CVE-2026-57694

CVE-2026-57694 affects the WordPress Tutor LMS plugin up to version 3.9.13, describing an insecure direct object reference (IDOR) vulnerability that enables an authorization bypass via a user-controlled key. The root cause is misconfigured access controls that allow access to restricted resources...

CVE-2026-57401

The connected records document a concrete vulnerability in the WordPress SureDash plugin (Brainstorm Force) up to version 1.8.0. The issue is reported as an improper limitation of a pathname to a restricted directory (path traversal), enabling traversal of the file system. Some sources describe t...

CVE-2026-57412

The CVE-2026-57412 entry concerns the WordPress Gift Vouchers plugin (versions up to 4.6.9). The vulnerability is described as a Missing Authorization issue caused by Incorrectly Configured Access Control Security Levels, i.e., a Broken Access Control vulnerability. Affected component: gift-vouch...

CVE-2026-57391

CVE-2026-57391 affects the WordPress Loops & Logic plugin, versions up to and including 4.2.3. The vulnerability is a stored Cross-Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. Exploitation details, affected exact vectors, and a published fix are...

CVE-2026-57418

CVE-2026-57418 covers a Missing Authorization vulnerability in the WordPress/plugin set associated with Sprout Invoices, specifically the Sprout Invoices Client Invoicing (WordPress plugin, versions up to 20.8.13). The root cause is an Incorrectly Configured Access Control , described as broken a...

CVE-2026-57423

CVE-2026-57423 affects the WordPress plugin Message Filter for Contact Form 7 (cf7-message-filter), specifically versions up to 1.6.3.8. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. Impact is reflected XSS...

CVE-2026-57691

CVE-2026-57691 concerns a Reflected Cross-Site Scripting (XSS) in the WordPress plugin WordPress Anti-Malware Security and Brute-Force Firewall (gotmls) ≤ 4.23.89. The root cause is improper neutralization of input during web page generation. Affected software is the Anti-Malware Security and Bru...

CVE-2026-57406

CVE-2026-57406 : A Missing Authorization vulnerability is reported in the WordPress FundEngine plugin (wp-fundraising-donation) affecting versions up to 1.7.6. The issue is described as broken access control due to incorrectly configured access security levels, enabling exploitation of access con...

CVE-2026-57396

CVE-2026-57396 is a Stored XSS vulnerability in the WordPress Free Gifts for WooCommerce plugin (versions up to 13.1.0). It stems from improper input neutralization during web page generation and can affect the plugin’s output. The CVSS 3.1 vector indicates network attack, no privileges required,...

CVE-2026-57739

CVE-2026-57739 affects the WordPress WordPress Plugin AcyMailing SMTP Newsletter (versions up to and including 10.11.0). The vulnerability is an SQL Injection caused by improper neutralization of special elements in an SQL command, allowing blind SQL injection. According to the provided metrics, ...

CVE-2026-57710

Summary: The WordPress plugin WoowBot Pro Max (woowbot-pro-max) up to version 14.1.7 is affected by an Unrestricted/Arbitrary File Upload vulnerability. The issue allows uploading dangerous files, classified as a Critical risk (CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The affected line is...

CVE-2026-57422

CVE-2026-57422 concerns a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Bopo – WooCommerce Product Bundle Builder (bopo-woo-product-bundle-builder). The issue arises from improper input neutralization during web page generation, allowing an attacker to inject script v...

CVE-2026-57726

CVE-2026-57726 affects the WordPress Kirki plugin (versions up to and including 6.0.12). The issue is an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands, enabling blind SQL injection. The CVSS v3.1 vector indicates high impact with network access, no...

CVE-2026-57718

CVE-2026-57718 describes a Reflected XSS in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates), specifically unlimited-elements-for-elementor, affecting versions from n/a up to and including 2.0.12. The vulnerability stems from improper neutralization of input...

