CVE-2026-59554 WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Ziina = 1.2.21 versions...

CVE-2026-59555 WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.3 versions...

CVE-2026-59547 WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce = 9.1.4 versions...

CVE-2026-59545 WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in miniOrange Discord Integration = 2.2.4 versions...

CVE-2026-59544 WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

CVE-2026-59543 WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution RCE in Advanced Views = 3.8.11 versions...

CVE-2026-59541 WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...

CVE-2026-59542 WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...

CVE-2026-59540 WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.6 versions...

CVE-2026-59526 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-59525 WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

CVE-2026-59524 WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Easy Digital Downloads = 3.6.7 versions...

CVE-2026-59517 WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...

CVE-2026-59522 WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP ERP = 1.17.5 versions...

CVE-2026-59513 WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Masteriyo - LMS = 2.3.0 versions...

CVE-2026-59514 WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Buddyboss Platform = 3.0.5 versions...

CVE-2026-59512 WordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Product Enquiry for WooCommerce = 2.2.34.43 versions...

CVE-2026-57809 WordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in AffiliateWP = 2.34.0 versions...

CVE-2026-57808 WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability

Subscriber Arbitrary Content Deletion in WP EasyPay = 4.5.0 versions...

CVE-2026-57785 WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in ApusListing = 1.2.63 versions...

CVE-2026-57769 WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Grand Photography = 5.7.8 versions...

CVE-2026-57784 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Ninja Forms File Uploads Extension = 3.3.26 versions...

CVE-2026-57767 WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...

CVE-2026-57735 WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Breakdance = 2.7.1 versions...

CVE-2026-57717 WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Knit Pay = 9.6.0.0 versions...

CVE-2026-57716 WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Broadcast Live Video = 7.2.4 versions...

CVE-2026-57704 WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Smart Manager = 8.90.0 versions...

CVE-2026-57703 WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Sunshine Photo Cart = 3.6.10.1 versions...

CVE-2026-57701 WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Real Estate Manager Pro = 12.8.5 versions...

CVE-2026-57699 WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Slider Pro = 4.8.13 versions...

CVE-2026-57696 WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in Picture Gallery = 1.6.5 versions...

CVE-2026-57427 WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-57428 WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Sprout Clients = 3.2.3 versions...

CVE-2026-57425 WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Autopay dla WooCommerce = 2.2.27 versions...

CVE-2026-57384 WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WishList Member X = 3.32.0 versions...

CVE-2026-57397 WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Coaching = 3.9.2 versions...

CVE-2026-57374 WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Funnel Kit Funnel Builder PRO = 3.15.0.7 versions...

CVE-2026-57370 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

CVE-2026-57373 WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability

Customer Cross Site Scripting XSS in Funnel Kit Funnel Builder PRO = 3.15.0.4 versions...

CVE-2026-57367 WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP Booking System 5.12.8.1 versions...

CVE-2026-27423 WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in Participants Database = 2.7.8.4 versions...

CVE-2026-27422 WordPress YT Player plugin <= 2.0.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in YT Player = 2.0.9 versions...

CVE-2026-27418 WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Fast Total Search = 1.81.282 versions...

CVE-2026-27399 WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...

CVE-2026-27403 WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3...

CVE-2026-27392 WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

Contributor Broken Access Control in uListing = 2.2.0 versions...

CVE-2026-27391 WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in uListing = 2.2.0 versions...

CVE-2026-27377 WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress = 1.0.16 versions...

CVE-2026-27355 WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ditty = 3.1.66 versions...

CVE-2026-27372 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...