CVE-2026-66704 WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66697 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66698 WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SureDash = 1.10.1 versions...

CVE-2026-66693 WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability

Subscriber Broken Access Control in Motors = 1.4.113 versions...

CVE-2026-66689 WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Anti Spam and list cleaner AcyChecker = 2.0.0 versions...

CVE-2026-66691 WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Nokri = 1.6.6 versions...

CVE-2026-66687 WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Customer Cross Site Scripting XSS in WpBookingly = 1.3.2 versions...

CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

CVE-2026-66661 WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-66658 WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

CVE-2026-66657 WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...

CVE-2026-66656 WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Foton Core = 1.1.1 versions...

CVE-2026-66654 WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-66655 WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

CVE-2026-66653 WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...

CVE-2026-66472 WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

CVE-2026-66478 WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...

CVE-2026-66471 WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...

CVE-2026-66469 WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...

CVE-2026-66468 WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Local Delivery Drivers for WooCommerce = 3.0.0 versions...

CVE-2026-66466 WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart = 2.1.1 versions...

CVE-2026-66467 WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in FluentCommunity = 2.7.5 versions...

CVE-2026-66465 WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...

CVE-2026-66463 WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in iCARRY = 2.9 versions...

CVE-2026-66464 WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...

CVE-2026-66462 WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...

CVE-2026-66461 WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce = 1.0.5 versions...

CVE-2026-66460 WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

CVE-2026-66458 WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in RealPress = 1.1.2 versions...

CVE-2026-66456 WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-66454 WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

CVE-2026-66455 WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in ReactPress = 3.4.0 versions...

CVE-2026-66453 WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...

CVE-2026-66449 WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

CVE-2026-66446 WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

CVE-2026-66443 WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-66444 WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-66436 WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in Active Products Tables for WooCommerce = 1.1.1 versions...

CVE-2026-66441 WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

CVE-2026-66432 WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...

CVE-2026-66430 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66429 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66426 WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...

CVE-2026-65582 WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-65580 WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...

CVE-2026-61984 WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WPMobile.App = 11.77 versions...

CVE-2026-61980 WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-61979 WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...

CVE-2026-61978 WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter Piraeus Bank = 1.0.32 versions...