CVE-2026-57702

The WordPress Amelia plugin (Amelia ameliabooking)

CVE-2026-57711

CVE-2026-57711 concerns the WordPress plugin SupportCandy

CVE-2026-57408

CVE-2026-57408 affects the WordPress Peach Payments Gateway plugin wc-peach-payments-gateway

CVE-2026-57419

CVE-2026-57419 concerns the WordPress plugin Stock Locations for WooCommerce (versions up to and including 3.1.8). The vulnerability is described as a Missing Authorization / Broken Access Control issue, arising from incorrectly configured access control security levels. The CVE notes that this a...

CVE-2026-57719

CVE-2026-57719 affects the WordPress plugin Aimogen Pro (versions up to and including 2.8.3). The vulnerability is described as Unrestricted Upload of File with Dangerous Type (Arbitrary File Upload) in Aimogen Pro, allowing attackers to upload malicious files. The CVSS v3.1 metrics indicate a ba...

CVE-2026-57724

CVE-2026-57724 affects the WordPress Kirki plugin (Kirki <= 6.0.12). The root cause is a deserialization of untrusted data leading to PHP Object Injection . According to the sources, this vulnerability can be exploited remotely (network attack vector) with no user interaction and can impact co...

CVE-2026-57733

The CVE-2026-57733 entry concerns the WordPress plugin tagDiv Cloud Library (td-cloud-library) with versions

CVE-2026-57414

CVE-2026-57414 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin “WoowBot” (ChatBot for eCommerce – WoowBot) up to version 4.6.1. The issue is caused by improper neutralization of input during web page generation, allowing stored malicious input to be reflected in pages...

CVE-2026-57729

The CVE-2026-57729 entry details a Missing Authorization (Broken Access Control) flaw in the UX-themes Flatsome WordPress theme for versions up to and including 3.20.5. The underlying issue is an improperly configured access control that can expose data with no privileges required (attack vector:...

CVE-2026-57417

CVE-2026-57417 concerns the WordPress Cart Lift plugin, affected versions are

CVE-2026-57706

CVE-2026-57706 affects the WordPress Dokan Dokan-lite plugin (v

CVE-2026-57740

CVE-2026-57740 describes a Missing Authorization (Broken Access Control) vulnerability in the WordPress AcyMailing Newsletter SMTP Newsletter plugin, affecting versions up to and including 10.11.1. The issue stems from incorrectly configured access control, enabling an attacker with network acces...

CVE-2026-57728

CVE-2026-57728 affects the WordPress Flatsome theme (UX-themes) versions up to and including 3.20.5. It is a Reflected Cross-Site Scripting vulnerability caused by improper neutralization of input during web page generation. The CVSSv3.1 base score is 7.1 (HIGH) with Network attack vector, no pri...

CVE-2026-57398

CVE-2026-57398 : WordPress Real Estate Manager Pro plugin (

CVE-2026-57402

CVE-2026-57402 concerns the WordPress plugin Flexible Refund and Return Order for WooCommerce (versions

CVE-2026-57713

CVE-2026-57713 : The WordPress Plugins Events Manager (events-manager ) is affected up to version 7.3.6. The issue is a PHP Object Injection caused by deserialization of untrusted data, enabling object injection. The affected component is the Events Manager plugin for WordPress; root cause is des...

CVE-2026-57393

CVE-2026-57393 affects the WordPress plugin WooCommerce PDF Invoice Builder (plugin slug woo-pdf-invoice-builder) up to version ≤ 2.0.8. The vulnerability is described as an Exposure of Sensitive System Information to an Unauthorized Control Sphere that allows retrieval of embedded sensitive data...

CVE-2026-57400

The CVE-2026-57400 entry concerns the WordPress plugin Event Tickets Manager for WooCommerce. A Missing Authorization vulnerability is described as due to Incorrectly Configured Access Control Security Levels, affecting the plugin’s “Event Tickets Manager for WooCommerce” component in versions up...

