CVE-2026-65487 WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Photography = 7.7.6 versions...

CVE-2026-65486 WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event post = 6.0.1 versions...

CVE-2026-65485 WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...

CVE-2026-65484 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Contributor Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-65482 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in LA-Studio Element Kit for Elementor = 1.6.2 versions...

CVE-2026-65483 WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in HashThemes Demo Importer = 1.4.2 versions...

CVE-2026-65481 WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Vino = 1.9 versions...

CVE-2026-65479 WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Reviewer = 3.14.2 versions...

CVE-2026-65480 WordPress TheGem theme <= 5.11.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in TheGem = 5.11.1 versions...

CVE-2026-65478 WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in ListingPro = 2.9.10 versions...

CVE-2026-65477 WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

CVE-2026-65476 WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi = 2.2.4 versions...

CVE-2026-65474 WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...

CVE-2026-65473 WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12 versions...

CVE-2026-65472 WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kit formerly ConvertKit = 3.3.5 versions...

CVE-2026-65471 WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...

CVE-2026-65469 WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AWP Classifieds = 4.4.7 versions...

CVE-2026-65470 WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...

CVE-2026-65468 WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JetBooking = 4.1.2 versions...

CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...

CVE-2026-65466 WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability

Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...

CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in GiveWP = 4.16.3 versions...

CVE-2026-65465 WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.1.1 versions...

CVE-2026-65463 WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

CVE-2026-65461 WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability

Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...

CVE-2026-65462 WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

CVE-2026-65460 WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...

CVE-2026-65458 WordPress Polylang plugin <= 3.8.5 - Sensitive Data Exposure vulnerability

Contributor Sensitive Data Exposure in Polylang = 3.8.5 versions...

CVE-2026-65457 WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in ЮKassa для WooCommerce = 2.16.1 versions...

CVE-2026-65456 WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...

CVE-2026-65454 WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

CVE-2026-65455 WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability

Administrator Arbitrary File Upload in MapSVG = 8.14.0 versions...

CVE-2026-65453 WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ebook Store = 6.19 versions...

CVE-2026-65452 WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ebook Store = 6.19 versions...

CVE-2026-65451 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

Contributor SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-65450 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

Contributor SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-65449 WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in MapSVG = 8.14.0 versions...

CVE-2026-61981 WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Simple Link Directory Pro = 15.0.8 versions...

CVE-2026-61973 WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in ShopLentor Pro = 2.8.5 versions...

CVE-2026-61972 WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ShopLentor Pro = 2.8.5 versions...

CVE-2026-61954 WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PayU India = 3.8.9 versions...

CVE-2026-61951 WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in TrueBooker = 1.2.3 versions...

CVE-2026-61950 WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in TrueBooker = 1.2.3 versions...

CVE-2026-61949 WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in Bookly = 27.7 versions...

CVE-2026-61947 WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...

CVE-2026-61948 WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-61944 WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Bookly = 27.7 versions...

CVE-2026-61946 WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...

CVE-2026-61943 WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-59555 WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.3 versions...