by the API contract, ...