CVE-2026-57403

The CVE-2026-57403 entry concerns the WordPress plugin “GD Security Headers” (GD Security Headers) with versions

CVE-2026-57712

WPZOOM Portfolio plugin

CVE-2026-57693

CVE-2026-57693 concerns the WordPress Ad Inserter plugin (versions up to and including 2.8.11). The issue is an Improper Neutralization of Input During Web Page Generation (XSS) that allows exploitation via incorrectly configured access control. Affected component: Ad Inserter (WordPress plugin)....

CVE-2026-57725

The CVE-2026-57725 entry concerns the WordPress Kirki plugin (Themeum Kirki) with a Stored XSS vulnerability in web page generation. Affected version range is Kirki up to 6.0.11 (exact affected range:

CVE-2026-57695

The CVE-2026-57695 entry relates to the WordPress Document Gallery plugin (

CVE-2026-57421

CRM Perks Forms WordPress plugin (versions

CVE-2026-57715

CVE-2026-57715 affects the WordPress Fluent CRM plugin (Fluent CRM) up to version

CVE-2026-57369

CVE-2026-57369 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Themify Builder (versions up to and including 7.7.4). The issue arises from improper neutralization of user input during web page generation, enabling an attacker to inject script via crafted input that...

CVE-2026-57382

CVE-2026-57382 is a reflected XSS vulnerability in the WordPress plugin Simple File List (version range: affected up to 6.3.8). The issue arises in the plugin’s web page generation and input handling, enabling a reflected cross-site scripting payload. CVSSv3.1 metrics indicate Network attack vect...

CVE-2026-57368

CVE-2026-57368 concerns the NooTheme Jobmonster WordPress theme (noo-jobmonster) with a reflected Cross-Site Scripting (XSS) vulnerability described as caused by improper neutralization of input during web page generation. Affected version range is Jobmonster up to and including 4.8.5. The vulner...

CVE-2026-57375

CVE-2026-57375 describes a missing authorization weakness in the WordPress MStore API (plugin/mstore-api) up to version

CVE-2026-57380

The CVE-2026-57380 entry concerns WordPress Extensions for Leaflet Map (extensions-leaflet-map) with versions up to and including 5.1. It describes an improper neutralization of user input during web page generation, enabling DOM-based cross-site scripting (XSS). Affected component: the Extension...

CVE-2026-57385

Vulnerable software: WordPress Vitepos plugin (vitepos-lite) up to version 3.4.2. Root cause: improper neutralization of special elements in SQL commands enabling blind SQL injection. Impact: high (CVSS v3.1 base 8.5) with network-based attack, low complexity, low privileges, no user interaction;...

CVE-2026-57372

CVE-2026-57372 is a Server-Side Request Forgery (SSRF) vulnerability affecting the WordPress WPJAM Basic plugin (wpjam-basic) versions up to and including 7.0. The CVE entry states the issue is a SSRF in WPJAM Basic, but the provided documents do not specify the underlying code path, affected fun...

CVE-2026-57378

The CVE-2026-57378 entry describes a Missing Authorization vulnerability in the WordPress plugin Advanced Forms (Phil Kurth) affecting versions up to and including 1.9.3.7. The issue arises from incorrectly configured access control, enabling unauthorized actions without sufficient privileges. Do...

CVE-2026-57379

The CVE-2026-57379 entry is for the WordPress FormyChat plugin (WPPOOL FormyChat social-contact-form) with a stored XSS in versions up to 2.15.3 due to improper input neutralization during web page generation. Affected product: FormyChat plugin (

CVE-2026-57387

CVE-2026-57387 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin picu (versions up to and including 3.5.1). The issue arises from improper neutralization of input during web page generation, enabling an attacker to inject malicious scripts that are stored and later rend...

CVE-2026-57364

The CVE-2026-57364 entry concerns the WordPress plugin WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More (better-payment) up to version 2.2.0. It describes improper validation of a specified quantity in input, leading to access to functionality not prop...