CVE-2026-42418 WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5...

CVE-2026-42417 WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...

CVE-2026-42415 WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Porto Theme - Functionality = 3.9.3 versions...

CVE-2026-42416 WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability

Subscriber SQL Injection in UDesign Core = 4.15.0 versions...

CVE-2026-42414 WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

Subscriber SQL Injection in ListingPro = 2.9.12 versions...

CVE-2026-42413 WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Snapshotify All-in-One Backup & Restore & Migrate = 1.3.2 versions...

CVE-2026-41562 WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Norvis Backup = 1.1.0 versions...

CVE-2026-41560 WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WXD Backup Lite = 1.0.2 versions...

CVE-2026-41561 WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Museder RestoreOne = 2.7.276 versions...

CVE-2026-41559 WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...

CVE-2026-41555 WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email = 1.5.9 versions...

CVE-2026-40807 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

CVE-2026-40806 WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Blog, Posts and Category Filter for Elementor = 2.1.0 versions...

CVE-2026-39798 WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

Unauthenticated Settings Change in TrueBooker = 1.2.9 versions...

CVE-2026-39796 WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...

CVE-2026-39797 WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...

CVE-2026-39795 WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability

Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...

CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39792 WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Simple File List = 6.3.11 versions...

CVE-2026-39793 WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions...

CVE-2026-39791 WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing = 6.2.3 versions...

CVE-2026-39790 WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7...

CVE-2026-39787 WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in 10Web Social Photo Feed = 1.4.35 versions...

CVE-2026-39788 WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Front End PM = 11.4.6 versions...

CVE-2026-39785 WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1...

CVE-2026-39784 WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Hotel Booking = 3.8 versions...

CVE-2026-39781 WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1...

CVE-2026-39780 WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Youzify = 1.3.7 versions...

CVE-2026-39778 WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ansar Import – One Click Starter Sites – for Elementor & Themes = 2.1.2 versions...

CVE-2026-39776 WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

Editor Remote Code Execution RCE in Tabs = 2.5 versions...

CVE-2026-39775 WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme = 2.2 versions...

CVE-2026-39774 WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tourfic Pro = 1.17.3 versions...

CVE-2026-39773 WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Doctreat Core = 1.7.0 versions...

CVE-2026-39772 WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft = 5.2.8 versions...

CVE-2026-39771 WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

CVE-2026-39770 WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...

CVE-2026-39769 WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Graphina = 3.1.12 versions...

CVE-2026-39768 WordPress Security & Malware scan by CleanTalk plugin <= 2.189 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Security & Malware scan by CleanTalk = 2.189 versions...

CVE-2026-39767 WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability

Subscriber Denial of Service Attack in WPBase Cache = 5.5.6 versions...

CVE-2026-39766 WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

CVE-2026-39765 WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Shop Manager Privilege Escalation in Challan = 3.7.88 versions...

CVE-2026-39764 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services = 1.0.19 versions...

CVE-2026-39762 WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1...

CVE-2026-39761 WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...

CVE-2026-39759 WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability

Employer / Sales Representative Arbitrary File Upload in Workreap Core = 3.4.5 versions...

CVE-2026-39758 WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Midtrans-WooCommerce = 2.32.3 versions...

CVE-2026-39757 WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Taskbot = 6.6 versions...

CVE-2026-39756 WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Wappointment = 2.7.7 versions...

CVE-2026-39755 WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in WP Duplicate = 1.1.11 versions...

CVE-2026-39754 WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability

Contributor Arbitrary File Download in Piotnet Addons For Elementor = 7.1.71 versions...